Privacy Policy

What we collect

We only collect what we need to sell you a product or hold your appointment.

• Order information — name, email, shipping address, and the items you bought.
• Booking information — name, email, optional phone number, and the service, date and time you selected.
• Contact form submissions — name, email, subject and message.
• Usage data — anonymous statistics about which pages are visited, only if you accept analytics cookies.

We do not collect or store card details. Payments are handled entirely by Stripe and card data never reaches our servers.

Why we collect it

• To fulfil and deliver your order, and to email you its confirmation
• To confirm, remind you about, or amend your appointment
• To answer your questions when you contact us
• To understand which parts of the site work, so we can improve them

We do not sell your personal data, and we never have.

Cookies

You control non-essential cookies through the banner shown on your first visit.

• Essential — remember your cart and keep checkout secure. These cannot be switched off, because the site cannot function without them.
• Analytics — anonymous page-level statistics. Off unless you accept.
• Marketing — used to measure campaigns. Off unless you accept.

Your cart is stored in your own browser's local storage, not on our servers. Clearing your browser data clears your cart.

Who we share data with

• Stripe — payment processing. Stripe receives the payment details and the order amount.
• Our email provider — to send order and booking confirmations.
• Shipping carriers — the delivery address, so your parcel can reach you.

Each of these receives only what it needs to do its job, and nothing more.

How long we keep it

Order and booking records are kept for seven years, because tax and accounting rules require it. Contact messages are kept for two years. Analytics data is retained for 14 months.

Your rights

You can ask us to:

• Give you a copy of the personal data we hold about you
• Correct anything that is wrong
• Delete your data, where we are not legally required to keep it
• Stop sending you marketing, at any time

Email hello@pholarnatural.com and we will respond within 30 days.

Security

The site is served over HTTPS and payment processing is delegated to Stripe, a PCI-DSS Level 1 provider. No system is perfectly secure, but we do not hold the data that would be most damaging to lose.

See also our terms of service.