PRIVACY POLICY

Effective Date and Last Updated

Effective date: September 3, 2026. Last updated: September 3, 2026.

Who We Are and Scope of This Policy

House of Lushes is a small, Alberta-based Canadian business selling handcrafted self-care products online. This policy explains how we handle personal information collected through this website — our shop, checkout, email subscription form, and email enquiries.

It does not cover other companies' websites or social media platforms that you may reach through links from our site. This policy describes our actual practices; it is not legal advice and does not guarantee compliance with any particular law.

Information We Collect

We collect only the information needed to sell and ship our products and to send emails you have asked for.

• Order and checkout information: your name, email address, billing address, complete shipping address, and the products and quantities in your order. Our checkout does not ask for a telephone number and has no delivery-instructions field.
• Payment-related information we keep after checkout: a payment reference, payment status (for example, pending or paid), item subtotal, shipping amount, tax amount, order total, currency, and the date of the order.
• Email subscription information: your email address, your subscription status, the date you subscribed and (if applicable) unsubscribed, where the consent was given (our homepage sign-up section), the wording and version of the consent statement you agreed to, and a private unsubscribe token used to process your unsubscribe link.
• Customer enquiries: if you email us, we receive your email address, your message, and anything else you choose to include. Enquiries are handled through our email inbox; this website does not store a database of support messages.

Information Collected Automatically

We do not run analytics software, advertising pixels, or tracking cookies on this website.

When you subscribe to our emails, your IP address is read momentarily to limit repeated automated submissions. It is used for that check only and is not written to our records.

Your browser stores your shopping bag locally on your own device so your items are still there when you return. That information stays in your browser and is not sent to us as a stored record.

Like any website, our hosting and backend providers may generate technical operational logs (such as request and error logs) as part of running the service. We do not use those logs to build profiles of visitors.

How We Use Personal Information

• To process, fulfil, and ship your order, and to keep an accurate business record of it.
• To respond to your questions, order issues, and support requests.
• To send promotional emails about new releases, restocks, limited drops, and self-care updates — only if you have subscribed.
• To protect our website against abuse, such as limiting repeated automated form submissions.

Orders and Payment Processing

Payments are processed by Stripe. Your payment card details are entered into Stripe's secure checkout and are handled by Stripe. House of Lushes does not receive or store complete card numbers, card expiry data, or security codes at any point.

What we do keep is payment metadata returned by Stripe: a payment reference for your transaction, whether it was paid, the amounts (subtotal, shipping, tax, total), the currency, and the items ordered, along with your name, email, billing address, and shipping address.

An order is only marked as paid once Stripe confirms the payment was successful. Stripe sends you a payment receipt directly.

Email Subscriptions and Marketing Consent

Subscribing to our emails is entirely voluntary and consent-based. We record the date of your consent, the source of the sign-up, and the exact wording and version of the consent statement shown to you at the time, so that we can demonstrate the basis for emailing you.

You can withdraw your consent at any time. We do not sell, rent, or share our subscriber list.

When Information Is Shared

We do not sell or rent your personal information, and we do not share it for advertising purposes. We do share limited information with the service providers listed below, who process it on our behalf so that the website, payments, and deliveries work. We may also disclose information where we are legally required to do so.

Service Providers

• Stripe — processes payments and handles card data, and receives the name, email, billing address, and shipping address you enter at checkout.
• Lovable — provides the platform and hosting infrastructure that runs this website.
• Lovable Cloud (built on Supabase) — provides the managed database where our order records and email subscriber records are stored.
• Shipping carriers — receive the delivery name and address needed to carry and deliver your parcel, and provide tracking information.

Processing or Storage Outside Canada

Some of your information is stored and processed outside Canada. Our managed database is hosted in the United States (an AWS region in the eastern United States), so order and subscriber records are stored there. Stripe and our platform and hosting providers also operate internationally and may process information outside Canada.

While information is held in another country, it may be accessible to the courts, law enforcement, and national security authorities of that country under its laws.

Retention and Disposal

We keep personal information only for as long as it is needed for the purpose it was collected, and for as long as we are required to keep business and tax records of a sale.

Order records are kept as part of our business records. Email subscriber records are kept while you remain subscribed; if you unsubscribe, we keep a minimal record of the unsubscribe so that we do not email you again. We have not set a fixed number of years for deletion, and we do not want to promise a schedule we do not follow.

You can ask us to delete information we hold about you at any time, and we will do so unless we are required to keep it as a legal or business record. Deletion requests are handled manually by our team.

Security Safeguards

We take reasonable steps to protect personal information, but no website or method of transmission can be guaranteed to be completely secure, and we do not claim otherwise.

• Card payments are handled entirely by Stripe on secure, encrypted pages; we never see full card details.
• Our database uses row-level security so that order records and subscriber records are not readable by website visitors — they are only accessible to our restricted server-side access.
• Checkout, pricing, stock, and email sign-ups are validated on our server, so totals and product prices cannot be altered from a customer's browser.
• Website traffic is served over encrypted HTTPS connections.
• Unsubscribe links use a private, randomly generated token rather than exposing your email address.
• Administrative credentials are held only on the server and are never included in the website code sent to your browser.

Customer Privacy Rights

Subject to applicable Canadian privacy law, including Alberta's Personal Information Protection Act, you may ask what personal information we hold about you, why we have it, how it has been used, and who it has been shared with. You may also ask us to correct information that is inaccurate or incomplete, or to delete it. You may withdraw consent for marketing emails at any time.

Access, Correction, and Deletion Requests

Email info@lusheshq.com with your request and the email address you used when ordering or subscribing, so that we can locate your records. Our Customer Support team responds within 3–5 business days.

We may need to keep certain records — such as details of a completed sale — where we have a legitimate legal, accounting, or business-record obligation to do so. If we cannot fully action a request, we will tell you why.

Withdrawing Marketing Consent and Unsubscribing

Every marketing email includes an unsubscribe link, and you can also use the unsubscribe page on this website. Selecting the link processes your request immediately: your subscription is marked as unsubscribed at that moment and the date is recorded, in keeping with Canada's anti-spam legislation (CASL).

Withdrawing marketing consent does not affect emails we must send about an order you have already placed, such as a payment receipt or shipping information.

Cookies and Analytics

This website does not use analytics services, advertising networks, tracking pixels, or third-party marketing cookies, and we do not sell or share browsing data.

Your browser saves your shopping bag on your own device so it is not lost between visits. Clearing your browser storage will clear your bag. Stripe may use its own cookies or similar technologies on its secure payment pages for fraud prevention and to make payment work; that processing is governed by Stripe's own privacy policy.

Changes to This Policy

We may update this policy as our business or practices change. When we do, we will revise the effective and last-updated dates at the top of this page. We encourage you to review it occasionally.

Contact Us

For any privacy question, or to request access to, correction of, or deletion of your information, email info@lusheshq.com. House of Lushes is based in Alberta, Canada. Our Customer Support team responds within 3–5 business days.