Privacy policy

This policy explains what AURALIGHT (“we”, “us”) collects when you use auralight.shop, why we collect it, and what control you have over it. The short version: we collect the minimum needed to sell you lights, run account rewards and get orders to your door. We don’t sell your data, and you can ask us to delete it.

1. What we collect

• Order data — name, email, shipping address and the items you bought. Collected at checkout, stored in our database (hosted on Supabase), and kept for as long as required for accounting and warranty claims.
• Payment data — handled entirely by Stripe. Your card number never touches our servers; we receive only a payment confirmation, the last four digits and the billing country.
• Rewards and link data — account points, tier, campaign links, link clicks, attributed orders, affiliate profile details and commission records. A random visitor identifier and link code may be kept in your browser for 30 days after you open a shared link.
• Support messages — anything you send through the contact form or by email, kept so we can follow the conversation.
• Technical data — if you accept analytics cookies, anonymised page views and general referral sources. See the cookie policy.

2. What we use it for

• Fulfilling and shipping your orders, and sending order updates.
• Crediting points, applying shared-link discounts and calculating affiliate commissions.
• Detecting duplicate, fraudulent or self-referred reward activity.
• Handling returns, refunds and warranty claims.
• Answering support requests and meeting legal obligations.
• Understanding, in aggregate, which products people care about.

We do not sell or rent personal data, and we don’t run third-party advertising trackers.

3. Who we share it with

• Stripe — payment processing (their policy).
• Supabase — database hosting for orders, rewards and support messages.
• Vercel — website hosting and delivery.
• Shipping carriers — your name and address, so the parcel arrives.

Each provider processes data only on our instructions. We share data with authorities only where the law requires it.

4. How long we keep it

Order, reward and commission records are kept for the period required for accounting, fraud prevention and resolving programme disputes. Order records are typically retained for 6–7 years, depending on jurisdiction. Support conversations are kept for 24 months after the last message. Optional analytics data is anonymised.

5. Your rights

Depending on where you live (including under the GDPR and CCPA), you can ask us to access, correct, export or delete the personal data we hold about you, object to processing, or withdraw consent for optional cookies. Email privacy@auralight.shop and we’ll respond within 30 days. You can clear an unredeemed shared-link cookie through your browser settings. You may also complain to your local data protection authority.

6. Security

Traffic is encrypted end-to-end (TLS). Databases are access-controlled with row-level security, and payment credentials never reach our infrastructure. No system is perfect; if a breach ever affects your data, we will notify you without undue delay.

7. Children

The store is not directed at children under 16 and we do not knowingly collect their data. If you believe a minor has provided us data, contact us and we will delete it.

8. Changes

If this policy changes materially, we’ll flag it on the site before the change takes effect. The “last updated” date at the top reflects the current version.

9. Contact

Privacy questions: privacy@auralight.shop. Everything else: the contact page.