Privacy Policy

LustraFlow ("we", "us", "our") sells filtered showerheads and replacement filters direct to consumers. This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have. It applies to lustraflow.com and to any order you place with us.

Information we collect

When you place an order we collect your name, email address, phone number and shipping address. We also receive a payment reference and the last four digits of your card from our payment processor — we never receive or store your full card number. If you use the subscriber portal we store your email address and a hashed, single-use verification code. We collect basic technical information such as browser type, device type and pages visited, and we use cookies that are necessary for checkout and for measuring aggregate traffic.

How we use it

We use your information to process and ship orders, to charge recurring refills you have authorised, to send order confirmations and tracking updates, to provide customer support, to prevent fraud, and to meet our legal and tax obligations. With your consent, we may send occasional product emails; every one of them includes a one-click unsubscribe link.

Who we share it with

We share only what is necessary with the providers that run our store: Square (payments and subscription billing), CJdropshipping (warehouse fulfilment and shipping), our email provider (transactional email), and our hosting provider. These providers are contractually limited to using your data to perform services for us. We do not sell your personal information, and we do not share it with advertising networks for cross-site behavioural targeting.

Cookies

We use strictly necessary cookies to keep your checkout secure and to remember your subscriber-portal session. We may use aggregate analytics to understand which pages are useful. You can block cookies in your browser, but checkout and the subscriber portal will not work without the necessary ones.

How long we keep it

Order and tax records are kept for as long as the law requires, generally seven years. Subscriber-portal verification codes expire within fifteen minutes and are deleted after use. Marketing contact details are kept until you unsubscribe or ask us to delete them.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to certain processing, and to opt out of the sale or sharing of personal information. To exercise any of these rights, email support@lustraflow.com. We will verify your request and respond within the timeframe required by applicable law. You will never be discriminated against for exercising a privacy right.

Security

Card data is tokenised in your browser by Square and never touches our servers. We use TLS for all traffic, hash verification codes, restrict access to order data, and keep our dependencies patched. No system is perfectly secure, but we take these obligations seriously and will notify affected customers if a breach occurs.

Children

Our store is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us with personal data, contact us and we will delete it.

Contact

Questions about this policy or your data? Email support@lustraflow.com. We may update this policy from time to time; the date at the top reflects the current version.