Privacy, plainly.

What we collect

We collect only what an order and an email list actually need:

• Order details — name, email, phone if you give it, delivery address, what you bought, and the order note.
• Account-less by design — there are no customer logins, so we hold no password for you.
• Payment — card details go directly to Stripe. They never reach our server; we only see the outcome and a transaction reference.
• Newsletter — your email address, if you subscribe.
• Basic request logs — IP and user agent, kept for security and abuse prevention.

Why we hold it

To take payment, deliver an order, handle returns within the 30-day window, and answer your emails. Newsletter addresses are used to send the newsletter and nothing else. We do not sell, rent or share personal data with advertisers, and we do not run third-party ad trackers on this site.

Who else touches it

A short list, all under contract:

• Stripe — card processing and payment security.
• Our carrier — name, address and phone, so the parcel can be delivered.
• Our own mail server — order confirmations and support replies.

No analytics, advertising or social tracking pixels are loaded on this site.

How long we keep it

Order records are kept for seven years because tax law requires it. Newsletter addresses stay until you unsubscribe. Request logs are rotated within 30 days. When a retention period ends the record is deleted, not archived.

Your rights

Email noor@nzsbeauty.com and we will, within 30 days: send you a copy of everything we hold about you, correct anything wrong, delete anything we are not legally required to keep, or stop emailing you. You do not need to give a reason. If you are in the EU or UK you also have the right to complain to your data protection authority.

Cookies

The storefront uses two things in your browser: a local storage entry remembering your light/dark preference, and a local storage entry holding your shopping bag. Neither leaves your device and neither identifies you. A session cookie is set only for store administrators after signing in, and it is HttpOnly, Secure and SameSite.

Security

The site is served over TLS with HSTS. Payments are handled entirely by Stripe, so we never store card data. Administrative access is password-protected with scrypt-hashed credentials, rate limiting and a short session lifetime. If we ever suffer a breach affecting your data, we will tell you directly and quickly rather than burying it.