DRAFT — please review and complete this policy before relying on it. It is grounded in how the Myxmh store actually works, but the items marked [OWNER: …] need your real business details, and the whole document should be checked by someone qualified for the markets you sell to (EU/UK/US, etc.).
Last updated: [OWNER: date you publish this]
1. Who we are
Myxmh (“we”, “us”, “our”) operates this online store, offering handmade ritual soaps, crystal bracelets and related items. This Privacy Policy explains what personal data we collect, why, how we use and protect it, and the rights you have over it.
The data controller is:
- [OWNER: registered business / legal entity name]
- [OWNER: business address]
- [OWNER: contact email for privacy requests, e.g. [email protected]]
EU / UK representative. If the controller above is established outside the EU and the UK, we are required to appoint representatives in those regions:
- EU representative (Art. 27 GDPR): [OWNER: name, EU address and email — or state “not required, controller is established in the EU”]
- UK representative (Art. 27 UK GDPR): [OWNER: name, UK address and email — or state “not required, controller is established in the UK”]
2. What we collect
We only collect what we need to run the shop and serve you.
- Order & delivery details — name, billing and shipping address, email address, phone number, and the items you order. Needed to process and deliver your purchase.
- Payment information — your card or wallet payment is handled directly by our payment processor, Stripe (including Apple Pay and Google Pay). Full card numbers are entered into Stripe’s secure fields and are not stored on our servers; we retain only limited details such as the payment status and the last four digits for order records.
- Account information — if you create an account: your username, email, a securely hashed password, order history, and saved addresses.
- Loyalty, wallet & birthday — if you join our “Inner Circle” programme: your Aura points, membership tier and any store‑credit / wallet balance, together with a transaction history of each credit and debit (amount, reason, related order and date). If you choose to add your birthday (month and day only), we store it solely to send you an annual birthday reward.
- Reviews — if you post a product review, your display name and the review text are stored and shown publicly on the product page; WordPress also stores the associated email address and IP with the comment. Approved reviews from verified purchases may earn loyalty points.
- Roll‑to‑Donate — if you use our dice donation feature, we keep a record linked to your order and account (the amount, the die result and the date) to maintain the shared fundraising total.
- Communications — if you subscribe to our newsletter, your email address; if you contact us, the content of your message.
- Referrals — each account has its own referral code. If you sign up through someone’s referral link, we record which member referred you and link the two accounts in order to administer referral rewards; store administrators can see aggregate referral counts.
- Technical & usage data — your IP address and approximate country (used to show prices in a suitable currency and to help prevent fraud), browser type, and pages viewed. Some preferences (your chosen language and currency, and recently‑viewed products) are stored in your browser.
Providing your order, delivery and payment details is necessary to enter into and perform your purchase contract — without them we cannot process or ship your order. Everything else (an account, newsletter sign‑up, a review, your birthday, using Roll‑to‑Donate) is optional.
3. Cookies & local storage
We use only first‑party, functional cookies. We do not use advertising cookies or third‑party tracking/analytics.
| Cookie / item | Purpose | Duration |
|---|---|---|
| WooCommerce cart & session | Keep your cart and let you check out (strictly necessary) | Session – up to ~2 days |
Login session (wordpress_*) |
Keep you signed in | Session (or ~14 days with “remember me”) |
mh_currency |
Remember your chosen currency | 30 days |
mh_ref |
Remember a referral link you followed | 30 days |
mh_cookie_consent |
Remember your cookie choice | 180 days |
| Local storage (language, recently‑viewed) | Remember preferences in your browser | Until you clear it |
You can accept or decline non‑essential cookies via the notice shown on the site, and you can clear cookies at any time in your browser settings. Declining does not stop the strictly necessary cookies required for the cart and checkout to function.
4. Why we use your data, and our legal bases
- To fulfil your order and contract (process payment, ship goods, provide support, manage your account, loyalty, wallet and referral rewards) — legal basis: performance of a contract.
- To keep the store working and secure (remember your cart/currency/language, display product reviews, prevent fraud and abuse) — legal basis: legitimate interests.
- To publish a review you submit, and to add your optional birthday — legal basis: consent (you choose to post/provide it), which you can withdraw.
- To send newsletters or marketing — only where you have opted in — legal basis: consent, which you can withdraw at any time.
- To meet legal and tax obligations (e.g. keeping order and payment records) — legal basis: legal obligation.
5. Automated decision‑making
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Our payment processor (Stripe) may run automated fraud and risk checks on transactions as part of processing your payment; if a payment is declined for such reasons you can contact us or Stripe.
6. Who we share it with
We do not sell your personal data. We share it only with service providers that help us run the store, and only as needed:
- Stripe — payment processing. See Stripe’s privacy policy at stripe.com/privacy.
- Shipping / delivery providers — [OWNER: name your carriers, e.g. postal service / courier] to deliver your order.
- Hosting & infrastructure — our web host and content‑delivery/security network (Cloudflare), which process technical data such as your IP address to serve and protect the site.
- Authorities — where required by law.
[OWNER: add any other tools you connect later — e.g. email/marketing service, analytics — and disclose them here before turning them on.]
7. International transfers
Some of our providers (such as Stripe and Cloudflare) may process data outside your country. Where that happens, it is done under appropriate safeguards such as the providers’ standard contractual clauses. [OWNER: confirm this reflects your setup.]
8. How long we keep it
We keep order and payment records for as long as needed to fulfil your order and to meet legal, accounting and tax requirements [OWNER: state your retention period, e.g. 6–10 years for order/tax records per local law]. Account, loyalty, wallet and referral data is kept while your account is active; newsletter data until you unsubscribe; reviews remain published until removed. You can ask us to delete data we are not legally required to keep.
9. Your rights
Depending on where you live, you may have the right to: access the data we hold about you; correct it; delete it; restrict or object to certain processing; receive a copy in a portable format; and withdraw consent at any time. To exercise any of these, contact us at [OWNER: privacy contact email]. You also have the right to complain to your local data‑protection authority.
10. Security
The site runs over encrypted HTTPS connections, passwords are stored hashed, and payment card data is handled by Stripe rather than stored by us. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.
11. Children
Our store is intended for adults and is not directed at children. We do not knowingly collect data from children [OWNER: state the age threshold for your markets, e.g. under 16 in the EU].
12. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows when it last changed; significant changes will be highlighted on the site.
13. Contact
For any privacy question or request, contact [OWNER: privacy contact email / postal address].
