Privacy Policy

This Privacy Policy explains how we collect, use, and protect your information when you visit our site, place an order, or send us your iris photo.

We wrote this in plain language. If anything is unclear, contact us — see footer.

What we collect

When you visit the site

• Pages you view, items you click, time spent — collected via cookies for analytics (Shopify Analytics, Google Analytics, Meta Pixel).
• Your IP address, device type, browser — used to detect fraud and improve the site.

When you place an order

• Name, shipping and billing address, email, phone number, payment information.
• Products ordered, sizes, materials, customizations.
• Payment is processed by Shopify Payments, Affirm, Afterpay, Klarna, Apple Pay, Google Pay, or Shop Pay — we never store your full card number.

When you send us your iris photo

• Your iris image and any associated metadata (capture timestamp, device).
• This is biometric information. We treat it with extra care (see below).

How we use your information

• To process and ship your order.
• To prepare your digital preview and craft your piece.
• To email you about your order, your preview, shipping updates, and post-order follow-up.
• To answer customer service questions.
• To analyze site usage and improve the experience.
• To send marketing emails (only if you opt in — you can unsubscribe any time).

We do not sell your personal information. We do not rent it. We do not share it with third parties for their own marketing.

Your iris data — special protections

Your iris photo is biometric information. We treat it accordingly:

• Stored encrypted at rest and in transit.
• Used only to craft the piece you ordered. Never used for AI model training. Never used for biometric identification.
• Kept on file so you can re-order or order new pieces from the same iris later — unless you ask us to delete it.
• Never shared with third parties, advertisers, government agencies (except as required by law), or anyone else.

You can request deletion of your iris photo any time by emailing us. We delete within 30 days and confirm by email.

Who we share information with

We share information only with service providers who help us run the store:

• Shopify — store platform and payment processing
• Shipping carriers (FedEx, UPS, USPS) — to deliver your piece
• Email service providers (Klaviyo) — to send order and marketing emails
• Analytics providers (Google Analytics, Meta Pixel) — to understand site usage
• Customer support tools — to answer your questions

Each provider is contractually required to protect your information and use it only to perform services for us.

Your rights

Depending on where you live, you have rights to:

• Access the information we hold about you
• Correct inaccurate information
• Delete your information ("right to be forgotten" under GDPR, CCPA)
• Restrict or object to certain processing
• Receive a copy of your data in portable form
• Opt out of marketing at any time

To exercise any of these rights, contact us. We respond within 30 days.

California residents have additional rights under the CCPA, including the right to know what categories of personal information we collect, and the right to opt out of "sale" of personal information (we don't sell, but you can confirm this).

EU/UK residents have rights under GDPR. Our lawful basis for processing is contract performance (to fulfill your order) and legitimate interest (to improve the service and prevent fraud).

Cookies

We use cookies for:

• Essential — cart, checkout, login (cannot be disabled)
• Analytics — to understand how the site is used
• Marketing — to show relevant ads on other sites

You can control cookies in your browser settings. You can also opt out of analytics and marketing cookies via our cookie banner.

Data security

We use industry-standard security: TLS encryption, secure data centers, restricted internal access. No system is 100% secure, but we take reasonable precautions to protect your information.

If we ever experience a data breach affecting your personal information, we'll notify you within 72 hours.

International transfers

By using the site, you understand your information may be processed in either jurisdiction (US or EU). We rely on Standard Contractual Clauses (SCCs) for EU–US transfers.

Children

This site is not intended for children under 16. We do not knowingly collect information from children. If you believe a child has provided us information, contact us and we'll delete it.

Changes to this policy

We may update this Privacy Policy occasionally. The date above reflects the most recent change. For material changes, we'll notify you by email.