Privacy Policy — Sacred Eye Beauty

Effective Date: September 10, 2026 · Last updated: September 10, 2026 · sacredeye-beauty.com

This policy describes what Sacred Eye Beauty™ collects when you use sacredeye-beauty.com, why, who else sees it, and what you can ask us to do about it. It describes this site and nothing else — the tools named below are the tools actually running, and if that list changes, this page changes with it.

The company responsible for your information is Sacred Eye Beauty™, 407 Lincoln Rd, 500 Miami Beach, FL 33139, United States. You can reach us about anything on this page at hello@sacredeye-beauty.com.

01 Information We Collect

What you give us directly

When you place an order — your first and last name, email address, phone number, and shipping address (street, apartment, city, state, ZIP code and country). Every one of these is required except the apartment line: the phone number is what a courier uses when a delivery goes wrong.
When you create an account — your email address and a password, which is stored hashed and cannot be read back by us or by anyone who obtained a copy of our database. You may also save your name, phone number and whether you want marketing email.
When you sign up for a discount code or our newsletter — your email address. We also record the IP address and browser the signup came from, which exists to stop automated abuse of the form and nothing else.
When you write to us — whatever you choose to put in the message, along with the address you sent it from.
When you write a review — the name you choose to be shown under, your email address, a rating, your words, and a photograph or video if you attach one. A review is published. The name, the rating, the words and the file are shown publicly on our Site once a moderator approves them; your email address is not, and is used only to recognise whether you have ordered from us and to reach you if we have a question. We also record a one-way hash of your IP address, as described below, to stop automated abuse of the form. Any photograph or video you send is re-encoded before it is published, which removes the location, camera and owner information that phones write into image and video files.

Your card details never reach us. Payment fields on our checkout page are hosted by Stripe and submitted straight to Stripe; your card number, expiry and security code do not pass through our servers and are not stored by us in any form. What comes back to us is confirmation that a payment succeeded, the amount, and Stripe's reference for it. We cannot see your full card number, and our access to Stripe is deliberately restricted so that we cannot retrieve it later either.

What we collect automatically

Standard server records of requests to the Site — IP address, browser and device type, the page requested and the time — kept for security, error diagnosis and abuse prevention.
Which pages you viewed and how you moved through the Site, only if you allow analytics cookies. If you do not, this is never collected.
If you arrived through an affiliate or referral link, we record the visit so the person who recommended us can be credited. The IP address is stored as a one-way cryptographic hash, not as an address: it lets us recognise that two visits came from the same place without our ever holding where that place is, and it cannot be reversed back into an IP address.

02 How We Use Your Information

Process, fulfil and ship your order, and handle returns, refunds and support requests
Manage your account, your order history and your invoices
Send transactional email — order confirmations, shipping notices, password resets and account notices. These are part of the service and are sent whether or not you accept marketing.
Send you a reminder if you leave items in your cart and gave us your email address on the way to checkout. It carries an unsubscribe link like any other marketing message.
Send marketing email where you have opted in, and stop the moment you unsubscribe
Measure whether our advertising works, where you have allowed marketing cookies — see section 04
Publish your review, if you write one and a moderator approves it, together with the name you gave and any photograph or video you attached
Detect and prevent fraud, abuse of our signup forms, and security incidents
Meet legal, tax and accounting obligations and enforce our Terms of Service

We do not build advertising profiles of you on this Site, we do not use your information to make automated decisions about you, and we do not enrich what you give us with data bought from anyone else.

03 Cookies & Tracking Technologies

Nothing optional runs until you say so. On your first visit the Site shows a cookie banner with Accept and Reject offered equally. Until you press one of them, only the strictly necessary cookies below are set — no analytics, no advertising, and no request is made to Google or Meta at all. Refusing means those tools are never loaded, not that they are loaded and told to behave.

You can change or withdraw your choice at any time through the Cookie preferences link in the footer of every page. Withdrawing consent is as easy as giving it, and it takes effect immediately.

Strictly necessary — always on

sacred-eye-beauty-session — keeps your session while you browse. Expires after two hours of inactivity.
XSRF-TOKEN — a security token that stops another site submitting forms on your behalf. Session length.
seb_cart — identifies your basket so it survives closing the tab. 60 days.
seb_consent — remembers the cookie choice you just made, so we stop asking. One year.
A sign-in cookie, set only if you have an account and choose to stay signed in.

These cannot be switched off, because the cart, the checkout and signing in do not work without them.

Analytics — only if you allow it

_ga, _ga_* — Google Analytics 4. Tells us which pages get read and where people give up. Not used to identify you.

Marketing — only if you allow it

_fbp, _fbc — set by Meta, so Meta can tell which of our Facebook and Instagram ads led to a sale.
_gcl_au — set by Google, for the same purpose on Google Ads.
seb_ref — first-party. Remembers the referral link that brought you here for 30 days, so whoever recommended us is credited if you order. If you refuse or withdraw marketing consent we delete this one on your next page view, even if it was set before you answered.

Your browser settings are a further control, and you can block or delete cookies there at any time. Blocking the strictly necessary ones will stop the cart and checkout from working.

04 Third Parties We Share Information With

We do not sell your personal information. We share it with a small number of service providers, each for a stated purpose, each bound to use it only as we instruct. This is the whole list.

Stripe — payment processing. Receives your name, email address, phone number, shipping address and the order amount, plus the card details you enter, which go to Stripe directly and never to us. Privacy policy: stripe.com/privacy
Resend — email delivery. Receives your email address and the contents of the message being sent to you, for transactional and marketing email alike. Privacy policy: resend.com/legal/privacy-policy
Fulfilment and shipping partners — receive your name, delivery address and phone number, because a parcel cannot be delivered without them.
Google Analytics — website analytics. Runs only with your analytics consent. Privacy policy: policies.google.com/privacy
Google Ads — advertising measurement. Runs only with your marketing consent. When you complete an order it is told the order total, the currency and the order number, so Google can tell which ad led to the sale. Privacy policy: policies.google.com/privacy
Meta (Facebook and Instagram) — advertising measurement. Runs only with your marketing consent. See the note below on what is sent and in what form. Privacy policy: facebook.com/privacy/policy
Legal and regulatory authorities — where the law requires it, or to establish or defend legal claims.

What Meta receives, and in what form

With your marketing consent, Meta's pixel reports which product pages you viewed, when you added something to the cart and when you started checkout. When an order is paid, our own server — not your browser — reports the sale to Meta's Conversions API, so that the report reflects a payment that genuinely completed.

That report carries the order number, the amount, the items, and details Meta uses to match the sale to an account it already has: your email address, phone number, first and last name, city, state, ZIP code and country. Every one of those is hashed with SHA-256 before it leaves our server. Hashing is one-way: Meta can compare the result against a hash of what it already holds, but the readable values are never handed over and cannot be recovered from what is sent. Your IP address, browser user agent and the two Meta cookies above are sent unhashed, because that is the format Meta requires and they are values Meta would see from your browser in any case.

We keep the IP address and user agent needed for that one report on the order until the report is sent, and then delete them. If you refused marketing cookies, nothing is sent to Meta at all — not hashed, not unhashed — and no report is made. Orders placed before this measurement existed are never reported, because nobody was asked.

A note for California residents

We do not sell personal information, and we never have. California law also uses the term “sharing” for the narrower case of disclosing personal information for cross-context behavioural advertising — which is what the Meta and Google Ads cookies described above do. On this Site that is switched off unless you turn it on, the banner's Reject button is the opt-out, and the Cookie preferences link in the footer withdraws it again at any time.

05 Data Retention

We keep personal information only for as long as it serves the purpose it was collected for.

Orders, invoices and payment records are kept for as long as tax, accounting and consumer-protection law requires us to be able to produce them.
Account details are kept while the account exists.
Newsletter signups are kept until you unsubscribe. After that we keep the address on a suppression list, because that is the only reliable way to make sure we never email you again.
The IP address and user agent held for advertising measurement are deleted as soon as the purchase report has been sent.
Referral visit records keep only the one-way hash described in section 01; the address itself is never written down.
Reviews are kept for as long as they are published, and stay in our records if we decline to publish them so that the same submission is not reviewed twice. Ask us and we will remove yours, including any photograph or video, which is deleted from our servers along with it.

When information is no longer needed, we delete it or strip it of anything that identifies you.

06 Your Rights

Depending on where you live, you may have the following rights over your personal information:

Access — request a copy of what we hold about you
Correction — ask us to update anything inaccurate
Deletion — ask us to delete it, subject to records the law requires us to keep
Opt out of marketing — unsubscribe from marketing email at any time, using the link in every one of them or by writing to us. Order and account emails continue, because they are part of the service you bought.
Opt out of advertising cookies — through the banner, or the Cookie preferences link in the footer, at any time
Data portability — request a transferable copy of what you gave us
Withdraw consent — where we rely on your consent, withdraw it without affecting anything done before you did

To exercise any of these, email hello@sacredeye-beauty.com. We may need to confirm you are the person the information is about — usually by checking that you can receive email at the address on the account. We respond within the timeframes applicable law sets, and we will not treat you differently for asking.

07 Children’s Privacy

Sacred Eye Beauty™ does not knowingly collect personal information from children under the age of 13 (or under 16 where applicable law requires). Our products and Site are intended for adult consumers. If you believe a child has provided us with personal information, contact us at hello@sacredeye-beauty.com and we will delete it promptly.

08 Where Your Information Is Stored

Sacred Eye Beauty™ is a United States company. The servers running this Site are located in the European Union, in Finland. Our payment, email and advertising providers — Stripe, Resend, Google and Meta — are United States companies and process information there and elsewhere.

Your information therefore crosses borders in both directions in the course of running an ordinary order, whichever country you are in. Where a transfer out of the European Economic Area or the United Kingdom requires a legal safeguard, we and our providers rely on the European Commission's Standard Contractual Clauses. If you would like details of the safeguards that apply to a particular transfer, ask us and we will tell you.

09 Legal Compliance

Florida Digital Bill of Rights. As a Florida-based company, we honour the rights and obligations set out under the Florida Digital Bill of Rights and related state privacy laws for consumers resident in Florida.

California (CCPA / CPRA). If you are a California resident you have the right to know what personal information we collect and why, to have it deleted, to have it corrected, and to opt out of its sale or sharing. We do not sell personal information; see the note in section 04 on what “sharing” covers and how to opt out. Exercising any of these rights will never result in a worse price or service.

EEA and UK (GDPR). If you are in the European Economic Area or the United Kingdom you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your national supervisory authority. We rely on these legal bases:

Performance of a contract — taking, fulfilling and supporting your order, and running your account
Consent — analytics and advertising cookies, and marketing email
Legitimate interests — keeping the Site secure, preventing fraud and abuse of our forms, and crediting the affiliate who referred you
Legal obligation — tax, accounting and consumer-protection records

Questions about any of this go to hello@sacredeye-beauty.com.

10 Changes to This Policy

We update this policy when what we actually do changes — a new tool, a new purpose, a new provider. The current version is always on this page with its effective date at the top. If a change means we would be using your information for a purpose you have not agreed to, we ask you again rather than relying on this page having been updated.

11 Contact Us

Questions, requests or concerns about this policy or about how we handle your information? Email hello@sacredeye-beauty.com and we will respond within 1–2 business days.

Sacred Eye Beauty™ · 407 Lincoln Rd, 500 Miami Beach, FL 33139, United States