Privacy Policy
This policy covers Precious Oils. It explains what this website does with your information when you browse it, order from it, or send us a message.
The short version
- We have no user accounts and no login on this site.
- Card details go straight to our payment provider and are never stored by us.
- Your cart and your saved delivery details stay in your own browser.
- We use your order details to fulfil your order, and for nothing else.
What we collect
Contact form
If you send us a message we receive your name, email address, the subject, the topic you chose, and whatever you write. We use it to reply, and for nothing else. We do not add you to a mailing list unless you specifically ask.
We keep messages for as long as the conversation is useful — typically no more than two years — and then delete them. You can ask us to delete yours sooner.
Your order
When you check out we receive your name, email address, phone number, delivery address, billing address, what you ordered and the delivery option you chose. We use it to take payment, pack the parcel, get it to you, and handle any return. We keep order records for seven years, which is what tax and accounting rules require.
We never receive or store your full card number. It goes directly from your browser to our payment provider, which returns only a confirmation and the last four digits so your receipt can identify the card.
Your cart and saved details
Your cart, the delivery details you type at checkout, and your past order confirmations are written to your browser's local storage so the next order is quicker to place. That copy stays on your device, is not readable by us, and can be cleared from your account page or by clearing your browser data.
Server logs
Our hosting provider keeps standard web server logs — IP address, time, page requested, browser type — for security and troubleshooting. These are retained for a short period by the host and are not used to build any profile of you.
What we do not collect
- Full card numbers, bank details or any other payment credential.
- Health information. Please do not send us medical details in the contact form.
- Advertising or cross-site tracking identifiers.
Third parties
Payment provider
Card payments are processed by our payment provider, which is PCI-DSS compliant and receives your card details directly. It uses them to authorise the payment and for fraud prevention. The provider and a link to its policy will be named here once it is configured.
Delivery carriers
We pass your name, delivery address and phone number to the carrier handling your parcel so they can deliver it and contact you about the delivery.
Fonts
This site loads a typeface from Google Fonts, which means your browser makes a request to Google's servers and they receive your IP address. If you would rather avoid that, the font can be self-hosted — tell us and we will do it.
Form delivery
Contact form messages are delivered through a third-party form service. The provider and its policy will be named here once it is configured.
Cookies
This site sets no tracking or advertising cookies, which is why you are not being asked to dismiss a consent banner. The only data stored on your device is your cart, your checkout details and your order confirmations, described above, in local storage rather than in cookies.
Your rights
Depending on where you live, you may have the right to ask what we hold about you, to have it corrected, to have it deleted, or to object to how we use it. We will honour these requests regardless of where you live.
To make a request, email preciousoils@yahoo.com. We will respond within 30 days.
Children
This site is not directed at children and we do not knowingly collect information from anyone under 16. If you believe a child has sent us information, contact us and we will delete it.
Changes
If this policy changes materially we will update the date at the top of this page.
Note for review
This is a working draft prepared during development, not legal advice. Before launch it must be completed and reviewed — in particular the form provider must be named, the hosting log retention period confirmed, and the whole document checked against the privacy law applying where the business operates and where its customers are (for a US and Canadian audience, that means at least CCPA/CPRA and PIPEDA).