Privacy Policy
Last updated: May 2026
Aarvoll Shop ("we", "us", "our") is committed to protecting your personal information. This Privacy Policy describes what data we collect, how we use it, and your rights.
Information We Collect
Information you provide directly
- Email address — used for order confirmations, shipping notifications, and account authentication.
- Phone number — used for order-related communications and carrier notifications.
- Shipping & billing address — used to fulfil and ship your order.
Information collected automatically
- Payment data — payment details are processed directly by Stripe and are never stored on our servers. We only retain a Stripe customer ID and payment intent/subscription reference.
- Server logs — standard web server logs (IP address, browser type, pages visited) retained for up to 90 days for security monitoring.
How We Use Your Information
- To process and fulfil your orders.
- To send order confirmations, shipping updates, and support responses.
- To manage your subscription (if applicable).
- To detect and prevent fraud or abuse.
- To comply with applicable laws and regulations.
We do not sell or rent your personal data to third parties.
Third-Party Services
- Stripe — payment processing. Your payment information is handled by Stripe under their Privacy Policy.
- USPS / Carriers — your name and address are shared with the shipping carrier solely to deliver your order.
Data Retention
We retain order records for 7 years to comply with US tax and accounting requirements. Account data (email, profile) is retained until you request deletion. Server logs are purged after 90 days.
Your Rights
Depending on your location, you may have the right to access, correct, or delete your personal data. After logging in to your account, you can update your profile information or request account deletion.
California residents may exercise rights under the CCPA. EU/UK residents may exercise rights under GDPR. We will respond to all verified requests within 30 days.
Cookies
We use only essential cookies: an httpOnly refresh-token cookie for authentication. We do not use advertising or analytics cookies.
Security
All data is transmitted over HTTPS. Access tokens are short-lived JWTs (15 minutes). We use RS256 signing and store no plaintext passwords (we use passwordless OTP authentication).
Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email to active customers.
Contact Us
Privacy questions: support@aarvoll.shop