Privacy policy

Who we are

The company responsible for the personal information described in this policy is HexaLuma, 170 Zenway Blvd, Unit 7, Vaughan, ON L4H 0S7, Canada. Orders ship from our fulfillment partner in China. Reach us at info@hexaluma.com or 888-817-5305.

What we collect

• When you order: name, email address, delivery address, and the contents and value of your order. With the order we keep the random visitor identifier described under Site analytics (where one exists), how your visit arrived (for example, from a Google ad) and the page you first landed on, so we can tell which advertising leads to orders.
• When you start checkout: the email address you enter and the contents of your cart, saved before payment so we can send one reminder if the order is not completed, together with the same visitor identifier, how your visit arrived and the page you first landed on. An email address receives at most one reminder in any 30 days, and every reminder tells you how to stop further reminders. The reminder’s button restores your cart on any device; its link carries only the products, their quantities and color temperatures.
• When you create an account: name, email address, and your order history. Orders you placed as a guest are linked to your account once you verify the same email address at sign-in.
• When you contact us: name, email address, phone number if you give one, and what you wrote. If you came from a link such as a fit check, we note that topic, with the visitor identifier and how your visit arrived.
• When you ask for a welcome code: your email address and the details described under Marketing emails and welcome offers.
• Site analytics: when you view a page we record the page, the site or campaign that referred you, whether you are on a mobile or desktop device, a shortened form of your IP address and an approximate location (country, region and city).
• What you do in the shop: the products, sizes, drawings and filters you open, the color temperature you choose, items you add to the cart, the checkout steps you reach, payment errors (the type of error only, never card details), the questions you open under “Before you order”, which of the listed reasons you tap under “What’s holding you back?”, and the contact links you use. None of these records holds your name, email address, delivery address, welcome code or card details.
• Page speed: how quickly each page loads and responds on your device, recorded with no identifier.
• The visitor identifier: a first-party cookie (hx_vid) holds a random identifier for 12 months, so repeat visits can be counted and the records above linked to one visitor. Visitors in the United Kingdom, the European Economic Area and Switzerland do not receive it, and their visits and actions are counted without any identifier. We use these records to understand how the site is used and where visitors stop before ordering, so we can improve it; we do not sell them.

We do not collect or store card numbers. Card details are entered directly into fields hosted by Stripe and never reach our servers.

Why we collect it

• To take payment, ship your order and handle returns or warranty claims — this is necessary to perform the contract between us.
• To answer inquiries you send us.
• To send one reminder if you enter your email at checkout and do not complete your order.
• To send the welcome code you ask for and, with your consent, emails about our products and offers.
• To measure whether our advertising leads to orders, and to see where visitors stop before ordering so we can improve the site.
• To keep records we are required to keep for tax and consumer-protection law.
• To keep the site secure and working.

Who it is shared with

• Stripe — payment processing. Stripe receives your card or wallet details directly, together with your name, email address, delivery address and the order total. The payment also carries, for our records, the random visitor identifier, how your visit arrived, the page you first landed on, whether a welcome code was used and which of our emails you last clicked a link in, if any.
• Supabase — the database that holds accounts, orders, checkout records and email subscriptions.
• Vercel — hosting and delivery of this website.
• Cloudflare Email Service — sending order confirmations, delivery updates, the checkout reminder, welcome codes, marketing emails and replies to inquiries.
• Google — advertising measurement through the Google Ads tag, including the shopping actions described under Advertising and analytics.
• Couriers — your name and delivery address, to deliver your order.

Some of these providers process information outside your country, including in the United States. We do not sell personal information.

Advertising and analytics

This site loads the Google Ads tag, provided by Google LLC. It lets us measure whether our advertising leads to visits, sign-ups and purchases, including the value of a completed order, and Google may use its cookies to show you our ads on other sites. When you receive a welcome code, the tag records that a sign-up took place; your email address and the code are not sent to Google. When the tag is on the page, we also tell Google when a product is viewed, on its page or in a quick look (the product and, in a quick look, its price), and when a product is added to the cart, the cart is opened, checkout starts and payment details are submitted, with the product, quantity and value, and when a contact link is used or an inquiry is sent. Your name, email address, delivery address, welcome code and card details are never sent to Google. For visitors in the United Kingdom, the European Economic Area and Switzerland, the tag runs in Google’s consent mode with advertising and analytics storage denied, so it sets no advertising or analytics cookies, and none of the shopping actions above is reported to Google. You can control ad personalization at adssettings.google.com, and you can clear this site’s cookies in your browser at any time.

Marketing emails and welcome offers

The welcome offer is a spin of a wheel for 10–15% off a first order. When you spin the wheel in the offer shown on this site (the button at the foot of each page opens it), our server draws the discount at random. When you claim it, our server records the discount with your code, and we record your email address, the page you were on, the date and time, an approximate location (your country) and a shortened form of your IP address, together with the consent wording you agreed to. The spin uses your IP address, without storing it, only so that a second spin from the same network on the same day shows the same prize. We use your email address to send your code, reminders before it expires if you have not used it, a short series of welcome emails about our kits and how they are installed, and occasional emails about our products and offers. When you ask for a code, we check whether your email address already has a paid order with us, because codes are for first orders. When a code is used at checkout, we make the same check on the email address on the order and record the code on the order. We also count how often the offer is shown and used, and which discount each new code won, without your email address.

When you click a link in one of our emails, we record which email it was and when, with the page it opens, the type of device and your country, so we can see which emails are useful. If you then order from the same device within 30 days, we record that email with the order (see hx_em under Cookies).

If you are in the United Kingdom or the European Economic Area, we send marketing emails, including code reminders, on the basis of your consent, which you can withdraw at any time by unsubscribing. We send the code you ask for in order to provide the offer you requested. We keep the record of your consent, and check whether an address already has an order with us, because it is in our legitimate interest to show when consent was given and to keep the offer to first orders.

Every marketing email has an unsubscribe link, or you can email info@hexaluma.com. Unsubscribing stops marketing emails, including code reminders. It does not stop emails about an order you have placed, and a code you already have still works until it expires.

We keep your email address for marketing until you unsubscribe, or until 24 months pass without an order or any contact from you, whichever comes first. After you unsubscribe we keep a record of your address and the date, so that we do not email you again. We keep a record of each code we issue (the code, its discount, the address it was sent to and whether it was used) for as long as we keep order records, so that each address receives one code. Requests for a code, and checks of a code at checkout, are logged with a shortened IP address (and, for a request, a one-way hash of the email address) and deleted within two days; we use them only to prevent abuse.

Cookies

• hx_vid — a random identifier used to count repeat visits. Kept for 12 months. Not set for visitors in the UK, EEA or Switzerland.
• hx_cty and hx_ccy — your country and currency, so prices are shown correctly. Kept for 12 months.
• hx_co and hx_co_email — your checkout session and the email address you entered, so the checkout form is pre-filled. Kept for 7 days and readable only by our server.
• hx_promo — your welcome code, so it is applied at checkout on this device. Kept for at most 7 days.
• hx_spin — the result of your spin of the welcome offer’s wheel, so spinning again shows the same prize. Kept for 24 hours and readable only by our server.
• hx_pbar — set only when you hide the bar that shows your welcome code, so it stays hidden. It ends when you close your browser.
• hx_em — which of our emails you last clicked a link in, so an order you place is credited to it. Kept for 30 days and readable only by our server. Not set for visitors in the UK, EEA or Switzerland.
• Sign-in cookies — keep you signed in to your account.
• Google Ads cookies — see Advertising and analytics.

Your cart is saved in your browser’s local storage and is not sent to us until you check out. Whether you have closed the welcome offer or received a code is saved there too, so the offer is not shown to you repeatedly, and so are the last few products you viewed (at most five), so the site can offer to take you back to one; that list is not sent to us. During a visit, your browser’s session storage keeps how many pages you have viewed, for how long, and how the visit arrived, so the welcome offer does not open over the page an ad brought you to; this is not sent to us either.

How long we keep it

Order records are kept for seven years to meet tax and accounting record-keeping obligations. Account data is kept until you ask us to delete it. Inquiries are kept for two years. Checkout records and site analytics records are kept until we no longer need them to understand how the site is used, and you can ask us to delete those linked to you at any time. Email subscriptions are kept as described under Marketing emails and welcome offers.

Your rights

Under PIPEDA, and under provincial law where it applies, you may ask for a copy of what we hold about you, ask us to correct it, ask us to delete your account and personal data, or withdraw consent for anything you previously agreed to. Email info@hexaluma.com and we will respond within 30 days. If you are not satisfied you may complain to the Office of the Privacy Commissioner of Canada.

If you live in the United Kingdom or the European Union, you also have the right to ask us to restrict or stop using your information, to receive it in a portable form, and to complain to your local data protection authority (in the United Kingdom, the Information Commissioner’s Office).

Children

This site is not directed at children and we do not knowingly collect their information.

Changes

If this policy changes materially we will update the date at the top and, where the change affects how we use information you have already given us, tell you directly.