Effective date: 28 August 2026
1. What we collect
- What you give us when you order. Your name, shipping and billing address, email address, phone or WhatsApp number, ring size and engraving text, and the details of what you bought.
- Your account, if you create one. Your email address, a password (stored only as a salted cryptographic hash — we never see or store the password itself), your saved addresses, your order history, and a short login record showing the date, device and IP address of recent sign-ins so you can spot access you did not recognise.
- Payment. Card and PayPal details are collected and processed by our payment provider, not by us. We never see or store your full card number. What reaches us is the confirmation, the amount, and the last digits or payment method label needed to match a payment to an order and to handle refunds.
- Ring designer. If you use the design tool, we keep the choices you made (shape, setting, metal, stones, any notes you typed), the images it generated for you, and — if you ask us to send them — your email address. The description is sent to an external AI image service to produce the pictures; see section 3.
- Reviews. If you leave a review, we keep the rating, the text, any photos you attach and the name you chose to display. The name and review are shown publicly on the product page; your email is kept privately for moderation only.
- Newsletter. If you subscribe, your email address.
- Messages. The emails and WhatsApp messages we exchange with you about an order or a question.
- Technical data from your visit. IP address, browser and device type, pages viewed and the site that referred you. Part of this is collected only if you accept analytics cookies — see section 5.
- Anti-spam verification. Our forms use Cloudflare Turnstile, which reads signals from your browser to tell a person from an automated script.
We do not ask for identity document numbers or any special category data (health, biometrics, political or religious views), and we would rather you did not send them.
2. How we use it, and on what basis
| What we do | Basis under the GDPR / UK GDPR, where it applies |
|---|---|
| Taking payment, making your ring, shipping it, and handling returns, resizing and warranty questions | Performance of a contract |
| Answering a question before you buy; running the ring designer at your request | Steps taken at your request before entering into a contract |
| Keeping invoices, export, customs and accounting records | Legal obligation |
| Running your account, keeping you signed in, and recording recent sign-ins so account takeover is visible | Performance of a contract, and our legitimate interest in keeping accounts secure |
| Protecting the site against spam, card testing and automated abuse; diagnosing faults | Our legitimate interest in keeping the site safe and usable |
| Publishing a review you chose to submit | Your consent, given when you submit it |
| Analytics — understanding which pages and styles visitors use, and improving the site | Your consent, given through the cookie banner and withdrawable at any time |
| Sending the newsletter | Your consent, given when you subscribe and withdrawable at any time |
3. Who we share it with
We do not sell your personal information and we do not share it for anyone else's advertising.
- Payment provider — PayPal, to take payment and process refunds.
- Shipping and courier partners, and the tracking service that follows your parcel, so we can deliver and so you can see where it is.
- Our workshop and quality partners, who receive the specification needed to make and inspect your ring.
- Our AI image provider (OpenAI), if you use the ring designer. The design description you enter is sent to OpenAI to generate the images. We do not send your name, email address or order history with it.
- Service providers that run the site: Cloudflare (content delivery, security and the Turnstile check), Amazon Web Services (hosting), Google Analytics (site statistics, only with your consent), and our email providers.
- Authorities, where customs, tax or other law requires it.
4. International transfers
Our team is in China, our workshop partners are in China, and this website is hosted in the United States and delivered through a global content delivery network. If you are in the European Economic Area, the United Kingdom or another jurisdiction that restricts international transfers, ordering from us necessarily involves transferring your information to those countries.
Where the law requires a transfer safeguard, we rely on Standard Contractual Clauses or an equivalent mechanism with the recipient. Write to support@caraluxa.com if you need this in writing.
5. Cookies and analytics
If you are in the European Economic Area or the United Kingdom, we show a banner on your first visit asking whether you accept analytics cookies, and nothing analytical runs until you choose. If you select "Essential only", no analytics or marketing cookies are set at all.
Outside those regions, where prior consent is not required, analytics is enabled by default. You can turn it off at any time by blocking cookies for this site in your browser. Marketing and advertising cookies are never enabled by default in any region.
- Strictly necessary — keeping you signed in, remembering your basket through checkout, and the Cloudflare cookies that route requests, protect the site from automated abuse and operate the Turnstile check. These are required for the site to work and are not covered by the banner.
- Your browser's local storage — remembers your cookie choice and your language preference. This is held on your own device; clearing your browser storage removes it.
- Analytics (only if you accept) — Google Analytics 4 sets
_gaand_ga_<id>cookies to count visits and show us which pages and styles are used. We do not use these to identify you personally.
We do not run advertising pixels on this site and we do not track you across other websites.
Changing your mind. If you were shown the banner and want to withdraw the consent you gave, clear this site's cookies and site data in your browser; the banner will appear again on your next visit and you can choose "Essential only". If no banner was shown to you, analytics can be turned off by blocking cookies for this site. You can also block cookies in your browser settings, though checkout and sign-in will stop working if you block the strictly necessary ones.
6. How long we keep information
| Information | How long |
|---|---|
| Orders, invoices, export and customs records | Ten years, to meet accounting, tax and export record-keeping obligations |
| Your account and saved addresses | While the account is open; deleted when you close it |
| Enquiries that did not lead to an order | Kept while the conversation is active; three years after the last contact we remove the personal details (name, email address, phone number) and keep only the company name and the requirement itself |
| Ring designs and generated images | Three years, so we can pick a project back up; deleted sooner on request |
| Published reviews | While the product is listed; the review stays if you close your account but the name is removed |
| Newsletter subscription | Until you unsubscribe |
| Website and security logs, including sign-in IP addresses | Twelve months |
| Analytics data | As configured in Google Analytics, currently fourteen months |
7. How we protect information
The site is served over HTTPS. Passwords are stored only as salted cryptographic hashes, never in a readable form. Sign-in attempts are rate-limited to make password guessing impractical, and administrative access to the systems behind this site is restricted.
No transmission over the internet is ever completely secure. If a breach occurs that is likely to put your rights at risk, we will notify you and the relevant supervisory authority as the applicable law requires.
8. Your rights, and how to use them yourself
If you have an account, you can act on two of these rights immediately, without asking us. Sign in and open Account → Security → Your data:
- Download my data — gives you a machine-readable copy of your account, orders, reviews and enquiries straight away.
- Delete my account — removes your account, saved addresses and sign-in history, and detaches your past orders from you. You will be asked for your password first, because this cannot be undone.
Beyond those, depending on where you are, you may have the right to ask us to correct information, to restrict or object to how we use it, and to withdraw a consent you previously gave. Write to support@caraluxa.com with "Privacy request" in the subject line and we will reply within 30 days. We may need to confirm who you are before we act.
Two things worth knowing. Withdrawing consent does not undo what we lawfully did before you withdrew it. And where tax or export law requires us to keep an invoice, we cannot delete the document itself — what we do instead is remove the details that identify you personally, which is exactly what the account deletion above does.
If you are in California, you have the right to know what we collect and to ask us to delete it. We do not sell or share personal information as those terms are defined there.
If you are not satisfied with how we handle your request, you have the right to complain to the data protection authority where you live. In the European Union each member state has its own authority; in the United Kingdom it is the Information Commissioner's Office. We would appreciate the chance to put it right first.
9. Marketing
We send the newsletter only to people who asked for it, and every message has an unsubscribe link. Emails about an order you placed — confirmation, dispatch, delivery, a question about your ring size — are not marketing and are sent whether or not you subscribe.
10. Children
This site is intended for adults. We do not knowingly collect information from children, and we will delete it if we learn that we have.
11. Changes to this policy
If we change how we handle information we will update this page and move the effective date at the top. If a change materially affects people who already have an account with us, we will say so by email.
12. Contact
Questions about this policy or a request about your data: support@caraluxa.com, or WhatsApp +86 130 6275 0528.