Privacy Policy

When you place an order we collect your name, email address, delivery address, and payment confirmation details. We do not store your full card number — payment is processed by Stripe and PayPal, and we receive only a token and the last four digits.

We collect analytics information about how visitors use the site (pages viewed, device type, approximate location by IP). This is used in aggregate to improve the store and is not linked to your identity.

To process and deliver your order, and to provide customer service if something goes wrong.

To send transactional emails: order confirmation, dispatch notification, delivery confirmation. These are not marketing and cannot be opted out of while you have an order in progress.

To send marketing emails, only if you have opted in. Every marketing email carries a one-click unsubscribe, and unsubscribing takes effect immediately.

Payment processors (Stripe, PayPal) to take payment.

Shipping carriers and our fulfillment partners, who receive your name and delivery address. This includes our suppliers in China where an order is drop-shipped directly — they receive shipping details only, never payment information.

Analytics and email service providers, who process data on our behalf under contract.

We never sell personal data. We do not share it with advertisers.

We use essential cookies to keep your cart and session working, and analytics cookies to measure site performance. You can block non-essential cookies in your browser settings without breaking the store.

If you are in the EU or UK, you have the right to access, correct, export, or delete your personal data, and to object to processing. If you are in California, you have equivalent rights under the CCPA, including the right to know what data we hold and to request its deletion.

To exercise any of these, email privacy@malalune.com. We respond within 30 days, usually within 3.

Order records are retained for seven years, as required for tax and accounting purposes. Marketing subscription data is retained until you unsubscribe. Analytics data is retained for 26 months.

All traffic is encrypted in transit. Data at rest is encrypted. Access to customer data is limited to staff who need it to fulfil orders or provide support.

Questions about this policy: privacy@malalune.com.