Privacy Policy

When you place an order, we collect your name, email address, shipping address, and payment confirmation. We don’t store full card numbers — payments are handled by PayPal, and all we receive is a confirmation and the payer details PayPal returns to us.

We collect aggregate usage statistics (pages viewed, device type, and approximate location estimated from your IP). This data is used in aggregate to improve the store and is never linked to your identity.

To process and ship your orders, and to provide after-sales support when something goes wrong.

To send transactional emails: order confirmations, shipping notices, and delivery confirmations. These are not marketing emails, and they can’t be unsubscribed from while your order is in progress.

To send marketing emails only if you’ve actively subscribed. Every marketing email includes one-click unsubscribe, which takes effect immediately.

Payment processors (PayPal), to collect payment. We never see or store your card details.

Shipping carriers, who receive your name and shipping address only — never payment information.

Analytics and email service providers, who process data on our behalf under contract.

We never sell personal data, and we don’t share it with advertisers.

We use cookies that are necessary to keep your cart and session working, plus analytics cookies to measure site performance. You can block non-essential cookies in your browser settings without affecting your ability to shop.

If you’re in the EU or UK, you have the right to access, correct, export, or delete your personal data, and to object to processing. If you’re in California, the CCPA gives you equivalent rights, including the right to know and the right to delete.

To exercise any of these rights, email privacy@malalune.com. We respond within 30 days, usually within 3.

Order records are kept for seven years to meet tax and accounting requirements. Marketing subscription data is kept until you unsubscribe. Analytics data is kept for 26 months.

All traffic is encrypted in transit, and data is encrypted at rest. Access to customer data is limited to staff who need it for fulfillment or support.

Questions about this policy: privacy@malalune.com.