Privacy policy.

We collect three buckets of information, and nothing else.

Order data: name, shipping address, billing address, email, phone number, and the items you ordered. Payment-card details are handled by our payment processor (Stripe) — we never see or store full card numbers.

SMS data: your mobile phone number if you opt in to text messages, and the messaging timestamps. We do not sell or share SMS numbers under any circumstances.

Site analytics: basic, anonymised usage data (page views, device type, country, referring site). We use a privacy-friendly analytics tool that doesn't drop tracking cookies.

Order data is used to make and ship your product, to email shipping confirmations, and to answer customer-support questions. We retain order records for seven years for tax and accounting purposes.

SMS data is used only to send you the texts you opted in for — typically one when a batch ships, one when there's a new shade level, and that's it. You can reply STOP at any time to remove your number; we will delete it within thirty days of cancellation.

Analytics data is used to understand what pages people find useful. It does not get tied to your account or order.

Three categories of vendor handle parts of your data on our behalf:

Payment processing — Stripe. They see card numbers; we don't. Their privacy policy is at stripe.com/privacy.

Shipping — USPS, UPS, or DHL depending on destination. They see your shipping address and contact details.

SMS provider — our text-messaging vendor sees the numbers we send to. They do not have permission to use those numbers for anything else.

We do not sell, rent, or trade your data to advertisers. We do not run paid ads, so we have no need to. We do not use Meta, TikTok, Google Ads, or any retargeting pixel on the site.

The site uses two cookies. One remembers if you've dismissed the announcement bar (so it doesn't keep popping up). One remembers your selected shade in the slider so you don't have to re-pick if you navigate away. Both are first-party and contain no personal data.

We don't use third-party tracking cookies. There is no ad pixel on this site.

You can ask us at any time to: see what data we have on you, correct it, delete it, or export it. Email hello@sunnbalm.co with the request and we'll respond within thirty days. You don't need to be a California or EU resident — these rights apply to every customer.

If you're in California: you specifically have the right to know, the right to delete, the right to correct, the right to opt out of sale (we don't sell data anyway), and the right to non-discrimination for exercising any of these. CCPA-specific request form available on request.

If you're in the EU/UK: GDPR rights apply. Our legal basis for processing your order is contract performance; for marketing texts, it's your explicit consent.

Sunnbalm is not directed at children under thirteen, and we don't knowingly collect data from them. If you believe a child has submitted personal information through our site, write to hello@sunnbalm.co and we'll delete it.

If we update this policy, we'll change the effective date at the top and email anyone with an active order. We won't retroactively change how we treat data you've already shared.

Questions, requests, or anything privacy-related: hello@sunnbalm.co. A human will answer within twenty-four hours.