Privacy
Policy

• —Order details: name, company, email, phone, shipping address, what you ordered, and the order value.
• —Payment: handled by Stripe on their systems. We receive the confirmation, the last four digits and the billing details they pass back, never your full card number.
• —Messages: anything you send through a contact form, a catalogue request, a size or fit question, a damage claim, or the chat window on the site.
• —Account details: if you have a client portal account, your name, email and the company you work for.
• —Technical details: the pages you visit, what you clicked, the site that sent you, and your device and browser. Your IP address and browser details are stored with an order and used for fraud prevention and advertising measurement.
• —Advertising identifiers: the click identifier a platform adds to the link when you arrive from an ad, kept with your inquiry or order, and the cookies those platforms set.
• —From others: payment and billing details from Stripe, voucher and order details from our Shopify voucher store, and, where your employer runs a program with us, your name and work details from them.

• —To price, make, ship and invoice your order, and to handle returns, exchanges and claims.
• —To answer you, quote a program, and pick up a conversation where it left off.
• —To meet tax, accounting and record-keeping obligations.
• —To keep the site working and to know which pages and products people actually use.
• —To measure whether our advertising works, and to show ads to people who look like our customers.
• —To keep the site and our accounts secure, and to prevent fraud.
• —To answer questions in the chat window, using an AI model.
• —To run voucher programs we operate for clients.
• —To send marketing email: to customers about products and programs like the ones they bought, and to anyone who asks to hear from us. Every marketing email has an unsubscribe link, and unsubscribing never stops order emails.
• —To establish, exercise or defend legal claims, and to comply with the law.

We share personal information with two kinds of companies.

Service providers run parts of the business for us and may use it only to do that work: Cloudflare, Stripe, UPS, Resend, Mailchimp, Shopify, and the AI model providers named below.

Advertising and analytics partners are Google, Meta, OpenAI's ad network and Pinterest. They receive information about your visits and, for an order, its contents and value. They use it under their own privacy policies, including to measure and target advertising. We do not sell personal information for money; under California law and the laws of several other states, giving information to advertising partners this way can count as "selling" or "sharing". We treat it that way, and you can opt out on the privacy choices page.

• —Cloudflare: hosts the site, the database, the images and the video meetings our staff run.
• —Stripe: takes payment, calculates sales tax and handles refunds. Stripe also uses some payment data under its own privacy policy, for example to prevent fraud.
• —UPS: rates and carries shipments, and prints the labels, which carry the name and address you gave us.
• —Resend: delivers order confirmations, shipping notices and replies.
• —Mailchimp: holds our mailing list, which includes customers and anyone who asks to hear from us, with their name and email address.
• —Shopify: runs the Success Academy voucher store, where your email address is used to issue and track a voucher.
• —Google: analytics and advertising measurement. This runs through Google Tag Manager.
• —Meta: advertising measurement pixels on the site.
• —OpenAI: advertising measurement for the ads we have run on their network.
• —Pinterest: advertising measurement, both from the site and from our server when an inquiry or order arrives.
• —Vimeo: plays the video on some marketing pages, and sees your IP address and browser when it does, under its own privacy policy.
• —OpenRouter, and the model it routes to (currently Google Gemini): processes the messages you type into the chat window so it can answer them.
• —Anthropic, Replicate and Modal: process images, documents and project notes our design team works with, which can include the names and messages of people at our client companies.
• —Professional advisers and authorities, where the law requires it.

Our service providers are bound by contract to use the data only to provide their service to us. Our advertising and analytics partners are governed by their own privacy policies. Our providers mostly process data in the United States; some may process it in other countries.

We advertise, and we measure it. The measurement works in two ways: a tag on the page, and a message from our server when an inquiry or an order happens. Between them, these platforms receive:

• —That a page was viewed, and which product pages were viewed or added to a cart.
• —That a checkout was started, that an inquiry was sent, or that an order was placed.
• —For an order: the order number, the value, the currency and the items.
• —A hashed copy of your email address (see below).
• —Technical identifiers: your IP address, your device and browser, and the advertising click identifier if you arrived from an ad.

We send Pinterest a hashed copy of your email address with inquiry and order events. Hashing replaces the address with a fixed code, so the address itself is never sent. It still identifies you: Pinterest hashes the addresses it already holds and matches them against ours, and that matching is the reason it is sent. We treat the hash as personal information. The opt-out on the next page stops the hash, and the inquiry and order events, for that address.

Cookies are the small files that make this work, and your browser also holds a little more. The table below lists the cookies we know our site and its partners set. Advertising and analytics partners can change their cookies without telling us, so you may see others from the same companies; ask us about any cookie you see on finery.la.

Some things are kept in your browser's storage rather than in cookies: your cart; a record of how you arrived (campaign, referrer, landing page and ad click identifiers), kept for 90 days and attached to an inquiry or order; a list of your last 20 order numbers, so the same purchase is not reported to analytics twice; and, during checkout, the contact details you type, until you close the tab. The chat window keeps nothing on our side.

Our own cookies' lifetimes are in the table above. The platforms set their own and decide how long those last; Google, Meta, Pinterest and Cloudflare publish the current values in their own cookie policies. Your browser's settings will refuse or delete any of these, though the cart and the sign-in will stop working if you block ours.

One more thing on some marketing pages: a video embed served by Vimeo, which sees your IP address and browser when the page loads.

Tracking across sites. Google, Meta, Pinterest and OpenAI can collect information about your activity on this site and combine it with your activity on other sites and apps over time.

Do Not Track. Browsers' "Do Not Track" setting has no agreed meaning, and we do not change what we do in response to it. The opt-out described under "Your choices" is the mechanism that works.

Tell us to stop using your data for advertising. When you do, we record the choice against a hashed copy of your email address, and we stop sending that address's inquiries and orders from our server to Pinterest. In that browser we also stop loading the Meta and OpenAI pixels, and stop sending shop events (product views, cart, checkout, purchase, inquiry) to the advertising and analytics tags.

What it does not yet do, in full. Our Google Tag Manager container still loads for everyone, so Google Analytics, Google Ads and the Pinterest page-view tag can still receive page views and catalogue downloads from that browser. A choice made under one email address does not cover an inquiry or order placed under a different one. If you clear cookies or switch browsers, the browser part of the choice does not follow you. We are working to close these gaps; until then, your browser's tracking protection will block those tags.

Marketing email is separate. Every marketing email has an unsubscribe link, and unsubscribing does not change the advertising choice, or the other way around. For an order, we keep the record of your opt-out as a hash so that deleting it cannot undo the choice.

Email privacy@finery.la and ask. We will confirm what we hold, correct it, or delete it, unless we are required to keep it for tax or accounting.

If you are in California or another state with a privacy law, you also have the right to know what we collected and shared in the last twelve months, to opt out of that sharing, and to not be treated differently for asking. The link above is that opt-out. We do not sell personal information for money, and we do not knowingly sell or share the personal information of anyone under 16.

We are based in the United States and process data there. If you are in the European Economic Area, the United Kingdom or Switzerland, the rights you have over your data are broader than the ones described above: access, correction, erasure, restriction, portability, objection, and the right to withdraw consent. We answer those requests within one month. You can also complain to the data protection authority where you live. Email privacy@finery.la and say where you are, so the request is handled under the right rules. We rely on our contract with you to fulfill orders, on our legitimate interest in running and securing the site and in supplying the business you work for, and on our legal obligations for tax and accounting.

Orders and inquiries are kept while they are needed for the reason they were collected: orders for tax, accounting and warranty, and inquiries while you or your company may become a client. We do not currently delete them on a timer, and we will say so here when we do. You can ask us to delete what we are not required to keep, and we will, except where the law requires us to hold it. Advertising opt-outs are kept while they are in force, as a hash, because deleting the record would undo the choice.

We use reasonable safeguards for the data we hold. Our systems run on Cloudflare, payments run on Stripe, and access to customer records is limited to the Finery staff and service providers who need it. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.

The site is for businesses and the people who work for them. It is not directed at children, and we do not knowingly collect information from anyone under 16.

When something here changes, the effective date changes with it. If the change is significant, we will say so on the site rather than leave you to notice.

privacy@finery.la reaches the person who handles this. For an order, include the order number so we can find it.