Privacy Policy

1. Who we are

Novirae Wellness ("we", "us", "our") operates the website novirae-wellness.co.uk and sells botanical wellness products directly to consumers. Our registered address is 37 Park Avenue, Chapeltown, Sheffield, S35 1WH, United Kingdom.

We are the data controller for the personal data we collect through this website. If you have any questions about this policy or how we handle your data, please contact us at support@novirae-wellness.co.uk.

2. What data we collect

We collect the following categories of personal data:

• Account data — name, email address, and password (hashed) when you create an account.
• Order data — delivery address, order contents, payment reference, and order status.
• Payment data — card payments are processed by Stripe. We do not store full card numbers; Stripe retains payment details under their own privacy policy.
• Communications — messages you send via our contact form or support chat.
• Technical data — IP address, browser type, device type, and pages visited, collected automatically when you use our website.
• Two-factor authentication — if you enable 2FA, we store a hashed TOTP secret associated with your account.

3. How we use your data

We use your personal data to:

• Process and fulfil your orders, including dispatching parcels and sending tracking information.
• Manage your account and authenticate your identity securely.
• Respond to your enquiries and provide customer support.
• Send transactional emails (order confirmations, dispatch notifications, return updates).
• Comply with our legal obligations, including fraud prevention and financial record-keeping.
• Improve our website and services through aggregated, anonymised analytics.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Legal basis for processing

Under UK GDPR, we rely on the following lawful bases:

• Contract — processing necessary to fulfil your order or provide services you have requested.
• Legal obligation — processing required to comply with UK law (e.g. tax records).
• Legitimate interests — fraud prevention, website security, and improving our services, where these interests are not overridden by your rights.
• Consent — where we have asked for and received your explicit consent (e.g. marketing emails, if applicable).

5. Sharing your data

We share your personal data only where necessary:

• Stripe — payment processing. Stripe is PCI-DSS compliant and processes card data under their own privacy policy.
• Evri / Shippo — parcel delivery and label generation. Your name and delivery address are shared to dispatch your order.
• Reamaze — customer support chat. Messages you send via the chat widget are processed by Reamaze.
• Hosting infrastructure — our website is hosted on secure cloud infrastructure. Data is stored within the UK/EEA.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

6. Cookies

We use strictly necessary cookies to keep you logged in and maintain your session. We may also use analytics cookies to understand how visitors use our site. You can control cookie preferences through your browser settings. A cookie consent notice is displayed on your first visit.

7. Promotional code security

We may use first-party security identifiers and related information associated with your browser or device, together with account, order and network information, to prevent fraudulent or repeated redemption of promotional discount codes. This processing is used solely for security, fraud prevention and enforcement of promotional eligibility rules and is not used for advertising or behavioural profiling.

The legal basis for this processing is our legitimate interests in preventing promotional code fraud and ensuring fair access to discount entitlements. We have assessed that this processing is necessary and proportionate, and that our interests are not overridden by your rights, given the narrow scope of the data collected and the limited retention period applied.

Promotional eligibility records are retained for 2 years from the date of the qualifying order. Security identifiers used solely for fraud prevention are retained for the same period. IP address information used as a supporting security signal is stored in pseudonymised (hashed) form.

8. How long we keep your data

• Account data — retained for as long as your account is active, plus 2 years after closure.
• Order data — retained for 7 years to comply with HMRC financial record-keeping requirements.
• Support communications — retained for 2 years from the date of the last message.
• Technical/analytics data — retained in aggregated, anonymised form indefinitely; identifiable logs are deleted after 90 days.

9. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data where there is no lawful reason for us to keep it.
• Restriction — ask us to restrict processing of your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email us at support@novirae-wellness.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS), hashed passwords, and access controls limiting who within our team can view personal data.

11. Changes to this policy

We may update this privacy policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For significant changes, we will notify you by email or by a prominent notice on our website. We encourage you to review this page periodically.

12. Google and YouTube integration

Our website uses the Google OAuth 2.0 authorisation flow to connect a Google account to our internal social media management tools. This integration is used exclusively by authorised staff and is not accessible to customers or site visitors.

When a staff member connects a Google account, we request the following OAuth scopes: youtube.readonly (to read channel information), youtube.upload (to publish video content to the connected YouTube channel), and yt-analytics.readonly (to retrieve YouTube Analytics data including views, watch time, and engagement metrics for the connected channel). We do not access any other Google account data.

The OAuth access token and refresh token issued by Google are stored in our database and used solely to publish content to the connected YouTube channel on behalf of the business. Tokens are protected by database-level access controls. We do not sell, share, or use these tokens for any purpose other than operating the YouTube publishing feature.

The connected staff member can revoke our access at any time by disconnecting the account via the Social Connect page in the admin panel, or by visiting Google Account settings at myaccount.google.com and removing access under Third-party apps and services. Revoking access in Google Account settings will invalidate the stored tokens immediately. Tokens stored in our database are removed when the account is disconnected via the admin panel.

Our use of Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. For more information, see Google's Privacy Policy at policies.google.com/privacy.

13. Contact us

If you have any questions, concerns, or requests regarding this privacy policy or your personal data, please contact us: