At Vilora Labelle, your privacy actually matters to us — not as a checkbox exercise, but because we're asking you to trust us with your name, address, and payment details every time you order. This page explains, in plain language, what we collect, why we collect it, and what control you have over it. Because we serve customers across the United States, the United Kingdom, and Europe, this policy is written to align with the UK/EU General Data Protection Regulation (GDPR) as well as general US privacy expectations, not just to satisfy a legal minimum.

Who We Are

This website is operated by Vilora Labelle. Our website address is https://viloralab.store. If you ever need to reach us about anything on this page, email info@viloralab.store.

Information We Collect

When you place an order: your name, email address, shipping address, billing address, and phone number. This is the basic information needed to actually get a product to your door and follow up if something goes wrong.

Payment information: handled entirely by our payment processor at checkout. We never see or store your full card number, expiration date, or CVV on our own servers — that data goes directly to the payment gateway, encrypted, and stays there.

Order history: what you've bought, when, and any notes tied to a return or support request, so we can help you faster the next time you reach out.

Account information, if you create one: your saved addresses and order history, viewable and editable by you at any time. You can delete your account or request its removal whenever you'd like.

Technical and browsing data: your IP address, browser type, device information, and pages visited — mostly collected automatically through cookies, and used to keep the site working properly and to understand which pages and products people actually engage with.

If you contact us: whatever you include in your message — a question, an order number, a complaint, a compliment. We keep this to follow up and to spot patterns if the same issue keeps coming up.

Cookies

Cookies are small files stored in your browser, and we use a few different kinds:

• Cart cookies, so the items you've added don't disappear if you close the tab and come back later. These typically last up to 30 days.
• Login cookies, if you create an account — these keep you signed in so you're not re-entering your password on every visit. If you check "Remember Me," this can persist for a couple of weeks; otherwise it's shorter, and logging out clears it immediately.
• Analytics cookies, which help us understand overall site traffic and behavior in an aggregated way — we're looking at patterns, not watching individual people.
• Marketing cookies, only if you've opted into promotional emails or if we're running ads that track conversions. These are optional, and you can decline them.

You're free to disable cookies through your browser settings. Doing so might mean your cart doesn't persist between visits, or that certain pages don't load quite as smoothly, but the core site will still work.

Embedded Content

Occasionally a page on our site might include embedded content from elsewhere — a video, a map, a social media post. That content behaves exactly as if you'd visited the other site directly: it may set its own cookies, track your interaction, and collect data according to that third party's own policy, not ours. We don't control what these embeds do once they're on the page, so it's worth being aware of that if you're logged into the third-party service at the time.

How We Use Your Information

• To process, pack, and ship your order
• To send order confirmations, shipping updates, and respond to support requests
• To handle returns, exchanges, and refunds
• To send promotional emails or offers — only if you've opted in, and you can unsubscribe with one click at any time
• To detect and prevent fraud, particularly on unusually large or suspicious orders
• To understand how the site is used, so we can fix what's broken and improve what isn't

We don't use your data for anything beyond what's listed here, and we don't sell it — not to advertisers, not to data brokers, not to anyone.

Who We Share Your Data With

We share the minimum necessary with a small number of trusted parties, strictly to get your order to you and keep the store running:

• Shipping carriers (FedEx, USPS, UPS, DHL) — your name, address, and phone number, so they can actually deliver the package
• Our payment processor — your payment details, handled entirely on their secure systems
• Our email service provider — your email address, to send order confirmations and, if you've opted in, marketing messages
• Hosting/server provider — the underlying infrastructure that keeps the site online

If you request a password reset, your IP address is included in that reset email automatically — that's a standard security measure most sites use to help detect unauthorized reset attempts.

We do not share your information with third parties for their own marketing purposes, and we don't hand data over to anyone outside this list unless we're legally required to — for example, in response to a valid court order.

International Data Transfers

Because we serve customers in the US, UK, and across Europe, your data may be processed or stored on servers located outside your home country. Where that applies to customers in the UK or EU, we take reasonable steps to make sure any such transfer meets GDPR's requirements for adequate protection, whether through standard contractual clauses or working with providers that meet recognized data protection standards.

How Long We Keep Your Data

We keep order and account information for as long as your account is active, or as long as we're legally required to retain transaction records — this is often several years for accounting and tax purposes, even after an order is complete. If you contact us for support, we keep that correspondence long enough to be useful if you follow up again, then it eventually ages out. If you request deletion of your data (see below), we remove what we can, except anything we're legally obligated to hold onto.

Your Rights Over Your Data

If you're a customer in the UK or EU, GDPR gives you specific, enforceable rights, and we honor them for every customer regardless of location:

• Access — you can ask what personal data we hold about you, and we'll provide it.
• Correction — if something's wrong or out of date, you can ask us to fix it.
• Erasure — you can ask us to delete your data, and we will, except where we're required by law to keep certain records (like transaction history for tax purposes).
• Portability — you can request an exported copy of the data you've given us, in a usable format.
• Objection — you can object to us using your data for marketing at any time, and we'll stop.
• Withdraw consent — if you'd opted into something (like marketing emails), you can pull that consent back whenever you like.
• Complain — if you believe we've mishandled your data, you have the right to lodge a complaint with your country's data protection authority, not just with us.

To use any of these rights, just email info@viloralab.store with what you're asking for. We'll respond within a reasonable timeframe, generally within 30 days, which is the standard GDPR expects.

If you're in the US, we apply these same protections as a matter of practice, even outside states with specific privacy laws like California's CCPA — we'd rather have one consistent standard than different treatment depending on where someone happens to live.

Account Access

If you've created an account with us, you can view, edit, or delete your personal information at any time by logging in — with the exception of your username, which can't be changed once set. As site administrators, we can also see and update this information if you need help doing it yourself.

If you check out as a guest without creating an account, we still keep the order and shipping details tied to that purchase for the retention period described above, but there's no login for you to manage it through — if you'd like to update or remove that information, just email us directly.

Data Security

Your information is protected using SSL encryption across the site, and payment data never touches our own servers directly — it's handled entirely by our payment processor's secure systems. We restrict internal access to personal data to only what's needed to do the job, whether that's fulfilling an order or responding to a support ticket. No system is completely immune to risk, but we treat this seriously and keep our practices current.

Automated Spam and Fraud Detection

Messages submitted through contact forms or comments may be checked through an automated spam detection service before reaching us. This is standard practice to keep the inbox usable and to flag anything that looks like it's not a genuine customer inquiry.

Children's Privacy

This site isn't intended for anyone under 18, and we don't knowingly collect personal information from children. If we become aware that we've inadvertently collected data from a minor, we'll delete it.

Marketing Communications

If you've opted into our emails, you'll hear from us about new arrivals, offers, and the occasional update — nothing excessive. Every marketing email includes an unsubscribe link, and opting out takes effect immediately, no back-and-forth required. Opting out of marketing doesn't affect transactional emails like order confirmations or shipping updates, which you'll still receive because they're necessary to complete your order.

Changes to This Policy

We may update this Privacy Policy occasionally, whether because our practices change, we add a new service, or the law requires it. The date at the top of this page reflects the last update. If a change is significant enough to affect how your existing data is used, we'll make a reasonable effort to let you know directly rather than just quietly updating the page.

Contact Us

For anything related to this policy — a question, a data request, a complaint — email info@viloralab.store and we'll get back to you personally, not through an automated loop.