Privacy Policy

01

What we collect, and why

• Orders: name, email, phone number, delivery address and what you ordered. We use it to fulfil your order, give support and keep tax records.
• Guest checkout: if you buy without an account, the email you give is used for your receipt, delivery updates and support. We don’t create an account for you, and we don’t email you news or offers unless you tick the box. If you buy a mini, its credit toward a full-size jar is tied to that email, and you use it by signing in with the same address.
• Bot check: guest checkout runs Cloudflare Turnstile to confirm a real person is buying. Cloudflare reads signals from your browser and device, and your IP address, to do this. It doesn’t use cookies. See Cloudflare’s Turnstile privacy addendum.
• Payments: processed by Stripe. We don’t see or store your full card number.
• Your account: if you create one, your name, email and any delivery addresses you save, so you can sign in and check out faster.
• Waitlist, news and offers: name and email, only if you sign up or tick the opt-in box (on a sign-up form, the skin quiz or at checkout). We use it to send launch updates, news and offers. Unsubscribe any time from the link in any of these emails.
• Skin quiz: your answers, used to suggest a formula. If you’re signed in we save them to your account. If you add your email to join the waitlist, we use it to send your result and launch updates.
• The Open Jar panel: if you apply, your name, email, city or region, skin type, and the moisturiser and sunscreen you use now, so we can choose panelists and contact you about it.
• Messages: what you send us, so we can reply.
• Website data: device and browser details, your IP address and the pages visited, collected by our host as ordinary server logs. To limit repeated form submissions we also hold your IP address for about a day.

02

Cookies and local storage

We don’t run analytics, advertising pixels or any tracking tool, and we don’t use Google Analytics. What the site does set:

• A sign-in cookie from Clerk, our sign-in provider, only if you sign in.
• Your cart, saved in your browser’s local storage so it’s still there when you come back. It stays until you clear it.
• A note in your browser’s session storage if you close the announcement banner. It clears when you close the tab.
• On the checkout page, Stripe loads and sets its own cookies for payment and fraud prevention.

You can block or clear cookies and local storage in your browser settings. Some of the site may not work without them. We don’t sell data collected through cookies.

03

Who we share it with

Only the providers we need to run the business: hosting and bot checks (Cloudflare and Vercel), database and image storage (Supabase), sign-in (Clerk), payments (Stripe), email (Resend), and our courier. We don’t sell your personal information. We may disclose it where the law requires.

04

Information held overseas

Some of these providers store or process information outside New Zealand. We take reasonable steps to make sure they protect it to a standard comparable with New Zealand law, and we stay responsible for it.

05

How long we keep it, and how we protect it

Order records, including guest orders, are kept for the seven years New Zealand tax law requires. Waitlist, news and offers details are kept until you unsubscribe. Skin quiz answers are saved only if you’re signed in, and stay with your account until you change them or delete it; if you aren’t signed in, your answers aren’t stored. IP addresses used to limit repeated form submissions are removed after about a day.

We hold information on secured systems with access limited to what the business needs, and our website is served over HTTPS. No method of transmission over the internet is completely secure, so we can’t guarantee absolute security.

If you ask us to delete something, we will unless the law requires us to keep it. If you checked out as a guest, email hello@sootheka.com from the address you used: we’ll take you off our mailing list and delete what we don’t need to keep. Order records stay for the seven years tax law requires. When you delete your account, we remove your profile, addresses and saved items and anonymise your past orders, which we keep as tax records. A mini credit code we issued to your email address stays on file so it can’t be claimed twice.

06

Your rights

You can ask for a copy of your personal information, and ask us to correct it. Email hello@sootheka.com. We’ll respond within 20 working days.

07

Privacy contact and complaints

Our privacy contact is Apurva Modi, hello@sootheka.com. If you’re not happy with how we’ve handled your information, tell us first. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

08

Children

Our website and products are not directed at children under 13. We don’t knowingly collect personal information from children. If you believe we have, contact us and we will delete it promptly.

09

Changes

We’ll update this page and its date if our practices change. This policy covers how we handle your personal information. For the rules that govern using this website and buying from us, see our Terms.