Privacy policy

1. Who we are

Moonie Skin is an Irish skincare brand and the data controller for the personal data described in this policy.

• Company: Moonie Skin, registered in Ireland, company number [COMPANY NUMBER].
• Registered address: [REGISTERED ADDRESS].
• Privacy contact: hello@moonie.skin.

2. What we collect

We collect the minimum needed to sell and deliver skincare:

• Order and contact details — your name, email address, delivery address and the items you ordered. Payment is taken by Stripe; your card details never reach our servers.
• Cart sessions— the contents of your basket are saved on our server against a random session ID stored in your browser's localStorage, so your cart survives reloads. The session ID is random and contains no personal information; if you enter checkout, your email is associated with the session so we can link it to your order.
• Newsletter email — if you join the Moonie list, we store the email address you give us and where you signed up.
• Support correspondence — emails you send to hello@moonie.skin.

3. Lawful bases

Under the EU General Data Protection Regulation (GDPR) we rely on:

• Performance of a contract (Article 6(1)(b)) — to process your order, take payment, deliver your parcel and handle returns.
• Consent (Article 6(1)(a)) — for the newsletter. You can withdraw consent at any time via the unsubscribe link in any email or by contacting us.
• Legitimate interests (Article 6(1)(f)) — to keep your cart between visits, prevent fraud and abuse, and respond to your messages.
• Legal obligation (Article 6(1)(c)) — to keep invoices and transaction records required by Irish tax and company law.

4. Who we share data with (processors)

We never sell your data. We share it only with service providers who process it on our behalf, under contract:

• Stripe (Stripe Payments Europe, Ltd, Ireland) — payment processing. Stripe receives your email, billing details and card information directly, and acts under its own privacy policy for payment data.
• DHL (DHL Express) — delivery. DHL receives your name, delivery address and contact details to deliver your parcel and provide tracking.
• Resend — transactional email. Resend processes your email address to send order confirmations and dispatch notifications.
• Hosting — our website and database run on infrastructure operated for us in the EU/EEA [HOSTING PROVIDER — CONFIRM LOCATION].

Where a processor transfers data outside the EEA, the transfer is protected by an adequacy decision or the European Commission's Standard Contractual Clauses.

5. How long we keep data

• Orders and invoices — 6 years after the transaction, as required by Irish tax and company law.
• Cart sessions — inactive sessions are routinely deleted; a session that never becomes an order is not kept long-term.
• Newsletter emails — until you unsubscribe or ask us to delete them.
• Support emails — up to 2 years after the query is resolved, so we have context if you contact us again.

6. Cookies & local storage

We use no tracking cookies and no third-party analytics today. The only browser storage we use is functional localStorage on this device: your cart contents, a random cart session ID, and your checkout contact details so the form remembers you. None of it is used to profile you or shared with advertisers, which is why you don't see a cookie consent banner.

If we ever add analytics or marketing tools, this section will be updated first and, where required, we will ask for your consent before anything is set.

7. Your rights

Under the GDPR and the Irish Data Protection Act 2018 you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased where there is no legal reason for us to keep it;
• restrict or object to our processing;
• receive the data you gave us in a portable, machine-readable format;
• withdraw consent at any time (for example, unsubscribe from the newsletter), without affecting processing already carried out.

To exercise any of these rights, email hello@moonie.skin. We respond within one month. If you're unhappy with our answer, you can lodge a complaint with the Irish supervisory authority: the Data Protection Commission (21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland).

8. Changes to this policy

If we change how we handle personal data, we'll update this page and revise the “last updated” date above. Material changes (like adding analytics) will be highlighted here before they take effect.