Privacy Policy
What we collect, why, how long we keep it, and how to delete it. GDPR and CCPA rights.
Most of this document is published below, including our Florida registration numbers in full. The sections marked “with counsel” are the ones a lawyer has to write — liability and jurisdiction — and we would rather name the gap than dress up placeholder text as a legal clause.
1 · What we collect
Your name, your email address and a one-way cryptographic hash of your password. We never store the password itself and cannot recover it — a reset replaces it, it does not reveal it.
The addresses you enter at checkout, frozen onto each order. Your cart, whether or not you are signed in. Your orders, with what you paid for each item and what the market said that day.
Your cookie choices. The IP address of a failed sign-in attempt, kept only to rate-limit password guessing.
We do not collect card numbers. Payment runs through a hosted processor page, so a card number never reaches this site or our servers.
2 · Why we collect it
To sell you something and get it to you: an order needs an address, and a receipt needs an account to belong to.
To honour the promises attached to what you bought — the buyback runs 12 months off your order history, and without that history there is nothing to claim against.
To keep the account yours: sessions and the sign-in throttle exist for that and nothing else.
We do not build advertising profiles, and we do not sell or rent your data to anyone. Analytics and marketing cookies are off until you turn them on.
3 · Who we share it with
The payment processor, which needs the order total and your email to take payment and to handle a dispute.
The carrier, which needs the delivery address and your name.
The email provider that delivers your receipt.
Nobody else. There is no data broker, no advertising network and no affiliate in this list.
4 · How long we keep it
Orders and their receipts: seven years, because tax authorities require it and a buyback window can be open for two of them.
Your account: until you delete it.
Sessions: 30 days, or until you sign out. Failed sign-in records: 15 minutes.
Deleting your account removes your name, email and addresses. It does not remove the orders themselves — those are financial records we are required to keep — and it cannot run while an order is open or a lease is active.
5 · Your rights
You can ask for a copy of everything tied to your account, in a machine-readable format, and we send it within 30 days.
You can ask us to correct anything that is wrong, and to delete your account subject to the retention above.
You can change your cookie choices at any time from the Cookie Policy, and withdrawing consent is as easy as giving it.
If you are in California, the CCPA rights to know, delete and opt out of sale apply — and we do not sell personal information, so there is nothing to opt out of. If you are in the EEA or the UK, the GDPR rights of access, rectification, erasure, restriction, portability and objection apply.
Write to customerservice@harmonyeshops.com. We do not charge for any of this and we do not require an account to make the request.
6 · Contact the DPO
With counsel. Whether we are required to appoint a data protection officer, and who that would be.