Privacy policy

Last updated: July 26, 2026
Lovairo ("we", "us", or "our") operates this website and all related online store features, products, and services (collectively, the "Services"), with the core purpose of providing you with a curated shopping experience for premium paper goods and greeting cards. The collection of personal information is solely a necessary step to complete transactions, deliver customer support, and improve your shopping experience, and is never our primary business purpose.
Our Services are powered by Shopify, which enables us to process orders, accept payments, and host our storefront on our behalf. This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you visit, use, make purchases, or otherwise communicate with us through the Services. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy shall govern with respect to the collection, processing, and disclosure of your personal information.
Please read this Privacy Policy carefully. By accessing or using any of the Services, you acknowledge that you have read, understood, and agree to our collection, use, and disclosure of your information as described in this Privacy Policy.

1. Personal Information We Collect or Process

When we use the term "personal information", we refer to information that identifies, relates to, or can reasonably be linked to you or another individual. Personal information does not include anonymized or de-identified data that cannot be used to identify a specific person.
Depending on how you interact with the Services and applicable law, we may collect or process the following categories of personal information, including inferences drawn from this data:
  • Contact details: your full name, billing address, shipping address, phone number, and email address
  • Financial information: credit/debit card numbers, payment card details, transaction records, payment confirmation, and other payment-related information
  • Account information: username, password, security questions, account preferences, and settings
  • Transaction information: items you view, add to cart, save to wishlists, purchase, return, exchange or cancel, and your historical order records
  • Communications with us: content and details you share when contacting customer support or otherwise corresponding with us
  • Device information: details about your device, browser, and network connection, including your IP address and unique device identifiers
  • Usage information: data about how and when you interact with or navigate the Services

2. Sources of Personal Information

We collect personal information from the following sources:
  1. Directly from you: when you create an account, place an order, use the Services, contact customer support, or otherwise voluntarily provide information to us
  2. Automatically through the Services: from your device when you visit our website, through cookies, pixel tags, and similar tracking technologies
  3. Our service providers: from vendors that perform services on our behalf, who collect or process personal data to support our operations
  4. Business and marketing partners: from third-party advertising and analytics partners that help us deliver relevant content and measure ad performance

3. How We Use Your Personal Information

We use personal information only for legitimate business purposes consistent with this Privacy Policy and applicable law. Depending on your interaction with the Services, we may use your information for the following purposes:

3.1 Provide, Customize, and Improve the Services

We use your personal information to fulfill our contract with you, including processing payments, fulfilling and shipping orders, managing returns and exchanges, maintaining your account, remembering your preferences, sending account-related notifications, enabling product reviews, and creating a personalized shopping experience such as recommending relevant products. This includes using your information to improve the functionality and performance of our Services.

3.2 Marketing and Advertising

We use your personal information for marketing and promotional purposes, such as sending marketing communications via email, postal mail, or text message, and displaying online advertisements for our products on our website and third-party platforms, based on your browsing activity, purchase history, and cart activity on our Services.
We will never use your personal information, uploaded photos, images, or personal likeness for commercial advertising or promotional materials without your explicit prior written consent.

3.3 Security and Fraud Prevention

We use your personal information to authenticate your account, deliver secure payment processing, detect and investigate fraudulent, illegal, or malicious activity, protect public safety, and secure our Services. If you register an account, you are responsible for safeguarding your account credentials; we recommend not sharing your login details with any third party.

3.4 Customer Communications

We use your personal information to respond to your inquiries, provide customer support, and maintain our business relationship with you.

3.5 Legal Compliance

We use your personal information to comply with applicable laws and valid legal processes, including requests from law enforcement or government agencies, to respond to civil discovery or litigation, and to enforce our terms of service and policies.

3.6 Lawful Basis for Processing (EEA / UK / Switzerland Users)

For users located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR:
  • Contract performance: to process your orders, deliver products, and fulfill our contractual obligations to you
  • Legitimate interests: to improve our Services, prevent fraud, and send relevant marketing communications (where permitted by law)
  • Consent: for marketing communications and non-essential tracking technologies where we are required to obtain your prior opt-in consent
  • Legal obligation: to comply with tax, accounting, and other regulatory requirements

4. How We Disclose Personal Information

We may disclose your personal information to third parties only as described in this Privacy Policy and permitted by applicable law. We strictly do not sell your raw personal contact information — including your full name, email address, phone number, and physical mailing address — to any third parties for commercial purposes.
Circumstances in which we may disclose personal information include:
  1. Service providers: with Shopify and other third-party vendors that perform services on our behalf, including payment processing, IT hosting, data analytics, customer support, cloud storage, and order fulfillment and shipping. These providers process data only on our instructions and are contractually required to protect your information.
  2. Marketing and advertising partners: with business partners that help us deliver personalized advertising across the web. Any data shared with advertising partners is limited to pseudonymous identifiers, browsing behavior, and transaction statistics, and does not include your original contact details. Under applicable U.S. state privacy laws, this type of sharing for cross-context targeted advertising may constitute a "share" or "sale" of personal information.
  3. At your direction: when you request or consent to disclosure of specific information to third parties, such as for shipping delivery or through social media login integrations.
  4. Corporate affiliates: within our corporate group of companies for internal business purposes.
  5. Business transactions: in connection with a merger, acquisition, bankruptcy, or similar business transfer.
  6. Legal requirements: to comply with applicable law, respond to subpoenas, warrants, or other valid legal process, enforce our terms of service, and protect the rights, property, and safety of our business, our users, or others.

5. Relationship with Shopify

Our store and Services are hosted on the Shopify platform. The following clarifies our respective roles with respect to your personal information:
  • Lovairo is the data controller for all personal information you provide directly to us for the purpose of purchasing products and accessing our store. We are responsible for responding to most privacy rights requests related to your order, contact, and account data.
  • Shopify acts as our data processor, hosting our storefront, processing payments, and managing order fulfillment on our behalf, per our written instructions.
  • In limited cases, Shopify acts as an independent data controller for certain platform-wide features — such as cross-merchant personalized advertising and platform-level security improvements. For data processed by Shopify in its independent controller capacity, Shopify is responsible for responding to your related privacy rights requests.
To learn more about how Shopify processes your personal information and to exercise rights related to Shopify-controlled data, please visit the Shopify Consumer Privacy Policy.

6. Cookies and Tracking Technologies

We and our service providers use cookies, pixel tags, device fingerprinting, and similar tracking technologies to operate the Services, remember your preferences, understand usage patterns, and deliver personalized advertising.

6.1 Types of Cookies We Use

  • Essential cookies: required for the basic operation of our website, such as maintaining your shopping cart, processing checkout, and securing your session. These cannot be disabled if you wish to use core store functionality.
  • Analytics cookies: help us understand how visitors interact with our website, measure site performance, and improve the user experience.
  • Marketing and advertising cookies: used to deliver personalized advertisements on third-party websites, measure ad performance, and track conversion activity.

6.2 Managing Your Preferences

You can control or disable cookies through your browser settings. Please note that disabling certain cookies may impact the functionality of our website. For users in jurisdictions requiring prior consent for non-essential cookies, you may set your preferences via our cookie consent banner.
Other than the Global Privacy Control signal described below, we do not recognize browser-level "Do Not Track" signals at this time.

7. Data Security

We take reasonable technical and organizational measures to protect your personal information from unauthorized access, use, alteration, or disclosure.
All checkout and payment pages where you enter credit card, debit card, or other sensitive financial information are protected by industry-standard Secure Sockets Layer (SSL) encryption technology, which safeguards your data during transmission over the internet.
Please note that no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security of your information. We recommend you do not send sensitive or confidential information to us through unsecure communication channels.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by data category:
  • Transaction and financial records: retained for as long as required by applicable tax, accounting, and financial regulations (typically 3–7 years)
  • Customer account information: retained for the duration of your active account, plus 12 months after account closure unless a longer retention period is required by law
  • Marketing contact data: retained until you opt out of marketing communications; after opt-out, we retain only minimal suppression data to honor your preference
  • Device and usage data: retained for 12 months, after which it is either aggregated and anonymized or securely deleted

9. Your Privacy Rights and Choices

Depending on your location, you may have the following rights regarding your personal information. These rights are not absolute and may apply only in certain circumstances; we may decline requests where permitted by law. We will not discriminate against you for exercising any of these rights.

9.1 Rights for California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (as amended by the CPRA):
  • Right to Know / Access: request details about the personal information we collect, use, and disclose about you
  • Right to Delete: request deletion of the personal information we hold about you, subject to legal exceptions
  • Right to Correct: request correction of inaccurate personal information
  • Right to Opt Out of Sale / Sharing: opt out of the "sale" or "sharing" of your personal information for cross-context targeted advertising
  • Right to Non-Discrimination: not be treated differently for exercising your privacy rights
We will respond to verifiable requests within 45 days of receipt, as required by law. We may need to verify your identity before processing your request, typically by matching the email or order details you provide to our existing records. You may also designate an authorized agent to submit requests on your behalf, subject to verification of authorization.

9.2 Rights for EEA / UK / Switzerland Users (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under the GDPR:
  • Right of access to your personal data
  • Right to rectify inaccurate or incomplete data
  • Right to erasure ("right to be forgotten"), where permitted
  • Right to restrict processing in certain circumstances
  • Right to data portability
  • Right to object to processing based on legitimate interests, including direct marketing
  • Right to withdraw consent at any time, where processing is based on consent
To exercise any of these rights, please contact us using the details provided at the end of this policy. We will respond to valid requests within 30 days, extendable by an additional 30 days for complex requests.

9.3 Managing Marketing Communications

You may opt out of receiving promotional emails from us at any time by using the unsubscribe link included in every marketing email. If you opt out of marketing communications, we may still send you non-promotional messages related to your orders, account, or ongoing business relationship.

10. Global Privacy Control (GPC)

Our website recognizes the Global Privacy Control (GPC) browser signal.
For users located in jurisdictions that legally recognize GPC as a valid opt-out mechanism — including the State of California — we will automatically treat a valid GPC signal sent by your browser as a formal request to opt out of the sale or sharing of your personal information for cross-context targeted advertising, for that specific browser and device. If we are able to associate the device sending the signal with an existing customer account, we will also apply the opt-out request to your account.
Please note that a GPC signal only applies to the right to opt out of sale/sharing for targeted advertising. It does not cover other privacy rights such as access, deletion, or correction of your personal information. To learn more about Global Privacy Control, visit https://globalprivacycontrol.org/.

11. Free Gifts and Incentive Programs

We may provide free gifts, rewards, or other incentives to users only under the following circumstances. The collection of personal information is never the primary purpose of these activities:
  1. Complimentary gifts provided alongside qualifying product purchases at checkout
  2. Benefits issued as part of regular, publicly disclosed marketing campaigns and promotions
  3. Programs where the collection of personal information is incidental to the core offer and not a mandatory condition of receiving the benefit, except where required by law for program administration
We will never offer free gifts or incentives solely for the purpose of collecting your personal information.

12. Children's Privacy

Our Services are intended for general audiences and are not directed at children. We do not knowingly collect personal information from children under the age of 13 in compliance with the U.S. Children's Online Privacy Protection Act (COPPA), or from children below the applicable age threshold in your jurisdiction (e.g., 16 years old for users in the European Union under the GDPR).
If you are a parent or guardian and believe your child has provided us with personal information, please contact us using the details below and we will take steps to delete that information.
As of the effective date of this Privacy Policy, we do not have actual knowledge that we "sell" or "share" (as defined under applicable U.S. state privacy laws) personal information of individuals under 16 years of age.

13. Third-Party Websites and Links

The Services may contain links to third-party websites or online platforms. We do not control and are not responsible for the privacy practices, security, or content of these third-party sites. We encourage you to review the privacy policies of any third-party websites you visit.

14. International Data Transfers

Please note that we and our service providers may transfer, store, and process your personal information in countries outside of your country of residence, including the United States and Canada, where our headquarters and primary hosting providers are located.
For personal data transferred from the European Economic Area, the United Kingdom, or Switzerland, we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses (SCCs), or equivalent UK-approved contractual clauses, to ensure an adequate level of data protection.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will update the "Last updated" date at the top of this page and post the revised policy on our website. For significant changes that impact your rights, we will provide additional notice through prominent website banners or email to registered customers where required by law.

16. Contact Us

If you have questions about our privacy practices, this Privacy Policy, or wish to exercise your privacy rights, please contact us:
  • By email: claire@lovairo.com
  • By phone: +1 949-309-8259
  • By mail: 22611 Vía Tercero, Mission Viejo CA 92691, United States

17. Governing Law

For users located in the United States, this Privacy Policy shall be governed by and construed in accordance with the laws of the State of California, without regard to its conflict of law principles. For users located in the European Economic Area, United Kingdom, or other jurisdictions with mandatory local privacy laws, the applicable local laws shall govern to the extent required by law.