Privacy Policy
Last updated: [EFFECTIVE_DATE]
1. Introduction
Welcome to Linen Lab ("we", "our", or "us"). Linen Lab is a wedding linen rental service that provides couples with curated, high-quality table linens, napkins, and textile accessories for their wedding day.
This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website and services. It applies to all information collected through our website, order process, and any related services, sales, or events.
This policy is effective as of [EFFECTIVE_DATE]. By using our services, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
We collect information you provide directly to us, information we collect automatically through your use of our services, and information we may receive from third parties.
Information You Provide
When you create an account, place an order, or contact us, you may provide:
- Full name and contact details (email address, phone number)
- Shipping and delivery address
- Wedding date and event details
- Linen color preferences and table configuration
- Payment information — processed securely by Stripe. We never store card numbers, CVV codes, or full payment card data on our servers. All payment data is handled directly by Stripe in accordance with PCI-DSS standards.
- Communications you send us, including support enquiries
Information Collected Automatically
When you access our website, we automatically collect certain technical information:
- Browser type, version, and operating system
- IP address and general geographic location (country/region level)
- Pages visited, time spent, and navigation paths
- Referring website or search terms
- Cookies and similar tracking technologies — see our Cookie Policy for details
Information from Third Parties
We may receive limited information from third-party services integrated into our platform, such as authentication providers or payment processors, solely to facilitate your use of our services.
3. How We Use Your Information
We use the information we collect for the following purposes:
- Order processing and fulfillment — to process your rental orders, arrange delivery and collection, and manage your account
- Communication about orders — to send order confirmations, shipping updates, return reminders, and respond to your enquiries
- Color matching recommendations — to provide personalised linen color and style recommendations based on your wedding details and preferences
- Service improvement and analytics — to understand how our website and services are used, identify improvements, and develop new features
- Legal compliance — to comply with applicable laws, resolve disputes, and enforce our agreements
4. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases as defined by the General Data Protection Regulation (GDPR) and UK GDPR:
- Contract performance (Article 6(1)(b)) — processing necessary to fulfil your rental order, manage your account, and provide our services to you
- Legitimate interests (Article 6(1)(f)) — processing necessary for our legitimate business interests, including fraud prevention, service improvement, and direct marketing to existing customers, where these interests are not overridden by your rights
- Consent (Article 6(1)(a)) — where you have given explicit consent, such as for analytics cookies or optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
- Legal obligation (Article 6(1)(c)) — where processing is necessary to comply with a legal obligation, such as tax record-keeping requirements
5. Your Rights Under GDPR
If you are located in the EEA or United Kingdom, you have the following rights regarding your personal data under the GDPR and UK GDPR:
- Right of access — you may request a copy of the personal data we hold about you
- Right to rectification — you may request correction of inaccurate or incomplete personal data
- Right to erasure ("right to be forgotten") — you may request deletion of your personal data, subject to legal retention obligations
- Right to data portability — you may request your personal data in a structured, commonly used, machine-readable format
- Right to restriction of processing — you may request that we limit how we use your data in certain circumstances
- Right to object — you may object to processing based on legitimate interests, including direct marketing
To exercise any of these rights, please contact us at [PRIVACY_EMAIL]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
6. Your Rights Under CCPA/CPRA
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:
- Right to know — you may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share it
- Right to delete — you may request deletion of personal information we have collected, subject to certain exceptions
- Right to opt out of sale or sharing — we do not sell or share your personal information for cross-context behavioural advertising as defined under CCPA/CPRA
- Right to correct — you may request correction of inaccurate personal information
- Right to limit use of sensitive personal information — you may request that we limit the use of sensitive personal information to what is necessary to provide the services
- Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny services, charge different prices, or provide a different quality of service because you exercised your rights.
To submit a CCPA/CPRA request, contact us at [PRIVACY_EMAIL]. We will verify your identity before processing your request and respond within 45 days, with one 45-day extension where reasonably necessary.
8. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements.
- Rental records — retained for [RETENTION_PERIOD] from the date of the rental event to support customer service enquiries and dispute resolution
- Account data — retained for the duration of your account; you may request account deletion at any time by contacting us at [PRIVACY_EMAIL]
- Order and financial records — retained for the period required by applicable tax and accounting laws (typically 7 years), even after account deletion
- Marketing preferences and consent records — retained until you withdraw consent or we are no longer required to keep them
9. Third-Party Services
We work with a limited set of carefully selected third-party service providers. Each provider is contractually bound to process your data only on our instructions and in accordance with applicable data protection law. The approved external services are:
- Stripe— payment processing. Card data is entered directly into Stripe's secure forms and never passes through our servers. Stripe is PCI-DSS Level 1 certified.
- Resend — transactional email delivery for order confirmations, shipping notifications, and account-related communications
- Supabase — cloud database and authentication infrastructure. Your account data and order records are stored here, protected by Row Level Security (RLS) policies ensuring you can only access your own data.
- Sentry — error tracking and application monitoring. Error reports are automatically scrubbed to exclude personally identifiable information before transmission.
- PostHog — product analytics to help us understand feature usage and improve the service. PostHog is only initialised after you have given explicit cookie consent.
We do not use any third-party services beyond those listed above for processing your personal data.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction:
- SSL/TLS encryption — all data transmitted between your browser and our servers is encrypted using industry-standard TLS protocols
- Row Level Security (RLS) — database-level security policies ensure that each user can only access their own records, enforced at the database layer independent of application logic
- PII redaction from logs — our application logging systems are configured to automatically redact personally identifiable information; email addresses, names, and other PII are never written to application logs
- Payment data isolation — no card numbers or sensitive payment data ever touches our servers; all payment handling is delegated to Stripe
- Regular security assessments — we conduct periodic reviews of our security practices, access controls, and third-party integrations
While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is 100% secure. If you believe your account has been compromised, please contact us immediately.
11. Children's Privacy
Our services are not directed to, and we do not knowingly collect personal information from, children under the age of 13 in the United States or under the age of 16 in the European Union and United Kingdom.
If you believe we have inadvertently collected personal information from a child below the applicable age threshold, please contact us at [PRIVACY_EMAIL] and we will take prompt steps to delete such information.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
For material changes, we will notify registered users via email at least 30 days before the changes take effect, where required by applicable law. The updated policy will also be posted on this page with a revised "Last updated" date.
Your continued use of our services after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree to the updated policy, you should stop using our services and may request account deletion.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:
- Email: [PRIVACY_EMAIL]
- Postal address: [COMPANY_ADDRESS]
We aim to respond to all privacy-related enquiries within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority.