Privacy

What we collect

To send you an order we collect your name, shipping address, email address, and what you bought.

We also note how you found us: the page you first arrived on and, if you came from one of our ads or a tagged link, which campaign it was. This is saved with your order so we can tell which ads work.

We never see your card number. Card details are entered directly into a payment form hosted by Square, our payment processor, and are sent to them rather than to us. We receive only a confirmation that the payment succeeded and the last few digits of the card.

Who it is shared with

Three parties, each for one purpose:

• Square processes the payment and handles refunds and disputes.
• Our fulfilment partner receives your name, shipping address and email address so your order can be packed, posted and tracked. They do not receive your payment details.
• Meta (Facebook and Instagram), so we can tell which of our ads led to a purchase. When you buy, we tell Meta the order value and products, with your email address, name, city, state, ZIP code and country in a scrambled (hashed) form, plus your IP address and browser. We delete our copy of the IP address and browser once Meta has the event. Meta does not receive your street address or payment details.

We do not sell your data. If your browser sends a Global Privacy Control signal, we treat it as an opt-out: we load no Meta code for you and tell Meta nothing about your purchase.

Email

We email you about your order — a confirmation, and tracking when it ships. We do not add you to a marketing list as a condition of buying.

How long we keep it

Full order records, including your address, are kept for 18 months. After that we strip the personal detail, including any ad click identifier, and keep only the financial record — amount, date, order number, and the payment reference — because that is a tax record we are required to retain.

Where sales tax applied to your order, the destination state is kept with that financial record, because it forms part of the tax return.

Your choices

Write to support@theheartgem.com to ask what we hold about you, to correct it, or to ask us to delete it. We will do so except where we are required to keep a financial record, in which case we will reduce it to the minimum described above and tell you what was kept.

Cookies

We set one cookie of our own. It records the page you arrived on and, if you came from one of our ads or a tagged link, which campaign it was. It lasts 90 days, only this site can read it, and nothing on the page can read it. When you place an order, it is saved with the order, as described above.

On product and browsing pages, we also use Meta's pixel, which sets Meta's own cookies so our ads can be measured and shown to people likely to be interested. It never runs on the checkout page or on your order page, and it does not run at all if your browser sends a Global Privacy Control signal.