Privacy policy

When you place an order we collect your name, email address, shipping and billing address, phone number if you give one, and the contents of your order. Payment card details are entered on our payment processor’s hosted checkout and are never sent to or stored on our servers.

We also collect basic analytics about how the site is used — pages viewed, referring site, device type, approximate location from IP. This is aggregated and is not used to build a profile of you as an individual.

To fulfil and ship your order, to send order and shipping confirmations, to handle returns and support requests, to prevent fraud, to meet tax and accounting obligations, and — only if you explicitly opt in — to send marketing email. Every marketing email has a one-click unsubscribe.

Only the service providers we need to run the store: our ecommerce and payment platform, our shipping carriers and label provider, our email provider, and our analytics provider. Each processes your data on our instructions and is not permitted to use it for their own marketing. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

We use cookies and local storage that are strictly necessary to keep your cart and complete checkout, plus analytics cookies to understand site usage. You can block cookies in your browser; the cart will stop persisting between visits if you do.

Wherever you live, you can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. If you are a California resident, the CCPA/CPRA also gives you the right to know what we collect and to opt out of sale or sharing — we do neither, but the right stands. If you are in the EU or UK, the GDPR rights of access, rectification, erasure, restriction, portability and objection apply.

To exercise any of these, email hello@shopnepalaya.com. We will respond within 30 days and will not charge you or treat you differently for asking.

Order records are kept for seven years because tax law requires it. Marketing contacts are kept until you unsubscribe. Analytics data is retained in aggregate for 26 months.

This store is not directed at children under 13 and we do not knowingly collect their personal information. If you believe a child has given us data, email us and we will delete it.

If we change this policy materially we will update the date at the top and, where the change affects how we use data you have already given us, email you about it.