Privacy Policy
Last updated: 2026
Overview
This policy explains what personal information Luna & Stone collects, how we use it, who we share it with, and the choices and rights you have. By using our site you consent to the practices described here.
Information We Collect
- Information you provide: name, email, shipping/billing address, phone, account password (stored hashed), order notes, contact-form messages, and any intentions or answers you enter in the Dao Compass.
- Order & payment data: items ordered and amounts. Card numbers are handled by Stripe/PayPal and are never stored on our servers.
- Automatically collected: IP address, browser/device type, language preference, pages viewed, referrer, and cookie/analytics identifiers.
How We Use Information
- Process, fulfill, and support orders, returns, and payments.
- Create and deliver Compass readings and personalized guidance.
- Send transactional emails and, with consent, marketing emails (unsubscribe in one click).
- Prevent fraud and abuse, and maintain site security.
- Understand and improve our products, content, and shopping experience.
- Comply with applicable legal and tax obligations.
Cookies, Analytics & Advertising Pixels
We keep our cookie use deliberately small. Essential cookies are required for the store to function and cannot be switched off. Analytics and marketing cookies are only set after you choose to accept them in the cookie banner — if you select "Essential only", no analytics or advertising cookie is created and no third-party tag is loaded.
| Cookie | Purpose | Type | Duration |
csrf_token | Protects forms against cross-site request forgery | Essential | 1 day |
lang | Remembers the language you selected | Essential | 1 year |
cf_clearance | Cloudflare bot protection | Essential | 1 year |
cookie_consent | Remembers this cookie choice | Essential | 180 days |
funnel_sid | Random visitor ID used to assign A/B tests and link page views within a visit. First-party only, no cross-site tracking. | Analytics | 30 days |
_ga, _ga_* | Aggregated traffic and behaviour statistics (Google Analytics) | Analytics | up to 2 years |
_fbp | Advertising measurement and remarketing (Meta) | Marketing | 90 days |
_ttp | Advertising measurement and remarketing (TikTok) | Marketing | 13 months |
You can change your choice at any time with Cookie preferences in the footer, or by clearing cookies in your browser. Blocking essential cookies will break checkout.
How We Share Information
We share data only with service providers who help us operate—payment processors (Stripe, PayPal), shipping carriers, email/SMTP providers, hosting, and analytics/advertising tools—under appropriate confidentiality terms. We may also disclose information where required by law. We do not sell your personal information.
Data Retention
We keep order and tax records for as long as required by law (typically several years for accounting/tax purposes). Marketing contacts and Compass leads are retained until you unsubscribe or request deletion; inactive records are periodically purged.
Your Privacy Rights (US Residents)
Depending on your state (including CCPA/CPRA in California, and comparable laws in Virginia, Colorado, Connecticut, Texas, Oregon, and Montana), you may have the right to:
- Know what personal information we collect and how it is used/shared;
- Access or receive a copy of your data;
- Correct inaccurate information;
- Request deletion, subject to legal retention;
- Opt out of sale/sharing or targeted advertising (we do not sell data);
- Not receive discriminatory treatment for exercising these rights.
To exercise any right, email [email protected]. We may verify your identity before acting on a request.
Children's Privacy
Our site is not directed to children under 13 (or the applicable age in your state), and we do not knowingly collect their information. If you believe a child provided us data, contact us and we will delete it.
International Visitors
If you access the site from outside the United States, your information may be transferred to and processed in the U.S., where data-protection rules may differ from those in your region.
Data Security
We use HTTPS/TLS encryption in transit, hashed passwords, rate limiting, and restricted internal access. No method of transmission or storage is 100% secure, but we work to protect your information.
Changes & Contact
We may update this policy; the "last updated" date reflects changes. Questions or requests: [email protected].
