StoneLab collects only what an order needs: your name, email address, shipping address, the pieces you configured, and the payment reference returned by the payment provider. We never store card numbers; card payment is handled by Stripe and PayPal.
If you create an account, we store your email address, a scrypt hash of your password (never the password itself), your name, language preference, saved shipping addresses and designs saved to your account. We use it to sign you in, keep your saved designs, prefill addresses at checkout and show your order history. A session cookie (stonelab.customer) keeps you signed in for 8 hours, or 30 days if you choose “remember me”; the cookie is HttpOnly and SameSite=Lax. A small non-sensitive flag cookie (stonelab.customer.hint) lets the header show Account instead of Sign in. Addresses, cloud designs, your saved wrist size and wishlist are kept until you clear or remove them, or ask us to delete your account. Orders linked to your account follow the order-retention rule below. We never sell this data, and we only send marketing email if you opted in.
If you save a wrist size, it is used only to start the atelier at that size. Your wishlist stores the designs you save and is visible only to you. If you request a repair or resize, we keep the order reference, the item, your note and the request status at least until the request is resolved and for any warranty period; this is not a return or refund. Order and account emails are always sent; marketing email only goes to customers who opt in. You can remove saved addresses, cloud designs and wishlist items in your account; deleting the account or exporting your data still requires contacting support.
If you join the newsletter, we store your email address, language, signup source, subscription status, and confirmation/unsubscribe timestamps. We send a confirmation email first; no newsletter is sent until you click it. Every newsletter email includes an unsubscribe link, and you can ask support to delete the subscription record. We never sell the list or share it for third-party advertising.
If you accept analytics consent, we also keep a first-party anonymous analytics record: a random visitor id in browser storage, an HttpOnly attribution cookie, the pages you visit, referrer and UTM parameters, a coarse country/region supplied by our hosting edge, and device/browser/operating-system classification. Analytics events do not contain your IP address, raw user-agent string, email address, shipping address or password. If you sign in, a visit may be linked to your customer record so the console can show which source and device brought you in; we use this only for aggregate operations and never sell it. Google Analytics, Meta and TikTok pixels load only after the same consent and are governed by those providers. When you register or pay, our team receives an internal transactional email with the account or order details; this is not marketing. You can contact support to request deletion of analytics data.
Why we keep it
- to make and ship your order, and to answer your questions
- to keep an invoice and meet our accounting obligations
- to handle a quality claim within the promised window
We do not sell your data and we do not send marketing email without your explicit opt-in.
Your choices
You can ask us to delete the personal details we are not legally required to keep by emailing support@stonelab.example. Saved addresses, cloud designs and wishlist items can be deleted in your account; to delete your account or export your data, contact us at the same address. Order records are kept for accounting and warranty purposes.
Cookies and storage
The site stores a language cookie (stonelab.locale) so it can remember English or Chinese, and keeps your bag in your browser's local storage. After you accept analytics, the site stores an anonymous visitor id in browser storage and an HttpOnly attribution cookie (stonelab_visitor); no analytics script or first-party event is sent before that choice. If analytics are enabled on this site, they only run after you accept the consent banner.
Security and providers
The site is served over HTTPS. Our payment and email providers process data under their own privacy terms, and we choose providers that do not use storefront data for advertising.