Privacy policy

AmberSkin Co operates amberskin.store and is the data controller for the personal data described here. Reach us at support@amberskin.store.

• Order data — name, email, delivery address, phone, and what you bought. Needed to fulfil the contract.
• Payment data — handled entirely by Stripe. We never see or store your card number.
• Marketing data — your email address, if you choose to subscribe.
• Browsing behaviour — products viewed and cart activity, tied to a random session identifier, used to make recommendations relevant.
• Approximate location — derived from your IP by our host to pick a language and currency. We do not store your IP for this.
• Skin scan — if you use the scan, three photos are taken and an external AI service (Anthropic) looks at the front one; all of them are discarded straight away. We do not store the photos, log them, or use them to recognise you. What we keep is the result: scores for nine visible characteristics, your answers and the products recommended. The report stays readable in your account for 2 days; the result itself is kept for 12 months.
• AI assistant — the messages you send to our AI assistant are processed by an external AI service (Anthropic) so it can reply. We wipe the text of the conversation after 30 days; the fact that a conversation happened and which products we showed is kept.

Order and payment data: to perform our contract with you. Marketing email: your consent, withdrawable at any time. Recommendations and fraud prevention: our legitimate interest in running a working shop. Tax records: a legal obligation.

Only the processors needed to get your order to you and keep the shop running: our payment processor (Stripe), our email provider, our hosting provider, the supplier or carrier shipping your parcel, and our AI provider (Anthropic) for the skin scan and the assistant. We do not sell your data, and we do not share it for anyone else’s advertising.

Order records for seven years, because tax law requires it. Marketing subscriptions until you unsubscribe. Behavioural data for 24 months, after which it stops being useful for recommendations anyway. Scan results for 12 months, then they are deleted. Assistant conversations: the text after 30 days.

Under the GDPR you can ask for a copy of your data, ask us to correct or delete it, object to processing, or ask us to send it elsewhere. Email support@amberskin.store and we will respond within 30 days.

Every marketing email carries a one-click unsubscribe link. Using it stops marketing immediately; you will still get order and delivery confirmations, because those are part of the purchase you made.

If you think we have handled your data badly, you can complain to your national data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

We set a small number of first-party cookies: your chosen language and currency, your cart, and an admin session cookie if you are staff. There is no third-party advertising or cross-site tracking on this site.

This policy describes what the software actually does. It is not legal advice, and if you are operating this shop commercially you should have a lawyer in your jurisdiction review it before launch.