Privacy

What we collect

To send you a candle, we need and keep:

• Your name, email address, and phone number.
• Your shipping address, and your billing address if it differs.
• What you ordered, what you paid, and when.

Your card number

We never have it. Card fields at checkout are rendered by Stripe, inside a frame served from Stripe's own domain, and the number goes straight from your browser to them. It does not pass through this site's code and it is not stored on our server, because it never reaches our server.

What comes back to us is the last four digits and a yes or no.

Your cart

The cart lives in your own browser's local storage until you check out. It is not an account, we cannot read it, and clearing your browser data deletes it.

Who else sees your details

• Stripe, to take the payment and email your receipt.
• The carrier, to deliver the box — name, address, and phone number only.
• Google, if you accept measurement cookies — see the section below.
• Vercel, who serve this site and count its page views — see "Page counts" below.

Measurement cookies

We advertise, and we would rather know which advert brought you here than guess. That is done with Google's tag, and it is the only script here that can set a cookie.

It is off until you answer the bar at the bottom of the screen. Decline and the tag still loads but stores nothing on your device and reads nothing back — Google calls this consent mode, and what it gets from you is an anonymous, unlinked count. Accept and it may set cookies that recognise this browser across visits.

In the EEA, the UK, and Switzerland nothing is stored until you accept. Everywhere else it starts on and the bar lets you switch it off. Either way the choice is remembered in your own browser, and "Cookie choices" in the footer reopens it whenever you want to change your mind.

Page counts

Vercel host this site, and they count its page views for us: which page, where the visit came from, and roughly what kind of device and country it was. No cookie, nothing written to your browser, and no profile that follows you anywhere. Vercel call it Web Analytics; the visitor it counts is a hash that is thrown away and re-made from scratch every day.

Two things are stripped before a page view leaves your browser. Anything in the web address that is not campaign attribution — your order confirmation, for one, carries a payment reference we have no reason to hand on. And every page view at all, if you told the bar at the bottom of the screen no: declining measurement turns this off as well, even though it stores nothing and could have carried on.

What we do not do

• No advertising pixels beyond that one Google tag — no Meta, no TikTok, no data broker.
• No cookies beyond what checkout and that tag need.
• We do not sell your details, and we never will. Under California law, allowing advertising cookies can count as "sharing" for cross-context advertising — declining them is how you opt out, and it is one click.
• No marketing email unless you ask for it, and one line in reply unsubscribes you.

How long we keep it

Order records for as long as tax and accounting law requires us to keep them. Everything else, only while it is useful for the order it belongs to.

Your say over it

Just email orders@threeatelier.com and ask for a copy of what we hold, a correction, or a deletion. We will do it, and we will not ask why. If you live in California, the CCPA gives you those rights by statute; we apply them to everyone regardless.

Deleting an order record we are legally required to retain is the one request we may have to refuse, and we will say so plainly if it comes up.

Children

This shop is not for children. We do not knowingly collect anything from anyone under 16.

Changes

If this policy changes, the date at the top of the page changes with it. There is no other version.