Privacy policy
# Privacy Policy
**Last revised: October 19, 2026**
SUJEEWA SENARATH LLC, doing business as hearthluma ("hearthluma," "we," "us," or "our"), provides this Privacy Policy to explain how personal information is collected, used, disclosed, retained, and protected when someone visits https://hearthluma.shop, purchases merchandise, contacts us, or uses a related store feature (collectively, the "Services").
SUJEEWA SENARATH LLC is the controller responsible for processing described here. Shopify and certain other providers may independently control information for their own stated processing activities.
## Information We Handle
### Information Supplied by Customers
Depending on the interaction, we may receive:
- name, telephone number, email address, billing address, and shipping address;
- product selections, transaction value, order status, payment confirmation, delivery, return, and refund information;
- account credentials and preferences if customer accounts are available;
- support messages, complaints, reviews, photographs, surveys, and other submissions; and
- marketing subscriptions, cookie choices, privacy preferences, and consent records.
Payment credentials are submitted to the provider displayed at checkout. We ordinarily receive limited payment details and confirmation of the transaction rather than a full card number or security code.
### Information Collected Through Technology
We and our providers may automatically record IP address, browser and device details, operating system, device identifiers, referral source, approximate location based on IP, pages visited, cart activity, checkout interactions, and activity dates and times. Cookies, pixels, tags, and similar tools may collect this information.
### Information Received From Others
Other sources may include Shopify, payment and fraud-prevention services, warehouses, fulfillment partners, delivery carriers, analytics or advertising providers, social platforms, and operational vendors.
## How Information Is Used
We may process personal information to:
- authorize payment, confirm and fulfill orders, arrange shipping, send transactional messages, and administer cancellations, returns, replacements, and refunds;
- create customer accounts and maintain requested settings;
- answer questions and address complaints or product issues;
- detect, investigate, and prevent fraud, abuse, unlawful conduct, and security incidents;
- evaluate performance and improve merchandise, website operation, and customer support;
- send marketing communications where permitted and respect unsubscribe choices;
- personalize content or advertising where lawful and consistent with user selections;
- comply with accounting, tax, consumer-protection, and regulatory requirements; and
- enforce agreements and establish, exercise, or defend legal claims.
When UK data protection law applies, we may rely on performance of a contract or requested pre-contract steps, compliance with a legal obligation, consent, or legitimate interests such as operating and protecting the Store, preventing fraud, assisting customers, and improving the business. We assess those interests against individual rights. Consent may be withdrawn prospectively at any time.
## Cookies and Available Controls
Essential technology supports checkout, security, carts, fraud prevention, and preferences requested by visitors. Depending on location, Store settings, and consent, other technology may support analytics, personalization, or advertising.
Use the cookie banner or privacy control shown by hearthluma to manage available choices. Browser settings can also block or delete cookies, although essential functions may no longer work. Marketing emails contain an unsubscribe method. Choices can require renewal after cookies are cleared or when a different browser or device is used.
## Information Sharing
We may disclose relevant information to:
- Shopify for Store hosting, checkout, analytics, infrastructure, and related commerce services;
- payment processors, card networks, banks, and fraud-prevention companies;
- fulfillment centers, warehouses, logistics partners, and delivery carriers;
- providers of cloud hosting, security, email, customer support, analytics, advertising, and other operational tools;
- accountants, insurers, auditors, lawyers, and other professional advisers;
- courts, regulators, law enforcement, and other parties where disclosure is required or permitted for compliance, safety, rights protection, or a legal claim; and
- a potential or completed lender, investor, purchaser, or successor connected with a merger, financing, reorganization, acquisition, or asset transfer, subject to appropriate safeguards.
We do not exchange personal information for money. Some U.S. state privacy statutes can nevertheless classify cookie-based advertising or analytics disclosures as a "sale," "sharing," or targeted advertising. Where those laws apply, use the Store's cookie banner or data-sharing opt-out control, or email us. We recognize browser signals such as Global Privacy Control where legally required and supported by our configuration.
## Shopify's Role
Shopify hosts hearthluma and processes information to supply and improve its commerce platform. Processing may occur in the United States, Canada, and other countries. Shopify's own privacy statement is at https://www.shopify.com/legal/privacy. Payment options, applications, and independent services may have separate notices.
## Retention of Information
We keep personal information for only as long as reasonably needed. Factors include order completion, support, returns, warranties, the customer relationship, fraud prevention, limitation periods, and required tax, accounting, or consumer records. Information no longer required is deleted, anonymized, or securely restricted pending deletion.
## Transfers Between Countries
Providers may process information outside the country where it was collected. Privacy laws may differ. When legally necessary, we use an approved safeguard such as an adequacy decision or regulation, recognized contractual clauses, or another lawful mechanism.
## Security
We maintain reasonable organizational, technical, and administrative safeguards designed for the information and risk involved. No transmission or storage system is entirely secure. Keep credentials confidential and notify us if you suspect unauthorized account activity or transactions.
## Your Rights
Depending on location and applicable law, and subject to verification and legal exceptions, you may have a right to:
- know whether personal information is processed and obtain access or a copy;
- correct inaccurate or incomplete information;
- request deletion;
- obtain eligible information in portable form;
- object to or restrict specified processing;
- withdraw consent for future processing;
- opt out of qualifying sale, sharing, targeted advertising, or profiling;
- limit certain uses or disclosures of sensitive personal information; and
- appeal a request decision where applicable state law offers an appeal.
Submit a request or appeal to nabsocashigne@outlook.com. Identify the right involved and provide enough information to locate the relevant record. We may ask for reasonable identity verification. Where an authorized agent is allowed, we may require proof of authority and permitted direct verification.
We do not unlawfully discriminate against anyone for exercising a privacy right. UK residents may also lodge a complaint with the Information Commissioner's Office at https://ico.org.uk. We encourage contacting us first so we can attempt to resolve the matter.
## U.S. State Privacy Notice
In the preceding 12 months, we may have collected identifiers and contact details, customer records, commercial and transaction information, internet or electronic activity, approximate IP-based location, and shopping-interest inferences. Sources include customers, devices, and the providers identified above. We use and disclose those categories for the purposes in this policy.
We do not knowingly use sensitive personal information to infer characteristics. We do not knowingly sell or share personal information of consumers under 16. State-specific rights and disclosures apply only where the relevant statute covers SUJEEWA SENARATH LLC, the individual, and the processing.
## Children's Information
The Services are not directed to children under 13, and we do not knowingly collect personal information directly from them. A parent or guardian who believes a child submitted information should contact us so we can investigate and delete it where required. Minors without legal capacity should use the Services only with parent or guardian involvement.
## Third-Party Websites
External links can lead to services we do not control. The independent operator is responsible for its privacy and security practices. Review its notice before providing information.
## Policy Changes
We may amend this policy to reflect changes in our Services, technology, practices, or legal duties. The current version and revision date will be posted here. Additional notice or consent will be provided where required.
## Privacy Contact
**SUJEEWA SENARATH LLC, doing business as hearthluma**
Email: nabsocashigne@outlook.com
Website: https://hearthluma.shop
Business address: 66 ASPEN DR, JACKSON, WY 83001, United States
Legal representative: SUJEEWA SENARATH PALAYANGODA