Privacy policy

OVESSI ("we", "us", "our") operates this website and store (the "Services"). This Privacy Policy describes how we collect, use and disclose your personal information when you visit, use or make a purchase on ovessi.com, or otherwise communicate with us.

By using the Services you confirm that you have read and understood this Privacy Policy.

Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information:

• Contact details : name, billing and shipping address, phone number and email address.
• Payment information : payment card details, transaction details and confirmation. Card numbers are processed by our payment provider and are not stored by us.
• Account information : username, password, account preferences and order history.
• Order information : the products you purchase, returns and customer-service correspondence.
• Customer-support information : messages you send us by email or contact form.
• Usage information : device identifiers, IP address, browser type, pages viewed, referring site and similar information collected through cookies and similar technologies.
• Marketing preferences : your subscription status and engagement with our marketing communications.
• Skin Reading data : if you choose to use our on-site skin-analysis tool, photographs of your face and answers to skin-related questions. See the dedicated section below.

How We Use Your Information

We use personal information to:

• Process and fulfil orders, including payment, dispatch and customer service.
• Operate, maintain and improve the Services.
• Communicate with you about your orders, account and our products.
• Send marketing communications where you have agreed to receive them.
• Prevent fraud, secure our Services and comply with legal obligations.
• Generate personalised product recommendations through our optional Skin Reading tool.

Lawful Basis

Where UK or EU GDPR applies, we rely on one or more of the following lawful bases : performance of a contract (to fulfil your order), legitimate interests (to run and secure our business), your consent (for marketing, analytics cookies and the Skin Reading tool), and compliance with legal obligations.

Skin Reading

We offer an optional on-site skin-analysis tool ("Skin Reading") that produces personalised product recommendations. Use of the tool is entirely optional and is initiated only when you choose to start the reading.

If you choose to use the tool, you may submit a photograph of your face and answer questions about your skin. We process this data in order to generate your skin reading and personalised product recommendations. Photographs and quiz responses may include information that constitutes "special category" or "sensitive" personal data under UK GDPR, EU GDPR and certain US state privacy laws. We rely on your explicit consent (given by submitting the photograph and your answers) as the lawful basis for this processing.

To deliver this feature, we use carefully selected third-party technology partners who act as data processors on our behalf and are bound by contractual confidentiality and data-protection obligations. Data may be processed and stored outside the United Kingdom and the European Economic Area. Where data is transferred internationally, we rely on appropriate safeguards permitted under applicable law, such as Standard Contractual Clauses or equivalent mechanisms.

We do not sell or share photographs, quiz responses or skin-analysis results with third parties for advertising or marketing purposes. The data is used only to deliver your reading and generate product recommendations. Photographs are not displayed publicly and are not used to identify you outside the tool.

Receiving your reading by email. After your reading is generated, you can choose to receive the full Skin Reading dossier as a PDF by email. If you provide your email address for this purpose, we use it solely to (a) send you the dossier and (b) save the reading to your profile so you can return to it later or receive future readings tied to the same email. To produce and deliver this dossier we use a small set of carefully selected processors: Render Services, Inc. (EU region) hosts the renderer that assembles your dossier; Anthropic, PBC processes a short summary of your reading data to generate the editorial copy inside the dossier; Shopify hosts the resulting PDF on its CDN at a non-guessable URL; and Klaviyo Inc. sends you the email and stores the email profile linked to the reading. The PDF carries a single frame from your face scan as a visible record of your reading. The PDF lives on Shopify's content delivery network at a non-guessable address, and Klaviyo retains a link to it on your profile so we can send it to you and so you can ask for it again later. You may request deletion of the PDF and the linked profile data at any time using the contact details below. Each of these is bound by a data-processing agreement and, where data is transferred outside the United Kingdom or European Economic Area, Standard Contractual Clauses or equivalent safeguards. Providing your email here does not opt you in to marketing. You may unsubscribe from any future marketing at any time using the unsubscribe link in any email we send you, and you may request deletion of your reading and email profile at any time by writing to hello@ovessi.com.

You have the right to access, correct, delete or withdraw consent at any time. To exercise these rights, contact us using the details in the "Contact" section below.

How We Share Information

We share personal information with the following categories of service providers and partners, all of whom act as our data processors and are bound by written contracts that meet UK GDPR Article 28 and EU GDPR requirements:

Processor	Purpose	Region of processing
Shopify International Limited (Ireland) and Shopify Inc. (Canada)	E-commerce platform, hosting, checkout, order management, fraud screening, customer accounts.	EU (Ireland), Canada, US
Shopify Payments / Stripe	Card payment processing, 3-D Secure, payouts, chargeback handling.	EU, UK, US
PayPal (Europe) S.à r.l. et Cie, S.C.A.	Payment processing for customers who choose PayPal at checkout.	Luxembourg, EU
Apple Inc. and Google LLC	Apple Pay and Google Pay tokenised checkout, where you choose to use them.	US
Made-to-order fulfilment provider	Manufacture and dispatch of EU and US orders. Receives recipient name, address and order contents only.	EU, US
Klaviyo Inc.	Transactional and marketing email and SMS, on-site signup forms, subscriber profile storage, abandoned-cart and back-in-stock automations, and delivery and storage of your Skin Reading dossier PDF when you choose to receive it by email.	US (Standard Contractual Clauses in place for EU and UK data)
Google LLC (Google Analytics 4, Google Tag Manager)	Site analytics, traffic measurement and aggregated reporting. Fires only after analytics-cookie consent under our Consent Mode v2 implementation.	US, EU (Google Ireland)
Meta Platforms Ireland Limited (Facebook, Instagram)	Conversion tracking and advertising audiences. Fires only after marketing-cookie consent.	EU (Ireland), US
TikTok Information Technologies UK Limited	Conversion tracking and advertising audiences. Fires only after marketing-cookie consent.	UK, EEA, US, Singapore
Face Age (Skin Reading provider)	Powers the optional on-site Skin Reading tool. Receives the photograph and quiz answers you submit, returns a skin reading and product recommendations. Used only with your explicit consent.	EU, US (Standard Contractual Clauses where applicable)
Render Services, Inc.	Hosts the Skin Reading dossier-rendering service that compiles your reading into a PDF. Receives the reading data only when you trigger the dossier; data is processed in-memory and not retained on the renderer.	EU (Frankfurt), with US headquarters under Standard Contractual Clauses
Anthropic, PBC	Generates the editorial copy inside your Skin Reading dossier via the Claude language model. Receives a short non-identifying summary of your reading data (no photograph, no email). Anthropic does not train on this data.	US (Standard Contractual Clauses in place for EU and UK data)
BOGOS.io	Powers the free-candle-with-ritual gift offer at checkout. Receives cart contents only, no contact data.	US
Shopify Collabs	Manages our Partner Programme creator relationships and commission payouts. Receives creator-supplied profile data only when a creator applies.	EU, US
Royal Mail Group, DHL, FedEx, UPS, La Poste, Deutsche Post	Shipping and delivery. Receives recipient name, address and contact details to deliver your order.	UK, EU, US (varies by carrier and route)
Cloudflare, Inc.	Content delivery, DDoS protection, bot mitigation for ovessi.com.	Global edge network
Microsoft / Zoho Mail	Operating our hello@ovessi.com inbox infrastructure.	EU, US
MailerSend	Transactional order emails (order confirmation, dispatch, delivery, receipts) sent from send.ovessi.com.	EU, US
Professional advisors	Lawyers, accountants and similar advisors, where necessary.	UK, EU

We may also disclose personal information to authorities where required by law, regulation or legal process, or to protect our rights or those of others; and to successors in the event of a merger, acquisition or sale of assets.

We do not sell your personal information. We do not share it for cross-context behavioural advertising without your consent.

International Transfers

Your information may be transferred to, stored and processed in countries outside your country of residence, including outside the United Kingdom and the European Economic Area. Where we transfer personal data internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, the UK Addendum, or equivalent mechanisms. You may request a copy of the relevant safeguards by contacting us.

How Long We Keep Information

We keep personal information for as long as necessary to provide the Services, comply with our legal obligations (including tax and accounting), resolve disputes and enforce our agreements. Typical retention periods : order and tax records for seven years; marketing-subscriber profiles until you unsubscribe plus two years; Skin Reading photographs are processed for the duration of the analysis and then discarded; we do not retain the photograph itself. Where you choose to receive your reading dossier by email, the dossier PDF and the email profile linked to it are retained until you request deletion or two years after your last engagement, whichever is sooner. When information is no longer needed it is deleted or anonymised.

Cookies and Similar Technologies

We use cookies and similar technologies to operate the Services, remember your preferences, measure performance and personalise your experience. On first visit we show a privacy banner in line with UK GDPR, EU ePrivacy and applicable US state laws. Until you accept analytics or marketing cookies, only strictly necessary cookies are set; advertising and analytics tags such as Google Analytics, Meta Pixel and TikTok Pixel are gated by Consent Mode v2 and remain inactive. You can change your choice at any time using the "Cookie preferences" link in the footer of the site.

Your Rights

Subject to applicable law, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your information.
• Restrict or object to certain processing.
• Withdraw consent at any time, where processing is based on consent.
• Request a copy of your information in a portable format.
• Lodge a complaint with your local data-protection authority. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk). In Germany, your competent state data-protection authority. In Ireland, the Data Protection Commission. Residents of California and other US states with comprehensive privacy laws have equivalent rights under those laws.

To exercise any of these rights, email hello@ovessi.com. We will respond within the time limits set by applicable law (one month under UK and EU GDPR, extendable by two months where the request is complex).

California Notice (CCPA / CPRA)

California residents have the right to know what personal information we collect, to request its deletion or correction, to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. We do not sell personal information for money. Our use of analytics and advertising cookies may, depending on settings, constitute "sharing" for cross-context behavioural advertising under California law. You can opt out at any time using the "Cookie preferences" link in the footer, or by sending a Global Privacy Control (GPC) signal from your browser, which we honour automatically.

Children

The Services are not directed to children under the age of 16 and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal reasons. The most current version is always available on this page. Material changes will be notified by email to subscribers and via a notice on the site.

Contact

OVESSI is operated by Wiseman FO. For privacy-related questions or to exercise your rights, write to hello@ovessi.com.

With care. OVESSI