What we collect, and why.

The business named on our Ownership page is the controller of the personal data described here, and the seller in every order placed through this store. Its registered name and address are on that page; data requests can be sent to the email below.

This is what the store handles today:

• Account details — your name, email address, and a hashed password. Passwords are never stored in readable form.
• Order details— the items you bought, the amount charged, your shipping address, and the order’s status and tracking number.
• Payment details— handled by our payment providers. Card numbers never reach our servers; we keep only the provider’s reference to the payment and whether it succeeded.
• Marketing — your email address, if you subscribe to the newsletter.
• Technical data — a session cookie that keeps you signed in, and server logs containing IP addresses, used to rate-limit abuse and diagnose faults.
• Usage data— through Google Analytics, which pages are visited, the type of device and browser, the approximate location (city or country), how the visitor arrived, and shop events: adding to cart, starting checkout, and an order’s number, items and value. Your name, email, phone and address are never sent to it.

• To take payment, fulfil your order, and email you a confirmation.
• To let you sign in and see your order history, wishlist, and saved addresses.
• To answer support requests.
• To protect the store from fraud and automated abuse.
• To send marketing email — only if you asked for it, and you can stop at any time.

We ship within Pakistan only, so Pakistani law governs this policy. We handle your data because it is necessary to perform the contract of sale, to meet a legal obligation such as tax record-keeping, or — for the newsletter alone — because you asked us to. You can withdraw that consent at any time without affecting anything else.

We do not sell personal data. We share only what a provider needs to do its job, and only with these categories of processor:

• Safepay(Pakistan) — takes and confirms card and wallet payments. Card numbers are entered on Safepay’s own page and never reach our servers.
• Resend — sends your order confirmation and any newsletter, and so receives your email address and the contents of that message.
• Vercel and Neon — host the site and store the database described above.
• Our courier — receives your name, address and phone number, because a parcel cannot be delivered without them.
• Google (Google Analytics) — receives the usage data described above, so we can see which pages and products people find useful.

The providers below are the only ones that receive any of it.

Order and payment records are kept for as long as tax and accounting law requires. Account data is kept until you ask us to delete the account. Newsletter subscriptions are kept until you unsubscribe.

Server logs containing IP addresses are short-lived, and used only to rate-limit abuse and diagnose faults. If you ask us to delete your account we will, except for the order and payment records we are required to keep.

You can ask us for a copy of your data, ask us to correct or delete it, or object to how we use it. You can unsubscribe from marketing email from any newsletter we send.

To make a request, email us from the address on your account and we will answer within 30 days. We may ask you to confirm your identity first — otherwise anyone could ask for a copy of your data.

This store sets one essential cookie, which keeps you signed in. It is required for the account and checkout areas to work.

We also use Google Analytics, which sets its own cookies (named _ga) to count visits and tell a returning visitor from a new one. We use it only to understand how the shop is used; we run no advertising or retargeting scripts. You can block these cookies in your browser, or install Google’s Analytics opt-out add-on, and the shop works exactly the same.

If you arrive through a creator’s LUCORE link, a cookie (named lucore_ref) remembers their discount code for 30 days so it is applied at checkout for you. It holds only the code. We count how many people each link brings, as a daily total; nothing about you is recorded with it.

If this policy changes materially we will say so on this page and, where the change affects you, by email.

Privacy questions and data requests: support@lucoreskin.pk. See also our Terms of Sale and Returns & Refunds policy.