Privacy Policy

Who we are

Luxe Society Candy Co. ("we", "us", "our") operates luxecandyco.com from Arizona, USA. We make hand-stacked candy sticks and, at the moment, a pre-launch signup list. We are the controller of the personal information described below. For any privacy question, write to [email protected].

This policy covers the pre-launch site only. When our shop opens we will publish an expanded policy covering orders, payments, and shipping, and we will tell Society members before it takes effect.

What we collect

We collect only what the signup form asks for, plus a small amount of technical data that keeps the form from being abused.

• Email address. Required. It is how we tell you when the sticks go live.
• First name. Optional. Used to greet you like a person instead of a row in a database.
• Mobile number. Optional, and only if you tick the box asking for launch and drop texts.
• Signup source and referring page. Which page or campaign you joined from, so we know what is working.
• A salted, hashed IP address. A one-way scrambled version of your IP address, plus a timestamp, used purely for spam and abuse prevention. We keep the hash rather than the raw address so we can rate-limit bots without holding a plain identifier.

We do not ask for your postal address, date of birth, or payment details, and there is nowhere on this site to enter them. If you email us directly, we hold whatever you choose to put in that message.

Why we use it

Your email and mobile number are used to send launch news, member early-access windows, and limited drop announcements. Nothing else. Signup source and technical data are used for spam prevention, security, and simple counts of how many people joined from where.

Where UK or EU data protection law applies, our lawful basis is your consent for marketing messages, which you may withdraw at any time, and our legitimate interest in protecting the site from automated abuse for the technical data. Withdrawing consent does not affect anything we sent before you withdrew it.

Where your data lives

The Society list is stored in a database on a server we control and administer ourselves, located in the United States. It does not live in a third-party marketing platform, a CRM, or a shared spreadsheet with an optimistic filename.

Email is delivered through our email provider, and texts through our SMS provider. Each processes your address or number only to hand our message to you, under contract, and neither may use it for its own purposes.

We never sell your information

We have never sold, rented, traded, or otherwise shared personal information for money or anything else of value, and we do not intend to start. No affiliate pixels, no data co-ops, no list swaps. The only parties who touch your data are the delivery providers above and our hosting provider.

We may disclose information if we are legally required to, for example by a valid subpoena or court order, or where necessary to protect our rights or someone's safety. If that ever happens and we are permitted to tell you, we will.

Text message program terms

By providing your mobile number and ticking the SMS consent box, you agree to receive automated marketing texts from Luxe Society Candy Co. at that number. Consent is not a condition of joining the Society or of any purchase.

• Message frequency varies. Expect a few messages per month, more in launch or drop weeks.
• Message and data rates may apply, depending on your mobile plan.
• Reply STOP to any message to cancel. Reply HELP for help, or email [email protected].
• Carriers are not liable for delayed or undelivered messages.

How long we keep it

We keep your details until you unsubscribe or ask us to delete them, and for up to 30 days afterward while the removal propagates through our sending systems and backups. After that the record is purged.

If the launch never happens and we wind the project down, we will delete the entire list within 90 days and tell you before we do. We keep a minimal suppression record of unsubscribed addresses in hashed form, indefinitely, purely so we never accidentally message you again.

How we protect it

The site is served only over HTTPS with modern TLS. The database sits behind a firewall on a private network with no public interface, access is limited to named administrators using key-based authentication and two-factor login, and backups are encrypted at rest. Submissions are rate-limited and screened by a hidden honeypot field.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your information we will notify you and any relevant regulator without undue delay.

Cookies and tracking

This site sets no advertising cookies and no third-party tracking cookies. There is no Meta pixel, no Google Analytics, no TikTok tag, no session recorder, and no cross-site profiling of any kind. Candy first, surveillance never.

Our server keeps standard web logs for a short period for security and diagnostics, and that is the extent of it.

Your rights

Wherever you live, we will honor these requests:

• Access. A copy of everything we hold about you.
• Correction. Fix an address, number, or name that is wrong.
• Deletion. Remove you and your record entirely.
• Withdraw consent. Stop email, texts, or both, at any time.
• Portability. Your data sent back to you in a machine-readable file.

To exercise any of them, email [email protected] from the address on the list, or tell us which address the request concerns. We reply within 2 business days and complete verified requests within 30 days, free of charge. You can also simply click unsubscribe in any email or reply STOP to any text.

Children

This site is not directed to children, and we do not knowingly collect personal information from anyone under 13. Our terms require list members to be at least 16. If you believe a child has given us their details, write to [email protected] and we will delete the record promptly.

California residents

Under the California Consumer Privacy Act as amended, you have the right to know what personal information we collect and why, to request deletion or correction, and to be free from discrimination for exercising those rights. The categories we collect are identifiers, namely email address, optional first name, optional mobile number, and a salted hashed IP address, plus internet activity in the form of your signup source and referring page. We collect them directly from you when you submit the form.

We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA, and we have not done so in the preceding 12 months. Submit any California request to [email protected]. Authorized agents may act on your behalf with written permission we can verify.

EU and UK residents

Joining the list means your information is transferred to and stored in the United States, which may have data protection rules that differ from those where you live. Where required, we rely on the European Commission's standard contractual clauses and the UK addendum with our processors to protect those transfers.

Under the GDPR and UK GDPR you hold the rights listed above, plus the right to object to processing and to lodge a complaint with your supervisory authority. In the UK that is the Information Commissioner's Office; in the EU it is the authority where you live or work. We would rather you told us first so we can put it right, but you are not obliged to.

Changes to this policy

If we change anything material, for example a new provider, a new category of data, or a new purpose, we will update the date at the top of this page and email everyone on the list before the change takes effect. Minor edits for clarity will be reflected in the date alone. We will not quietly broaden what we do with your information and hope nobody reads the diff.

Contact

Questions, requests, or complaints about this policy go to [email protected]. Postal correspondence can be requested at the same address and we will provide a mailing address in reply.