privacy@breauti.com must be created and tested, and Breauti must publish a physical business address where required. Before Stripe or another production service is activated, Breauti must document the exact products, data flows, cookies, retention, vendors, processor terms, international-transfer safeguards, and applicable U.S., EEA, and UK notices. Do not send identity documents until the inbox is confirmed active.
Controller and scope
Breauti LLC, a Mississippi limited liability company, is the controller for personal data it determines how and why to process through this site. This policy applies to Breauti's public fashion pages, Product Plan, policy pages, and browser-based style customizer.
The current site does not provide an account, public contact form, checkout, payment form, interest signup, product order, email signup, or connected payment service. Breauti has not appointed a Data Protection Officer because the current limited processing does not appear to require one. Breauti has not yet designated an EU or UK representative and will assess that requirement before targeting those markets.
Privacy requests should be sent to privacy@breauti.com once that inbox is active. The Contact page records the status of the official request channel. A tested email address and, where legally required, a business mailing address must be published before this policy is treated as launch-ready for active EEA or UK commerce.
Data, purposes, and legal bases
The table reflects the current site. A legal basis applies only when the GDPR applies to the processing.
| Data category | Purpose | GDPR legal basis | Retention approach |
|---|---|---|---|
| Site delivery and security data | IP address, browser/device details, requested URL, referrer, timestamps, and diagnostic or security events may be processed to deliver, secure, and troubleshoot the site. | Legitimate interests in providing a reliable, secure site (Art. 6(1)(f)). | Kept only for the hosting provider's reasonable operational and security period, then deleted or anonymized unless law requires more. |
| Communications | If you later use a verified channel, Breauti may receive your name, contact details, message, and attachments to answer you and maintain necessary records. | Legitimate interests (Art. 6(1)(f)) or steps requested before a contract (Art. 6(1)(b)). | While the request is open and for a reasonable record period afterward, subject to legal obligations and disputes. |
| Customizer choices | Colors, materials, trim, chains, stones, laces, and a saved look may be stored in your browser so the customizer functions on that device. | Not transmitted to Breauti by the current site; no Breauti server-side processing or retention. | Until you reset the customizer, clear site data, or your browser removes it. |
| Future checkout and order data — not active | If checkout opens, Breauti expects to receive customer and recipient names, email, billing and shipping addresses, selected item, price, currency, tax and shipping amounts, order, delivery, cancellation, return and refund status, Stripe transaction identifiers, and limited payment details such as card brand and last four digits when Stripe makes them available. Breauti does not plan to receive full card numbers or security codes. | Contract or requested pre-contract steps (Art. 6(1)(b)); legal obligations for tax, accounting, consumer protection, and fraud records (Art. 6(1)(c)); and legitimate interests in security, fraud prevention, support, and legal claims (Art. 6(1)(f)). | Order, tax, refund, fraud, and dispute records will follow a documented production schedule based on legal, accounting, chargeback, warranty, and claims periods; unnecessary data will be deleted or de-identified. |
| Consent-based technology | Non-essential analytics, advertising, and marketing email are not active. | If added, consent will be requested where required (Art. 6(1)(a)) and this policy will be updated first. | Not applicable on the current site. |
You are not required to provide personal data to browse the current public site. Some technical request data is necessary for a hosting provider to deliver and secure any website.
Local storage, cookies, and shared links
The current site does not intentionally set non-essential advertising cookies or use third-party marketing analytics or advertising pixels. The customizer uses browser local storage for functional configuration choices. That data stays on your device unless another feature explicitly transmits it.
You can remove local data with the site's reset controls or your browser's site-data settings. A shared customizer URL may include style choices in its query string. If you copy or share that URL, you choose to disclose those configuration choices to its recipient and to any service used to share it.
If Stripe Checkout is activated, Stripe may use cookies and browser, device, network, and interaction data that are necessary to provide checkout, authenticate a payment, and prevent fraud. The production cookie notice will identify the actual Stripe configuration. Breauti will not activate optional advertising, cross-site measurement, or marketing technology without the notice and consent controls required in the relevant market.
Breauti does not currently sell personal data or share it for cross-context behavioral advertising. Do Not Track and Global Privacy Control signals do not change the current site because the tracking activities those signals address are not active.
Recipients and international transfers
Technical request data may be available to hosting, network, and security providers acting for Breauti. Information may also be disclosed to professional advisers, insurers, courts, regulators, or authorities when reasonably necessary to protect rights, comply with law, or resolve a dispute. Breauti does not disclose data to payment processors, email marketing platforms, or advertising networks through the current site because those services are not connected.
Breauti plans to host the public site through Cloudflare, connect selected features to a Firebase backend, and use Stripe for eligible payments. A completed order may also require disclosure to shipping carriers, tax or accounting providers, fraud-prevention services, banks, card networks, enabled payment-method providers, and professional advisers.
Stripe may act as Breauti's processor for some merchant-directed processing and as an independent controller for certain payment, security, compliance, and service-improvement purposes described in Stripe's own privacy materials. Before activation, Breauti will document the exact products and settings, enter or confirm applicable data-processing terms, configure retention and access controls, and update this policy with the resulting data categories and purposes. Firebase Authentication, Analytics, Crashlytics, Performance Monitoring, Cloud Functions, and other Firebase products will not be treated as enabled unless the production configuration actually uses them.
Breauti is U.S.-based, so information received by Breauti or its providers may be processed in the United States or another country with different data-protection laws. When GDPR-restricted data is transferred outside the EEA, Breauti will use an available legal mechanism—such as an adequacy decision, Standard Contractual Clauses, or another permitted safeguard—and assess supplementary protections where required. Provider-specific transfer details will be published before new data services are activated.
Your privacy rights
EEA and UK rights
When the GDPR applies, you may have the following rights. They are not absolute; the applicable right can depend on the data, legal basis, and any legal exemption.
- AccessObtain confirmation and a copy of your personal data.
- CorrectionCorrect inaccurate or incomplete personal data.
- ErasureAsk for deletion where the legal conditions are met.
- RestrictionLimit certain processing while an issue is resolved.
- PortabilityReceive eligible data in a structured, commonly used format.
- ObjectObject to processing based on legitimate interests or direct marketing.
- Withdraw consentWithdraw consent at any time without affecting earlier lawful processing.
- Human reviewChallenge qualifying solely automated decisions with legal or similarly significant effects.
Once a verified request channel is active, Breauti will respond without undue delay and generally within one month. Breauti may request proportionate information to verify identity. If Breauti denies a request, it will explain why and identify available complaint or judicial-remedy options.
You may complain to the data-protection authority where you live, work, or believe an infringement occurred. The European Data Protection Board lists national supervisory authorities.
United States state privacy rights
Where an applicable U.S. state privacy law covers Breauti and the processing, a resident may have rights to know or access personal data, correct inaccuracies, delete eligible data, obtain a portable copy, opt out of a sale or qualifying sharing, targeted advertising, or certain profiling, appeal a denied request, and receive equal service without unlawful discrimination for exercising a right. An authorized agent may submit a request where the law permits and the required authorization can be verified.
Breauti does not currently sell personal data, share it for cross-context behavioral advertising, or use it for targeted advertising or significant-effects profiling. If a covered practice is introduced, Breauti will provide the required notice at or before collection, an applicable opt-out method, and recognition of legally required preference signals such as Global Privacy Control. California residents will receive a notice at collection before checkout or another materially new collection begins.
Requests will be handled under the response periods and verification rules of the law that applies. Breauti may retain information needed to document the request, prevent fraud, comply with law, or establish or defend legal claims.
Retention and security
Breauti uses retention criteria tied to purpose: browser-local choices remain until you or the browser remove them; hosting and security logs remain only for a reasonable operational or security period; and communications remain while a request is active plus a reasonable record period. Longer retention may apply when necessary for law, a dispute, fraud prevention, or enforcement.
If payments open, Breauti will maintain a written retention schedule for order, tax, accounting, delivery, cancellation, return, refund, fraud, chargeback, warranty, and customer-support records. Full payment-card numbers and security codes will remain with Stripe and the payment network rather than Breauti's application. Access to production order data will be limited by role and reviewed periodically.
Breauti will use reasonable administrative and technical safeguards appropriate to the limited data it handles and will require relevant providers to protect data under their control. No online transmission or storage system is completely secure. Browser-local data is also subject to the security, synchronization, and backup settings of your device and browser.
Other disclosures
Automated decision-making
The current site does not use automated decision-making or profiling that produces legal or similarly significant effects.
Children
The site is not directed to children, and Breauti does not knowingly request personal data from children through the current site. Before adding an account, marketing, or sales experience directed to minors, Breauti will add age-appropriate information and any consent process required by applicable law.
Payments
Payments are not connected, and Breauti does not receive payment-card information through this site. Breauti plans to use hosted Stripe Checkout only after the exact payment model is approved and the production disclosures are complete. The checkout will identify Breauti as the seller, link this policy and the applicable transaction policies, and explain the transaction information Breauti receives. Never send full card or bank credentials through email or an unverified form.
Changes to this policy
Breauti will update this policy before activating materially different data practices, including accounts, payments, email marketing, analytics, or advertising. Material changes will receive a new effective date and, when appropriate, a prominent notice. Prior versions will be retained where reasonably practical.