Privacy Notice | Yeelite Beauty

Who we are

Yeelite Beauty is run by Yeelite Inc., a company based in Ottawa, Ontario, Canada. We are responsible for the personal information described here. Henry Chen, CTO, is accountable for privacy at Yeelite Inc. To ask about your information, email beauty@yeelite.com.

What we collect

Your account: your name, email address and password. We store a scrambled (hashed) form of your password, not the password itself. An account is optional; you can check out as a guest.
Your orders: your name, email address, shipping address, optional phone number, and what you bought and paid. If you save an address, we keep it on your account.
Payments: you enter your payment details directly into Stripe’s secure form, and Stripe handles them. Your full card number, security code and full bank account number never reach or get stored on our servers. We keep a reference to the payment, its status and amount, and the limited details Stripe reports back to us, which can include the card type, last 4 digits, expiry date and billing details.
Messages from you: contact forms, support tickets, return requests, Sell with us enquiries and product reviews, including whatever you choose to write in them.
Technical information: your IP address and browser details, kept with your signed-in session and with account and admin activity logs, and used briefly to limit abuse such as repeated sign-in attempts.

Why we use it

To take, ship and support your orders, including returns and warranty claims.
To run your account and keep it secure.
To send emails about your orders, account and support tickets.
To answer your questions and publish reviews you submit.
To keep the records that tax and accounting rules require, and to prevent fraud and abuse.

We do not sell your personal information. The site does not use advertising or analytics trackers. In the future, we may send marketing email to people who opt in. You can opt out at any time by emailing beauty@yeelite.com or using the unsubscribe link in the email.

How password checks work

When you choose a password, your browser checks it against known data breaches using Have I Been Pwned’s Pwned Passwords service. This check is based on guidance from NIST’s digital identity guidelines (SP 800-63B), although our password rules do not meet every NIST requirement.

Your browser creates a hash of your password and sends only the first 5 characters of that hash to the service. Your password and its full hash are not sent, and the comparison happens on your device. The service receives your IP address, as with any web request. See the Conditions of Use for what it means to use a password we warn you about.

Third parties we work with

Running an online store means relying on a few other companies:

Stripe handles our payments. It collects your payment information directly in order to process your payment, and your full card and bank account numbers never reach our servers. We give Stripe only what it needs for the payment: the amount, an order reference and your email address for the receipt. See Stripe’s privacy policy for more information.
Resend and Namecheap deliver our email. We do not actively share your information with them, but because email passes through these services, its contents are governed by their privacy policies. See the Resend and Namecheap privacy policies for more information.
Canada Post receives basic information, such as your name, address and order details, so that your delivery can be made. See Canada Post’s privacy centre for more information.
Cloudflare helps us protect our site against bad actors, including with its Turnstile check on our forms, which uses your IP address and browser details. See Cloudflare’s privacy policy for more information.
Have I Been Pwned receives a hashed segment of a potential password, as described above. See its privacy policy for more information.
Google, if you choose to continue with Google: Google gives us your name, email address and profile picture, and knows you signed in to our site.

We may also disclose information when the law requires it.

Cookies

We use only the cookies the site needs to work: one that remembers your shipping country, one for your cart, one that keeps you signed in, and a short-lived one that carries your email address between the sign-in steps. Cloudflare Turnstile may use its own to do its check. Your browser may also briefly store what you typed into a form, so it isn’t lost if there’s an error.

Where it’s kept, and for how long

Site and account information is hosted on our own secure servers within Canada. We value data sovereignty, and keeping your information in Canada wherever we can. The third parties above run their own services, which may process information outside Canada, including in the United States, under the laws that apply there.

We keep orders and related records for at least six years from the end of the tax year they relate to, as the Canada Revenue Agency requires. We may securely keep them, and your account information, for longer at our discretion where we still need them for legal, tax, warranty or other business reasons. You can request the deletion of your specific information at any time by contacting beauty@yeelite.com. Some records, such as invoices, must be kept by law.

Your choices and rights

You can ask to see the personal information we hold about you, correct it, or ask us to delete it, by emailing beauty@yeelite.com. You can update saved details from your account. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Changes to this notice

If we change this notice, we will update this page and its effective date.