Privacy Policy

Last updated 6 October 2026

This explains what personal information we collect when you use this website or buy from us, why we need it, who else sees it, and what you can do about it.

Who we are

Mirah (“we”, “us”) sells the Mirah Modest and Adorned By Mirah collections through this website. We are the controller of the personal information described here, which means we decide how and why it is used.

To contact us about your data, email support@adornedbymirah.com.

What we collect

• Your account. Your name, email address and phone number, and a password. We never store your password itself, only a one-way scrambled version of it that cannot be turned back into the original. If you sign in with Google, we receive your name and email address from Google.
• Your orders. What you bought, the delivery address you gave us, your phone number and email, the delivery method, any discount code used, and the order's status and tracking number. We also keep the date and total of the order.
• Your payment. You pay through Stripe. Your card number never reaches our website or our database. We receive a confirmation that the payment succeeded, plus the card brand and last four digits so you can recognise it on your order.
• Addresses and wishlist. If you create an account, the addresses and saved items you choose to keep there.
• Messages and reviews. Anything you send us through the contact form, return requests, and reviews you write.
• Basic visit counts. We log which page was viewed, whether it was on a phone, tablet or computer, and when. We do not record your IP address, your location, or anything that identifies you in this log.
• Abuse prevention. To stop automated attacks (for example, someone trying thousands of passwords), we briefly keep a scrambled form of the IP address and email involved in sign-in, sign-up, contact and payment attempts. These records expire within a day and cannot be turned back into the original address.
• Server logs. Our hosting provider keeps standard technical logs of requests to the website, which include IP addresses, for a short period to keep the service running and secure.

Why we use it, and our legal basis

We do not currently send marketing emails. If that changes we will ask for your permission first, and every message will have a way to stop receiving it. We do not sell your information, and we do not use it for automated decisions about you.

Who else sees your information

We use a small number of other companies to run the shop. Each only receives what it needs for its job:

• Stripe takes card payments and helps detect fraud.
• Vercel hosts the website, and Supabase hosts the database it uses.
• Resend sends the emails we send you, such as order confirmations and password resets.
• Easyship and the courier that delivers your parcel (usually Royal Mail) receive your name, delivery address, phone number and email so the parcel can reach you.
• Telegram carries a short alert to the people who run the shop when an order or message arrives. It includes the customer's name, postcode and what they ordered.
• Google, only if you choose to sign in with Google.
• OpenStreetMap provides the address suggestions that appear as you type a delivery address. The text you type into that box is sent to their service, from our server rather than your device.

We may also have to share information with the authorities where the law requires it. Some of these companies handle data outside the UK. When they do, it is under safeguards the UK recognises, such as approved contract terms.

How long we keep it

• Order records: for six years from the end of the financial year of the sale, because tax and accounting rules require it.
• Your account: until you ask us to delete it. Deleting your account does not remove order records we must keep.
• Messages and returns: for as long as we need to deal with them and anything that follows.
• Password-reset links expire after one hour, and the scrambled abuse-prevention records described above expire within a day.

Your rights

You can ask us to:

• tell you what information we hold about you and give you a copy;
• correct anything that is wrong or out of date;
• delete your information, where we do not have to keep it;
• restrict or stop how we use it, or object to a particular use; and
• give you your information in a portable format.

Email support@adornedbymirah.com and we will reply within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, although we would like the chance to put things right first.

Cookies

We use only the cookies the site needs to work: one that keeps you signed in, and two that protect sign-in forms from forgery. We do not use advertising or analytics cookies, so there is no cookie banner to dismiss. When you pay, Stripe may set its own cookies to detect fraud. Those are governed by Stripe's own policy.

Changes to this policy

If we change how we use your information we will update this page and the date at the top. If the change is significant, we will tell you by email.