Privacy policy

Nina with Love (“we”, “us”, “our”) is a small-batch skincare workshop based in Cyprus, operating the website ninawithlove.cy. We are the data controller for personal data collected through this site.

Questions about this policy or your data can be sent to hello@ninawithlove.cy.

• Account & order data: name, email, shipping address, phone (if provided), order history.
• Skin profile data: answers you give to our quiz so we can formulate for you (skin type, concerns, sensitivities, lifestyle notes).
• Payment data: processed directly by Stripe. We never see or store your full card details.
• Communications: messages you send us, gift-message text, support correspondence.
• Technical data: IP address, browser, device, pages viewed, basic analytics.

• Contract: to take and fulfil your order, formulate your product, ship it, and provide customer support.
• Legal obligation: tax, accounting and consumer-protection records.
• Legitimate interest: securing the site, preventing fraud, improving our products.
• Consent: marketing emails, non-essential cookies. You can withdraw consent at any time.

We only share what is necessary, with processors bound to confidentiality:

• Payment processing: Stripe
• Hosting & database: Lovable Cloud / Supabase (EU region)
• Shipping carriers (for the address on your order)
• Email delivery (transactional and, if you opt in, marketing)

We do not sell your personal data. We do not transfer data outside the EEA unless covered by Standard Contractual Clauses or an adequacy decision.

• Order records: 7 years (Cyprus tax requirements).
• Account & skin profile: until you delete your account.
• Marketing list: until you unsubscribe.
• Analytics: up to 26 months in aggregated form.

Under the GDPR you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your data (“right to be forgotten”)
• Restrict or object to processing
• Request your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with the Cyprus Commissioner for Personal Data Protection

To exercise any of these rights, email hello@ninawithlove.cy. We respond within 30 days.

We use TLS encryption in transit, encrypted storage at rest, scoped access controls, and audit logging. No system is perfectly secure — if a breach occurs, we will notify affected users and the supervisory authority within 72 hours where required.

Our products and site are intended for adults. We do not knowingly collect data from anyone under 16.

We may update this policy. Material changes will be announced on this page; the “last updated” date above always reflects the current version.