Effective July 14, 2026
Burnish & Bloom ("we," "us," "our") operates burnishandbloom.com (the "Site"). This Privacy Policy describes the information we collect from visitors and customers, how we use and share it, and the rights you have over it. By using the Site you accept the practices described here.
Information we collect
Information you give us
- Contact information. When you email us or fill out our newsletter signup, we receive your name (if provided) and email address.
- Order information. If you place an order, we (and our payment processor) collect the items ordered, shipping and billing addresses, phone number, and payment details. We do not store full payment card numbers on our servers. Those are handled by our payment processor.
- Correspondence. Messages you send to hello@burnishandbloom.com or via our social channels.
- Product-safety reports. If you report a reaction or safety concern, we may collect product and lot information, a description of the event, relevant photos, contact details, and information about medical care that you choose to provide.
Information collected automatically
- Technical data. Browser type, device type, IP address, pages visited, and the page that referred you to us. Standard server log information.
- Cookies and browser storage. The Site uses necessary browser storage to remember your shopping bag and privacy choice. When a campaign link contains attribution parameters (such as UTM tags or an advertising click ID), we retain those details for the current browsing session and attach them to an order so we can understand which campaigns produce sales.
- Optional Google Analytics. If you select “Allow analytics,” Google Analytics 4 measures visits, referring campaigns, pages viewed, product interactions, checkout activity, and completed purchase totals. Google may set cookies such as
_ga and _ga_* to distinguish browsers. We do not send payment-card details or customer contact information to Google Analytics, and advertising storage remains disabled. If you select “Only necessary,” the Google Analytics tag is not loaded.
How we use information
- To fulfill orders and provide customer service.
- To send transactional emails (order confirmations, shipping notices, return communications).
- To send newsletter and promotional emails, only to people who have opted in. You can unsubscribe at any time using the link at the bottom of any marketing email.
- To prevent fraud and protect the Site and its users.
- To improve our products and the Site experience.
- To comply with legal obligations.
- To investigate product complaints, maintain required safety records, and report serious adverse events to the FDA when required by law.
Who we share with
We do not sell, rent, or trade your personal information. We share it only with the service providers we need to operate the business:
- Hosting and infrastructure. Our website is hosted by Vercel, which receives standard server-log information when you visit.
- Analytics. When you allow analytics, Google processes website usage and ecommerce event data on our behalf to provide Google Analytics reports.
- Payment processing. When you place an order, payment details are handled by our payment processor (subject to their own privacy practices).
- Shipping carriers. Your shipping address is shared with the carrier handling your delivery.
- Email service. If you opt in to the newsletter, your email is stored by our email service provider for the purpose of sending those emails.
- Legal compliance. If required by law, court order, or to protect rights and safety.
- Cosmetic safety reporting. We may share information in a product-safety report with the FDA, medical professionals, insurers, laboratories, or service providers when reasonably necessary to investigate the report or comply with law.
We require these service providers to handle your information consistent with this policy.
Your rights and choices
- Access. You can request a copy of the personal information we hold about you.
- Correction. You can ask us to correct inaccurate information.
- Deletion. You can ask us to delete your personal information, subject to our legal obligations to retain certain records (e.g., for tax purposes).
- Opt out of marketing. Unsubscribe links appear at the bottom of every marketing email. Transactional emails (order confirmations, etc.) cannot be opted out of separately.
- Analytics choice. You can allow, decline, or change optional analytics at any time using the “Privacy choices” control in the Site footer.
- California residents (CCPA / CPRA). California residents have additional rights, including the right to know what categories of personal information we have collected, the right to deletion, and the right to opt out of any "sale" or "sharing" of personal information. We do not sell personal information. To exercise California rights, email us at the address below.
To exercise any of these rights, email hello@burnishandbloom.com. We may need to verify your identity before fulfilling certain requests.
Data retention
We retain personal information only as long as needed to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Order records are typically retained for at least seven years for tax and accounting purposes. Newsletter subscriber information is retained until you unsubscribe.
Security
We use reasonable administrative, technical, and physical safeguards to protect your information. The Site is served over HTTPS with HSTS enabled. No method of transmission over the internet is 100% secure, however, and we cannot guarantee absolute security.
Children
The Site and our products are not intended for children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided personal information, email us and we'll delete it.
International users
Burnish & Bloom is based in the United States. The Site currently ships only within the US. If you visit from outside the US, you are doing so subject to US law, and any data we collect will be processed in the US.
Third-party links
The Site may link to third-party websites (Instagram, Facebook, etc.). This policy does not apply to those sites. Review their privacy practices separately.
Changes to this policy
We may update this Privacy Policy from time to time. The "Effective" date at the top reflects the most recent update. Material changes will be announced on the Site or via email to active customers.
Contact
Questions about this policy or about our privacy practices: hello@burnishandbloom.com.