Legal

Privacy policy

Last updated: January 8, 2026

What we collect

Account details: name, email and a securely hashed password.
Order details: shipping address, items purchased, totals and order status — some of this (your name, address and order contents) is shared with our fulfilment partner so they can ship your order; see Who we share data with.
Usage data: pages viewed, products viewed and cart activity.
Marketing preferences you opt into.

Cookies & consent

We use three categories of cookies. A cookie consent banner lets you choose which non-essential categories to allow, and you can change your choice at any time by clearing site data or using the consent settings in the banner.

Essential — required for the cart, checkout, and account sign-in to work. These can't be turned off.
Analytics — Google Analytics 4 (GA4), used to understand which pages and products perform well. Only loads if you accept analytics cookies.
Advertising — Google Ads, including hashed-email enhanced conversions, used to measure and improve ad performance. Only loads if you accept advertising cookies. We hash your email before it's sent to Google — we never send it in plain text.

Who we share data with

Stripe — processes your payment. We never see or store your full card number.
CJ Dropshipping — our fulfilment partner. They receive your name, shipping address and order contents so they can pack and ship your order.
Resend — sends transactional email (order confirmations, shipping updates) and, if you opt in, marketing email.
Google (GA4 / Google Ads) — receives usage and, where you've consented to advertising cookies, a hashed version of your email for conversion measurement.

We do not sell personal data.

Retention

We keep order records for as long as required for tax, accounting and fraud-prevention purposes. Account, address and marketing records are kept until you ask us to delete them. Analytics and advertising cookie data follow the retention windows set by Google.

Your rights

You can access, correct, export, or delete your data, and withdraw marketing or cookie consent at any time. To exercise any of these, email support@midnighthallowstore.com, or use the consent banner controls to change your cookie choices. Deletion removes your account, saved addresses, wishlist and marketing records; order records are retained where required for tax purposes, as described above.

Security

Data is stored with row-level access control so shoppers can only read their own records. Payment details are handled entirely by Stripe and never stored on our servers.