Privacy Policy

This page describes what information Naterra collects when you use this website, why, and who it's shared with. It reflects how the site actually works today.

Information we collect

When you create an account or sign in, we collect your name, email address, and (optionally) phone number. When you place an order, we collect the shipping details you provide — name, phone, address, and any delivery instructions — and your email if you give one. Your cart is tracked with a cookie so it persists between visits, whether or not you're signed in. If you subscribe to our newsletter or submit the contact form, we collect the email (and, for contact submissions, name and message) you provide.

We do not collect payment card details — Cash on Delivery orders are paid in person to the courier, not through this website.

Store analytics

We record how the store is used — pages and products viewed, cart changes, checkout steps, searches, the site or campaign link you came from, which version of a page you saw when we're testing a change, and your device type, browser and country — against random identifiers kept in our own cookies (see the Cookie Policy). It's on by default for every visitor, and you can turn it off at any time under “Cookie settings” at the bottom of every page; a Global Privacy Control signal from your browser turns it off too. We don't store your IP address, don't try to work out who an anonymous visitor is, and keep this record in our own database.

Google Analytics

We also use Google Analytics, a service run by Google, to see how visitors find and use the store. It uses its own cookies (see the Cookie Policy) and sends Google the pages you view, how long you stay, the site or campaign link you came from, and your device, browser and approximate location. Google reads your IP address to work out that location and says it doesn't log or store it. This data may be processed outside your country, including in the United States. We don't use it for advertising. It never receives what you type on the checkout form, and it stays off your account, order confirmation, review and unsubscribe pages, because their addresses can identify you or your order. When you place an order, our server tells Google Analytics its value, delivery fee and products, with an internal reference for the order, so we can see which pages and links lead to sales. That doesn't include your name, contact details, address or order number. If you're visiting from the European Union, the EEA, the UK or Switzerland, it only runs if you choose “Accept” under “Cookie settings”. Everywhere else it runs by default, and you can turn it off at any time under “Cookie settings”. A Global Privacy Control signal turns it off too. See how Google uses information from sites that use its services.

Meta ads (Instagram and Facebook)

We advertise on Instagram and Facebook. To measure those ads and show them to people likely to be interested, including people who have visited the store, Meta's script (its “pixel”) runs on our pages, and Meta is told, by the script and by our server, when you view a page or product, add to your cart, start checkout, press a WhatsApp link or place an order. That includes the page address, the product, an order's value and products with an internal reference, the random browser identifiers in Meta's cookies and a scrambled version of ours, which ad you clicked if you came from one, your IP address, browser details and country. Because the script runs in your browser, Meta can link this to your Instagram or Facebook account if you're signed in to it there. It never includes your name, contact details, address, what you type into a form or your order number: the script stays off the checkout and contact pages, and both leave out your account, order confirmation, review and unsubscribe pages. This data may be processed outside your country, including in the United States, and Meta may use it to improve its ads. If you're visiting from the European Union, the EEA, the UK or Switzerland, it only happens if you choose “Accept” under “Cookie settings”. Everywhere else it happens by default, and you can turn it off at any time under “Cookie settings”. A Global Privacy Control signal turns it off too. See Meta's Privacy Policy.

Checkout details you enter

The name, email and phone number you enter on the checkout form are saved as soon as you enter them — even if you don't place the order — so we can see unfinished checkouts and contact you about your order if needed. The checkout page says so next to those fields. This applies to every visitor, whatever your cookie choice. Only store administrators can see these details, they're removed from this record once you complete the order (the order itself keeps what's needed to deliver it), and we never use them for marketing without your separate consent. They're deleted automatically after 90 days, and you can ask us to delete them sooner through the contact page.

How we use it

Order and account data is used to fulfil and track your orders, manage your account, and respond to support requests. Email addresses are used to send order confirmations and status updates, and — only if you've subscribed — occasional product updates. We don't sell your data to third parties. Its only advertising use is telling Meta about visits and orders, as described above.

Third parties

A small number of service providers process data on our behalf, strictly to run the store: Clerk handles account authentication, Supabase hosts our database, Resend delivers transactional emails (order confirmations, status updates, contact-form notifications), Google Analytics measures how the store is used, and Meta measures our ads, both as described above. Each only receives the data needed to perform its function.

Your rights

You can request a copy of the data we hold about you, or ask us to delete your account and associated data, by reaching out via the contact page. Order records tied to a completed purchase may be retained as needed for accounting and legal purposes even after an account deletion request.

This policy describes our actual data practices but has not been reviewed by a lawyer — if you need this to satisfy a specific legal or regulatory requirement, have it reviewed before relying on it.