Privacy policy

Last updated: 30 June 2026

This Privacy Policy explains how Aethr Skin ("AETHR", "we", "us", "our") collects, uses, shares and protects your personal information when you visit our website or otherwise interact with us.

Our website is currently in a pre-launch phase. We are not yet accepting orders or registrations. This policy describes the limited data processing that takes place when you visit our website at this time.

AETHR operates this website and related services (the "Services"). Our website is hosted on Shopify's platform. Aethr Skin is a cosmetics company based in the United Kingdom. We are committed to handling your personal data fairly, lawfully and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use and disclosure of your information as described below.

Contents

1. Who we are
2. What personal data we collect
3. How and why we use your personal data
4. Cookies and similar technologies
5. Who we share your data with
6. Our relationship with Shopify
7. International transfers
8. How long we keep your data
9. Your rights
10. Marketing
11. Children
12. Security
13. Third-party links
14. Complaints
15. Changes to this policy
16. Contact

1. Who We Are

Aethr Skin is the "data controller" responsible for your personal data. This means we decide how and why your personal data is processed.

Our contact details for data protection matters are:

2. What Personal Data We Collect

During our pre-launch phase, our website is a holding page only. We do not collect names, email addresses, or any information you actively submit. The personal data we collect is limited to information gathered automatically when you visit our website.

2.1 Information we collect automatically

• Device information: IP address, device and browser type, operating system, and unique identifiers.
• Usage and browsing data: how you navigate and use our website, pages viewed, and time spent on page.
• Cookie and similar technology data: see section 4 for full details of the cookies set when you visit our website.

2.2 Information from other sources

Where you arrive at our website by clicking an advertisement on a third-party platform (such as Instagram or Google), that platform may share limited data about your click with us (for example, a click identifier) for the purposes of measuring the effectiveness of our advertising. This data is processed in accordance with the platform's own privacy policy and your settings on that platform.

3. How and Why We Use Your Personal Data

Under UK data protection law, we must have a lawful basis for each way we use your personal data. The table below sets out our processing purposes and the legal basis we rely on for each.

Purpose	Lawful Basis
Essential website functionality and security	Legitimate interests — ensuring our website loads, operates securely and is available to visitors.
Website analytics and performance monitoring	Legitimate interests (essential analytics) / Consent (non-essential analytics cookies, obtained via our cookie banner).
Advertising measurement and retargeting	Consent — obtained via our cookie consent banner. Marketing cookies are only set after you give consent.
Responding to data subject rights requests	Legal obligation — required by UK GDPR.
Legal, tax and accounting compliance	Legal obligation — required by applicable law.

Where we rely on legitimate interests, we have carried out a balancing assessment to ensure your rights and freedoms are not overridden. You can ask us for a copy of these assessments by contacting our DPO.

4. Cookies and Similar Technologies

Cookies are small text files placed on your device when you visit a website. Similar technologies include pixels, tags and local storage, which we refer to collectively as "cookies" in this section.

We only set non-essential cookies with your consent, which you give through our cookie consent banner. You can change your cookie preferences at any time.

4.1 Types of cookies

• Required (essential): These cookies are necessary for the site to function securely. They cannot be switched off and do not require consent under PECR Regulation 6.
• Analytics: These cookies help us understand how visitors use our website so we can measure and improve performance. We use Google Analytics 4. Set only with your consent.
• Marketing: These cookies are used to deliver relevant advertising and measure campaign effectiveness. They are set by Meta (Facebook/Instagram) and Google Ads through their respective tracking pixels and tags. Set only with your consent.

4.2 Cookies we use

Cookie	Category	Purpose	Duration
_shopify_essential	Required	Core site functionality: session management and security	Session
storefront_digest	Required	Verifies access to password-protected store	Indefinite
localization	Required	Remembers your country and currency selection	1 year
_ga	Analytics	Google Analytics 4: distinguishes unique visitors	2 years*
_ga_[container]	Analytics	Google Analytics 4: persists session state	2 years*
_gid	Analytics	Google Analytics 4: distinguishes users (short-term)	24 hours
_fbp	Marketing	Meta Pixel: identifies your browser for ad delivery and measurement	90 days
_fbc	Marketing	Meta Pixel: stores the Facebook click identifier when you arrive via a Facebook ad	90 days
_gcl_au	Marketing	Google Ads: links your visit to ad click data for conversion measurement	90 days
_gcl_aw	Marketing	Google Ads: stores click information for conversion tracking	90 days

* Browser policies (e.g. Safari ITP) may cap first-party cookie lifetimes at approximately 7–400 days. The durations shown are the values we configure; actual expiry may be shorter.

4.3 Third-party cookies

Some cookies are set by third parties that provide services on our website. These third parties may process your data in accordance with their own privacy policies. We only allow these cookies to be set after you have given consent.

Provider	Cookies	Purpose	Privacy Policy
Google Analytics	_ga, _ga_[id], _gid	Website analytics and performance measurement	Google Privacy Policy
Meta (Facebook / Instagram)	_fbp, _fbc	Ad delivery, retargeting and conversion measurement	Meta Privacy Policy
Google Ads	_gcl_au, _gcl_aw	Conversion tracking and remarketing	Google Privacy Policy

4.4 How we obtain cookie consent

When you first visit our website, our cookie consent banner allows you to accept all cookies, decline all non-essential cookies, or set your preferences by category. Non-essential cookies are not set until you give consent. We record your choices and re-seek consent when our cookie use changes.

4.5 How to manage or disable cookies

You can change your cookie preferences at any time via the cookie settings on our website. You can also control cookies through your browser settings. You can opt out of specific third-party cookies using:

• Google: Ad Settings and Google Analytics Opt-out Add-on
• Meta: Ad Preferences
• Industry-wide: Your Online Choices (European Digital Advertising Alliance)

5. Who We Share Your Data With

We share personal data only where necessary, with:

• Shopify — our website platform provider, which hosts our site and provides related infrastructure. Shopify acts as a processor on our behalf and, for certain enhanced features, as an independent controller (see section 6).
• Google Analytics — where you have consented to analytics cookies, your browsing data is shared with Google for website performance analysis. Google processes this data in the United States under appropriate safeguards.
• Meta and Google Ads — where you have consented to marketing cookies, data about your visit is shared with these platforms for advertising measurement and retargeting purposes.
• Professional advisers (lawyers, accountants, auditors) — where necessary.
• Regulators, law enforcement or other authorities — where required by law.

All processors acting on our behalf are bound by written Data Processing Agreements that require them to keep your data secure and process it only on our instructions.

We do not sell your personal data.

6. Our Relationship with Shopify

Our website is hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Information submitted through the Services will be transmitted to and shared with Shopify, as well as third parties that may be located in countries other than where you reside.

In addition, to help protect, grow and improve our business, we may use certain Shopify enhanced features that incorporate data from your interactions with our site, along with other merchants and Shopify. For these enhanced features, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights.

To learn more about how Shopify uses your personal information, visit the Shopify Consumer Privacy Policy. You may also exercise your rights with respect to data processed by Shopify at https://privacy.shopify.com/en.

7. International Transfers

Some of our service providers process personal data outside the United Kingdom. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place, such as:

• A UK adequacy decision ("adequacy regulations") for the destination country; or
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

The following international transfers currently apply:

Service Provider	Country	Safeguard
Shopify	Canada / United States	UK adequacy decision (Canada) / UK IDTA (US)
Google (Analytics / Ads)	United States	UK IDTA / Standard Contractual Clauses
Meta	United States	UK IDTA / Standard Contractual Clauses

You can contact us for more information about the safeguards in place for any specific transfer.

8. How Long We Keep Your Data

We keep your personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting or reporting requirements.

Data Category	Retention Period
Website analytics data / cookies	Up to 14 months (or as set by the relevant third-party platform)
Server and access logs	Up to 90 days
Customer service correspondence	24 months from the date of correspondence

9. Your Rights

Under UK data protection law you have the following rights, which you can exercise free of charge in most cases:

• The right to be informed about how we use your data (this policy).
• The right of access to a copy of your personal data (a "subject access request").
• The right to rectification of inaccurate or incomplete data.
• The right to erasure ("the right to be forgotten") in certain circumstances.
• The right to restrict processing in certain circumstances.
• The right to data portability — to receive a copy of data you provided to us in a structured, commonly used format.
• The right to object to processing based on legitimate interests.
• The right to withdraw consent at any time, where we rely on consent as the lawful basis. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at hello@aethr.skin or our DPO at dpo@aethr.skin. We will respond within one month. We may need to verify your identity before acting on your request.

You may also exercise certain rights with respect to data processed by Shopify at https://privacy.shopify.com/en.

We will not discriminate against you for exercising any of these rights.

10. Marketing

We do not currently send marketing emails or other direct marketing communications. If and when we do so in the future, we will only contact you where you have given us prior consent or where another lawful basis applies, and we will update this policy accordingly.

We may use cookie-based retargeting to show advertisements to people who have previously visited our website on third-party platforms such as Meta (Instagram/Facebook) and Google. This is done only where you have consented to marketing cookies via our cookie banner. Full details of how to opt out are set out in section 4.5 above.

We do not share your personal data with third parties for their own independent marketing purposes.

11. Children

The Services are not intended to be used by children, and we do not knowingly collect personal information from anyone under the age of 18. If you are the parent or guardian of a child who has provided us with their personal information, please contact us and we will delete it.

12. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These include encryption in transit (TLS), access controls, and secure hosting via Shopify.

No security measures are perfect or impenetrable. We recommend that you do not use insecure channels to communicate sensitive information to us.

13. Third-Party Links

The Services may provide links to websites or platforms operated by third parties. We are not responsible for the privacy or security practices of those sites. We recommend you review their privacy policies before providing your personal information.

14. Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve the matter.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

15. Changes to This Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal or regulatory reasons — for example, when our full store launches. We will post the revised policy on this website and update the "Last updated" date above.

16. Contact

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

For the purpose of UK data protection law, we are the data controller of your personal information.