Privacy Policy

Brilliaura is responsible for the personal information described in this policy. The legal company name, trading name, support address, and contact details configured for this store identify the relevant controller. Contact the support email shown on this website for privacy questions or rights requests.

We collect information you choose to provide, including name, email address, phone number, account credentials, delivery and billing addresses, jewellery preferences, ring configurations, saved designs, wishlist choices, inquiry messages and attachments, newsletter choices, order instructions, return requests, and communications with support. We do not ask you to send full payment-card details to Brilliaura support.

We process cart, checkout, order, product configuration, price, payment status, fraud and risk signals, invoice, shipment, customs, tracking, return, repair, warranty, and refund information. Payment credentials are handled by the configured payment processor; Brilliaura stores provider references, payment status, amounts, and reconciliation information rather than complete card numbers. Delivery information is shared with the configured carrier and customs services where required.

Our systems may receive IP address, browser and device information, request identifiers, timestamps, security and audit events, session activity, referral information, and pages or placements interacted with. Marketing attribution and persistent visitor recognition occur only when the applicable non-essential cookie choice permits them. Essential security, authentication, cart, checkout, delivery-country, order-access, and consent records operate as described in the Cookie Policy.

We use information to provide accounts, saved designs, shopping, checkout, payment, delivery, returns, support, and requested communications; calculate prices, production and international delivery; prevent fraud and protect the service; maintain audit and transaction records; improve reliability; comply with law; and, where you consent or the law otherwise permits, send marketing and measure campaigns.

Depending on location and purpose, processing may be necessary to perform a contract or take requested pre-contract steps, meet a legal obligation, protect legitimate interests such as security and fraud prevention, or act on consent. Consent can be withdrawn for future optional processing. Brilliaura must confirm the correct legal basis for each jurisdiction before final publication.

Information may be disclosed only as needed to providers supporting payment processing, insured delivery and customs, transactional email, authentication, infrastructure and private media storage, security, professional advice, and legal compliance. Providers actually used depend on deployment configuration and may include Razorpay for payment, Resend for email, Google or Apple for optional sign-in, and configured object storage. We may also disclose information where law requires it or in connection with a properly structured business transfer.

Service providers and customers may be located in different countries. Where law requires transfer safeguards, Brilliaura will use an approved mechanism such as an adequacy decision, contractual safeguards, or another lawful basis. The actual hosting and processing locations must be confirmed for the production deployment.

Browser credentials have defined lifetimes: the account session is configured for up to 7 days, the rolling guest-commerce credential for about 24 hours, the secure guest-order access credential for up to 90 days, the delivery-country preference for up to 1 year, and the optional marketing identifier for up to 1 year. A ring-builder configuration remains in browser storage until it is replaced or cleared. Account, order, payment, tax, customs, fraud, support, consent, return, warranty, and audit records are retained only for operational, legal, accounting, dispute, or security needs under Brilliaura's approved retention schedule.

Depending on your location, you may request access, correction, deletion, restriction, portability, or information about use and disclosure; object to certain processing; withdraw consent; opt out of marketing; or appeal a privacy decision. California residents may also have rights to know, delete, correct, opt out of sale or sharing, limit certain sensitive-information uses, and receive equal service. Brilliaura does not sell personal information for money or use it for cross-context behavioural advertising in the audited codebase. Identity verification and legal exceptions may apply.

Essential cookies and local storage support sign-in, security, carts, checkout, delivery preferences, private order access, the ring builder, and consent records. The optional first-party marketing identifier is disabled unless marketing consent is available. Use Cookie Settings at any time to accept or reject non-essential categories and read the detailed Cookie Policy.

Brilliaura uses access controls, role-based administration, secure cookie attributes, password hashing, request validation, rate limits, audit logging, encrypted transport in production, private storage controls, payment-provider tokenisation, and transaction safeguards. No service can guarantee absolute security; contact support immediately if you believe an account or order-access link has been compromised.

Brilliaura is intended for adults purchasing high-value jewellery and is not directed to children. We do not knowingly create accounts or collect marketing consent from children below the age at which independent consent is valid in their location. Contact us if you believe a child provided personal information.

We may update this policy when services, providers, or legal requirements change. The effective date and version appear above. Material changes will be communicated where required. Submit privacy questions and rights requests through the published support contact and include enough information for Brilliaura to verify and respond securely.

The storefront currently requests font files and styles from Google Fonts and Fontshare. Those providers receive ordinary technical request information such as IP address, browser details, requested resource, and time. Brilliaura does not use those requests as advertising trackers, but the production legal and privacy review should confirm the applicable lawful basis or replace them with self-hosted assets.