Privacy Policy

1. Who we are

IYSTAR ("we", "us") operates the website www.iystar.com and related services. This policy explains what personal data we collect, why, and the rights you have over it.

For any privacy question or request, contact us at privacy@iystar.com.

2. Data we collect

Account data: email address, name, and a password hash (we never store your plain password).

Order data: shipping and billing address, phone number, items purchased, and payment status. Full payment card numbers are handled by our payment provider and never touch our servers.

Usage data: basic technical logs (IP address, browser type, pages visited) needed to operate and secure the service.

3. How we use your data

To create and manage your account; to process, ship, and support your orders; to prevent fraud and abuse; to comply with tax, customs, and consumer-protection law.

We do not sell your personal data to third parties.

4. Legal bases

Performance of a contract (fulfilling your orders), legitimate interests (security, fraud prevention, service improvement), and consent where required (e.g. marketing communications, which you can withdraw at any time).

5. Cookies

We use a small number of strictly necessary cookies: a session cookie to keep you signed in, and a bag token to remember your shopping bag between visits. We do not use third-party advertising cookies.

6. Who we share data with

Store partners and carriers, strictly to fulfil and deliver your order; our payment processor, to take payment and handle refunds; professional advisers and authorities where required by law.

Each store fulfils its own orders, so your shipping details are shared with the store(s) you purchase from.

7. Retention

Account data is kept while your account is active. Order and invoice records are retained for the period required by tax and accounting law (typically 7 years) even after account closure; other personal data is deleted or anonymised on closure.

8. Your rights

You may request access, correction, deletion, portability of your data, or object to certain processing, subject to legal retention duties. Email privacy@iystar.com and we will respond within 30 days.

If you are in the EEA/UK you may also lodge a complaint with your local data-protection authority. If you are a California resident, you have the rights described by the CCPA as amended.

9. International transfers

Our hosting and service providers may be located outside your country. Where personal data leaves the EEA/UK we rely on appropriate safeguards such as standard contractual clauses.

10. Security

Passwords are stored using salted scrypt hashing. Traffic is encrypted with TLS. Access to personal data is limited to what is necessary to run the service.

11. Changes to this policy

We will post any changes on this page and update the "last updated" date above.