Privacy Policy

Information We Collect

When you visit or make a purchase on Cura, we collect certain information to process your order and improve your experience. This may include your name, email address, shipping address, payment details (processed securely by our payment provider), and browsing activity on our site.

If you accept optional cookies, we may also collect a limited checkout-attribution record. It contains first and most recent touch timestamps, sanitized campaign labels, a Cura landing path without its query or fragment, and only the origin of an external referring site. The attribution fields are not designed to collect your name, email, phone number, address, payment information, customer or guest identifier, order or payment identifier, or a checkout credential; obvious direct-identifier values are removed before capture.

Optional first-party journey analytics use random browser and 30-minute session identifiers to record defined page, product, cart, checkout, and error events. Event context is limited to a Cura path without its query or fragment, an external referrer origin, bounded campaign labels, broad device type, stable product identifiers, and bounded commerce values. This journey record excludes names, email addresses, phone numbers, postal addresses, raw search words, full referrer URLs, IP addresses, and raw browser user-agent strings.

Google Sign-In

Cura Collective uses Google Sign-In only to create or access Cura Collective accounts. Cura Collective receives basic profile information associated with a user's Google account, including their name, email address, and profile image, to authenticate that account. Cura Collective does not request sensitive or restricted Google data.

How We Use Your Information

• Process and fulfill your orders
• Communicate with you about orders, products, and promotions
• Improve our website, products, and services
• Understand which broad acquisition channels contribute to completed orders
• Measure shopping-funnel conversion and where observable sessions stop
• Comply with legal obligations
• Prevent fraud and protect the security of our platform

Sharing Your Information

We do not sell your personal information. We share information with trusted third parties who help us operate our business, such as payment processors, shipping providers, and email service providers. We may also share limited data with advertising partners to support marketing and analytics. These partners are contractually required to protect your information.

Cookies & Tracking

We use cookies and similar technologies to keep the site functioning, remember your preferences, and understand how visitors use Cura. For more details, see our Cookie Policy. You can manage your preferences at any time via the Cookie Settings link.

Consented checkout attribution uses Cura's first-party browser storage, as do random first-party journey identifiers. Both are separate from optional third-party analytics and advertising tags. Blocking a third-party tracker alone does not clear a valid consented Cura record. Declining or revoking optional consent clears these browser records and stops future browser capture; unavailable browser storage never prevents checkout.

Customer Journey Analytics

Cura uses the consented events described above to report an observable sequence from a visit through product consideration, cart activity, and checkout. If a checkout becomes an order, trusted Cura and Stripe processing may link the random journey identifiers to Cura's internal customer, checkout, and order identifiers and record payment or refund outcomes. Stripe and Cura's order records—not a browser success page—remain the source of truth for transaction outcomes.

Authorized Cura administrators may view aggregate conversion, drop-off, timing, acquisition, first-time and returning customer, and data-quality reports. They may also retrieve a limited event timeline using an internal session, customer, or order identifier for diagnostics. A journey can be incomplete when consent is not granted, storage is cleared or blocked, or a customer uses another browser or device; Cura does not label such gaps as a complete record of a person.

Checkout Attribution

We preserve the sanitized first and most recent source facts and separately apply a versioned Cura-managed grouping into broad channels: direct, organic, referral, seller, creator, partnership, email, paid social, paid search, or unknown. Known campaign signals take priority over a referrer. Conflicting or unrecognized campaign signals remain unknown rather than being guessed, and an order with no protected attribution record is not recast as direct.

The protected record is linked only after Stripe reports a completed payment and the order is marked paid. The source facts, classifications, and one-to-one order link cannot then be overwritten or reassigned. Raw records are available only to authorized Cura administrators through a protected, limited-access reporting interface; they are not exposed to buyers, guests, sellers, or the public. Classification failures do not block a purchase and remain visibly unavailable for later repair.

Cura does not use a Meta, Google Ads, or other advertising-platform API to create or enrich this protected attribution record. Optional analytics and advertising tags are separate and remain subject to your cookie preference.

Your Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting us. If you are located in the EU, UK, or California, you may have additional rights under applicable privacy laws.

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy, comply with legal requirements, and resolve disputes.

A browser attribution record expires 90 days after its first touch, and later touches do not extend that deadline. An unlinked protected server record reaches its link deadline 90 days after receipt and is then eligible for deletion. Once attribution is immutably linked to a paid order, it is retained with the order under our order-record retention policy. Revoking optional consent clears the browser copy and stops future capture, but it does not rewrite an attribution record already linked to a completed order.

Raw first-party behavioral journey events are retained for up to 400 days. Trusted purchase, refund, and other journey facts linked to an order may be retained with that order under our order-record retention policy. Aggregate reports may be kept longer when they no longer identify an individual journey.

Contact Us

If you have questions about this Privacy Policy, please reach out at support@shopcuracollective.mom.