Privacy Policy

This Privacy Policy explains how CORMELIO, LLC, operating through cormelio.com, collects, uses, stores, protects, and manages personal information when customers browse our website, place an order, make a payment, contact customer support, request a return or refund, or otherwise interact with our services.

1. Scope of This Privacy Policy

This Privacy Policy applies to personal information collected through cormelio.com and through communications directly related to orders, payments, delivery, returns, refunds, customer service, and account-related activity.

It is intended to explain clearly what information may be collected, why it may be needed, how it may be used, and what rights customers may have regarding that information.

2. Information We May Collect

We may collect information that customers provide directly when placing an order or contacting us, including name, billing address, shipping address, email address, telephone number, order details, product selections, and customer service communications.

We may also receive technical information relating to website use, such as IP address, browser type, device information, approximate location derived from network information, operating system, referring page, and website activity.

We aim to collect only information that is reasonably necessary for operating the website, processing transactions, providing customer support, improving security, and meeting legal or regulatory obligations.

3. Information Used for Order Fulfillment

Personal information may be used to process and manage orders, confirm purchases, prepare shipments, communicate delivery information, provide order tracking, and assist with delivery-related issues.

Shipping information may be shared with relevant carriers or logistics providers only to the extent reasonably necessary to complete delivery or investigate a shipping-related concern.

4. Payment Information and Payment Providers

Payments made through cormelio.com may be processed using supported payment service providers, including Stripe and PayPal.

Depending on the selected payment method, payment providers may collect or process information such as payment card details, billing information, transaction identifiers, authorization results, fraud screening information, and other data required to complete or verify a payment.

Full payment card details are generally handled by the applicable payment processor rather than being directly stored by CORMELIO, LLC.

5. Payment Security

We use established payment processors and security measures designed to reduce the risk of unauthorized access, fraudulent transactions, interception, or misuse of payment-related information.

Stripe and PayPal may apply their own security controls, including transaction monitoring, risk analysis, authentication, tokenization, payment verification, and fraud detection technologies.

Where additional authentication is required by a bank, card issuer, Stripe, PayPal, or another payment service, customers may be asked to complete that verification before a transaction is approved.

6. HTTPS and SSL/TLS Protection

cormelio.com uses HTTPS connections supported by SSL/TLS encryption to help protect information while it is transmitted between a customer's browser and our website.

This encrypted connection is intended to reduce the risk that information transmitted through supported website pages, forms, checkout processes, or account functions can be intercepted or altered while in transit.

We also aim to maintain valid security certificates and use current transport encryption standards where supported by our hosting and service infrastructure.

7. Internal Data Security Measures

We use reasonable administrative and technical measures designed to protect personal information from unauthorized access, disclosure, loss, misuse, alteration, or destruction.

These measures may include restricted administrative access, password-protected systems, role-based access, account authentication, software updates, server-level protections, security monitoring, and limiting access to information to personnel or service providers who reasonably need it for their work.

No online system can guarantee absolute security, but we regularly aim to reduce foreseeable risks through appropriate technical and operational safeguards.

8. How We Use Personal Information

Personal information may be used for legitimate business purposes connected with providing our services.

These purposes may include processing purchases, confirming payments, arranging delivery, providing customer support, handling returns or refunds, investigating payment or shipping concerns, improving website functionality, preventing fraud, maintaining business records, and complying with legal obligations.

9. Fraud Prevention and Transaction Review

We may use order, account, technical, payment, and communication information to help identify suspicious activity, reduce unauthorized transactions, and protect customers and our services from fraud.

Relevant information may also be reviewed where a transaction is disputed, charged back, reported as unauthorized, or otherwise questioned through Stripe, PayPal, a card issuer, or another payment provider.

Where necessary, we may provide relevant order, transaction, shipping, tracking, or customer communication records to a payment provider as part of a legitimate dispute review or fraud investigation.

10. Sharing Information With Service Providers

We may share limited personal information with trusted service providers that help us operate the website and complete customer transactions.

These providers may include payment processors, shipping carriers, hosting providers, website security services, email service providers, analytics providers, technical support providers, or other vendors required to operate the service.

Information is shared only to the extent reasonably necessary for the relevant service, subject to applicable contractual, technical, and legal safeguards.

11. Data Retention

Personal information collected through cormelio.com is generally retained for no longer than 1 year from the date it is collected or from the date of the relevant transaction or interaction, whichever is later.

Information may be removed, anonymized, or securely deleted after that period when it is no longer reasonably required for customer support, transaction records, dispute handling, fraud prevention, or other legitimate purposes.

In limited circumstances, certain records may need to be retained longer where applicable law, tax rules, accounting obligations, payment provider requirements, active disputes, fraud investigations, or legal claims require continued retention.

12. Cookies and Similar Technologies

cormelio.com may use cookies and similar technologies to support essential website functions, maintain sessions, remember preferences, improve performance, understand website use, and assist with security or fraud prevention.

Some cookies may be placed by third-party service providers involved in payment processing, analytics, website functionality, or security.

Where required by applicable law, customers may be provided with appropriate cookie controls or consent options.

13. Marketing Communications

Where permitted by applicable law, we may send customers service-related or promotional communications based on consent or another valid legal basis.

Transactional messages relating to orders, payments, shipping, returns, refunds, or account security are treated separately from promotional communications because they may be necessary to provide the requested service.

Customers may opt out of promotional email messages using the available unsubscribe method or by contacting us at [email protected].

14. GDPR and Lawful Basis for Processing

Where the General Data Protection Regulation ("GDPR") or similar European data protection rules apply, personal information may be processed on one or more lawful bases.

These may include processing that is necessary to perform a contract, such as processing an order; compliance with legal obligations; legitimate interests such as fraud prevention, service security, customer support, and dispute handling; or customer consent where consent is legally required.

We aim to ensure that personal data is processed only for legitimate and proportionate purposes consistent with the reason it was collected.

15. GDPR and Customer Privacy Rights

Depending on applicable law and location, customers may have the right to request access to personal information held about them, request correction of inaccurate information, or request deletion of information where deletion is legally available.

Customers may also have rights to restrict certain processing, object to processing in specific circumstances, request data portability, or withdraw consent where processing is based on consent.

Privacy requests may be submitted to [email protected]. We may request reasonable information to verify the identity of the person making the request before providing or changing personal information.

16. International Data Processing

Because we provide worldwide services and use third-party providers such as Stripe, PayPal, hosting services, and shipping providers, personal information may be processed in countries other than the customer's country of residence.

Where cross-border data transfers are subject to applicable privacy laws, we aim to use service providers and transfer mechanisms designed to provide appropriate protections for personal information.

The privacy practices and legal obligations of independent third-party providers may also be governed by their own privacy policies and applicable laws.

17. Data Breach and Security Incident Response

If we become aware of a security incident involving personal information, we may take reasonable steps to investigate, contain, mitigate, and document the issue.

Depending on the nature and severity of the incident, these steps may include restricting access, resetting credentials, reviewing affected systems, working with hosting or security providers, preserving relevant records, and implementing corrective measures.

Where notification is required by applicable data protection law, affected individuals or relevant authorities may be notified in accordance with the applicable legal requirements.

18. Privacy Questions and Policy Updates

Customers who have questions about this Privacy Policy, personal information, data retention, payment security, GDPR rights, or a privacy-related request may contact us at [email protected].

We may update this Privacy Policy from time to time to reflect changes in our services, payment providers, security practices, legal requirements, or operational processes.

Any updated version will be made available through cormelio.com. Continued use of the website after an update will be subject to the current version of the policy, except where applicable law requires additional notice or consent.