Privacy Policy

1. Overview

Beautiful And Afraid ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This privacy policy informs you how we manage, collect, and safeguard your personal data when you interact with our website (beautifulandafraid.com) and subscribe to our early access communications, in compliance with the UK Data Protection Act 2018, UK GDPR, and the Privacy and Electronic Communications Regulations (PECR).

2. Data We Collect

When registering for our waitlist or early access updates, we collect:

• Contact Information: Your email address and, only if you separately opt in to SMS updates, your phone number.
• Information you provide: Your consent choices and any information you include when contacting us.

When you place an order through our checkout, we additionally collect:

• Order information: Your name, email address, and shipping address, the items and amount purchased, and order status (including shipping/tracking details once your order ships). This information is stored to fulfil your order, provide customer support, and meet our accounting and legal record-keeping obligations.
• Payment information: Payment is processed entirely by Stripe, our payment processor. We do not receive, transmit, or store your card details, Stripe handles card entry on its own secure checkout page and shares with us only confirmation that payment succeeded, the amount charged, and Stripe's own transaction reference IDs.
• Technical information: With your consent, we use Google Analytics (GA4) on our early access, checkout, and sizing survey pages to understand how visitors use our site. This may process technical information such as IP-derived approximate location, browser type, device information, and pages visited. Google Analytics is only loaded after you accept our cookie banner; if you reject or take no action, it does not load. You can withdraw consent at any time by clearing your browser's site data for our domain, which will show the cookie banner again on your next visit. Our hosting provider and Brevo may separately process technical information, such as IP address, browser type, device information, delivery status, email opens, and link clicks, as part of hosting, security, deliverability, and campaign reporting.
• Where you came from: With your consent, we save a short label in your browser's local storage showing which link brought you to our site (for example Instagram, TikTok, or email). When you check out, we attach that label to your order so we can see which channels lead to sales. It does not identify you. If you reject the cookie banner, nothing is saved and the order is recorded as "direct".
• Sizing survey responses: If you use our jeans sizing survey (on the website or via an email link), we record your selected size as an analytics event tied to your consent status, not to your name or account. This is used only in aggregate to plan production sizing and is not linked to your identity beyond what Google Analytics or Brevo's link-click tracking otherwise processes as described above.

3. Legal Basis & How We Use Your Data

Under the UK GDPR, we rely on the following lawful bases to process your information:

• Contract performance: When you place an order, we process your order and payment information because it is necessary to fulfil the contract of sale between you and us, to take payment, ship your order, and provide customer support relating to it.
• Email marketing consent: You explicitly consent to receiving release announcements, exclusive drops, and project communications by email when you tick the email consent box and submit your address.
• SMS marketing consent: You separately consent to receiving priority marketing text messages when you tick the SMS consent box and submit your phone number. You can withdraw consent by replying STOP.
• Legal obligation: We retain order and transaction records as required by UK tax and accounting law.
• Legitimate Interests: To optimize our communications, enhance deliverability, and ensure security across our platform.

We do not sell, rent, or trade your personal information to third parties for commercial marketing.

4. Third-Party Service Providers

To deliver automated communications and process orders securely, we share relevant information with verified technical processors:

• Payment Processing: We use Stripe to process payments. Stripe collects and stores your card details directly and provides us only with confirmation of payment, the amount charged, and its own transaction reference IDs. Stripe's own privacy policy governs its handling of your payment data.
• Email and SMS Marketing & Transactional Email: We use Brevo to securely store mailing lists, process signups, deliver automated email and SMS marketing campaigns, and send order confirmation and shipping notification emails.
• Order Processing & Hosting: Our order data is stored and processed on Cloudflare's infrastructure (Workers and D1 database) as part of our checkout system, and our website is hosted on cloud and DNS service providers that securely host and protect our domain infrastructure.
• Delivery: We ship to the United Kingdom, the United States and the European Union (except Cyprus, Luxembourg and Malta). To deliver your order we share the information needed with our couriers and shipping providers: your name, delivery address, phone number, email address, and the contents and value of your order. We buy our shipping labels through Easyship, so this is shared with Easyship for every order, and with Royal Mail for UK deliveries. For international orders it is shared with Easyship and UPS, and with customs authorities through them, so that your parcel can clear customs and be delivered. Shipping labels contain your delivery address and are deleted if you ask us to erase your data.
• International transfers: Because of this, your personal data may be sent outside the UK and the European Economic Area, for example to the United States. Where that happens we rely on appropriate safeguards, such as an adequacy decision or standard contractual clauses, to protect it.

5. Data Retention

We retain your contact details only for as long as needed to provide the communications you requested, manage our records, meet legal or regulatory obligations, resolve disputes, and protect our services. When you withdraw consent or request deletion, we will remove or suppress your details from active marketing lists, subject to information we must retain for legal, security, suppression, or record-keeping purposes. Brevo may retain information according to its role as our service provider and the terms of our agreement with it.

Order records (including your name, shipping address, and purchase history) are retained for as long as necessary to meet our accounting, tax, and legal obligations, resolve disputes, and maintain a record of the transaction. We do not currently operate an automated deletion schedule for order records; deletion or anonymisation requests are handled manually as described in Section 6.

Analytics data collected through Google Analytics (with your consent) is retained for 14 months. For user-level data, this period restarts if you return to the site, so it is deleted 14 months after your last visit. Aggregated, non-identifying reports are not affected by this limit.

If you ask us to erase your data, we remove your name, email address, phone number and delivery address from your order records and delete your saved shipping label. We keep the order itself (items, amount and dates) as the sales record we must retain for tax and accounting. We also delete your contact from our Brevo mailing list and any customer records held for you in Stripe. Stripe keeps its own payment records, which we ask it to redact separately.

You may opt out of marketing at any moment using the "Unsubscribe" link in an email or by replying STOP to an SMS. You can also contact us to request access, correction, or deletion of your data.

6. Your Statutory Rights

Under UK data protection law, you possess the right to:

• Request access to the personal data we hold about you.
• Request correction or deletion of your personal records.
• Object to or restrict the processing of your data.
• Withdraw your consent at any time without penalty.

We currently handle these requests manually: contact us using the details in Section 7 and we will respond within one month, as required by law. Note that we may be legally required to retain certain order and transaction records (for example, for UK tax and accounting purposes) even after a deletion request, in which case we will retain only what the law requires and explain this to you.

If you believe your personal data has been handled improperly, you retain the right to lodge an official complaint with the Information Commissioner’s Office (ico.org.uk).

7. Contact

For questions regarding this policy or to exercise any data rights, please contact:

Beautiful And Afraid
Email: [email protected]
Registered office: 17 Albacore Road, Upper Cambourne, Cambridge, England, CB23 6JH

Pulsar Clothing Limited is the data controller for the personal data described in this policy. Beautiful And Afraid is a trading name of Pulsar Clothing Limited. Registered in England and Wales, company number 15551888. Registered office: 17 Albacore Road, Upper Cambourne, Cambridge, England, CB23 6JH. This is our registered office, not a shop or returns address.