Privacy Policy

Who We Are

This Privacy Policy explains how Base Layer Skin LLC ("Base Layer," "we," "us," or "our") collects, uses, and shares information when you visit baselayerskin.co (the "Site") or purchase our products.

Base Layer Skin LLC operates from Colorado, United States, and is the party responsible for the information described in this policy. You can reach us at any time at contact@baselayerskin.co.

Information We Collect

Order information. Checkout is processed by Shopify. When you place an order, Shopify collects the information needed to fulfill it, such as your name, email, shipping address, and payment details. Payment card numbers are handled by Shopify and its payment processors and are never stored on our servers.

Contact and waitlist information. If you join our early-access waitlist, sign up for updates, complete a skin-concern quiz, or otherwise submit an email address on the Site, we store that information using Supabase, our backend data platform, and send it to Brevo to deliver the emails you requested.

Automatically collected information. Unless you turn it off (see Cookies & Tracking Technologies below), we use Google Analytics 4 and the Meta (Facebook/Instagram) advertising pixel to understand how visitors use the Site and to measure the performance of our advertising. This includes pages viewed, links and buttons clicked, approximate location derived from IP address, device and browser type, and referring source. We also send certain purchase and add-to-cart events to Meta server-side through the Meta Conversions API. Turning tracking off stops all of it, browser-side and server-side alike.

Email lifecycle information. After you submit a marketing opt-in and allow optional cookies, Brevo can associate your product views and current shopping-cart contents with your email contact so we can send relevant welcome, cart-recovery, and replenishment messages. Cart events do not contain your email address; Brevo associates them using its visitor cookie.

After a purchase, Shopify may also send us limited order-status, fulfillment, delivery, refund, subscription-order, and email-consent information. We store a minimized lifecycle record in Supabase and, only when marketing consent is current, share relevant status signals with Brevo. These lifecycle records exclude payment-card details, shipping and billing addresses, and phone numbers.

Cookies & Tracking Technologies

What runs before you choose depends on where you are. If you're visiting from the European Economic Area, the United Kingdom or Switzerland, a banner asks you to Accept or Reject on your first visit, and nothing in the table below marked "Yes" is set until you Accept. Everywhere else, including the United States, those cookies are set from your first visit and you can switch them off at any time using "Cookie Preferences" in the footer, which opens the same banner.

Reject works identically wherever you are: choose it and GA4, the Meta Pixel, Meta CAPI, the Brevo lifecycle tracker and the bl_session cookie all stop, leaving only the cookies marked "Required" below. Accept and Reject are one click each, and neither is preselected or visually favored over the other. Your choice is stored on your device and you can change it as often as you like. Durations below are the values set by each provider and may change if a provider updates its defaults.

You can change your Accept/Reject choice at any time using "Cookie Preferences" in the site footer. You can also block or delete cookies through your browser settings, opt out of Google Analytics using Google's browser add-on, and adjust how Meta uses your data for advertising in your Meta account ad preferences. Blocking cookies may affect how parts of the Site function.

How We Use Information

We use the information above to process and fulfill orders, respond to customer service inquiries, operate and improve the Site, and measure and personalize our marketing and advertising.

How We Share Information

We do not sell your personal information for money. We share it with the service providers who help us run the Site and our business:

• Shopify — checkout, payment processing, and order fulfillment.
• Supabase — backend storage for waitlist and contact submissions.
• Brevo — email list management, marketing email delivery, and opted-in subscriber lifecycle automation.
• Netlify — website hosting and delivery.
• Google — analytics and measurement.
• Meta — advertising delivery and conversion measurement, including server-side events.
• Sanity — content management for articles and product education pages.

Sharing information with Meta and Google for advertising measurement may be treated as "sharing" for cross-context behavioral advertising under certain state privacy laws. See Your Privacy Rights below for how to opt out. We may also disclose information where required by law or to protect our legal rights.

Data Retention

We keep order records for as long as needed to fulfill the order and meet tax, accounting, and legal obligations, which is generally seven years. Waitlist and marketing email addresses are kept until you unsubscribe or ask us to delete them. Analytics data is retained according to each provider's settings, which is up to 14 months for Google Analytics and up to 90 days for Meta's event-level data. When a retention period ends, we delete or anonymize the information.

Your Privacy Rights

Depending on where you live, you may have the right to request access to the personal information we hold about you, request that we correct it, request that we delete it, opt out of the sale or sharing of your personal information for targeted advertising, and receive a copy of it in a portable format. You have the right not to be discriminated against for exercising any of these rights.

If you are in the European Economic Area or the United Kingdom, you may also have the right to object to or restrict certain processing, to withdraw consent where we rely on it, and to lodge a complaint with your local supervisory authority. You can withdraw or change your cookie consent at any time using "Cookie Preferences" in the site footer — see Cookies & Tracking Technologies above.

To exercise any of these rights, email contact@baselayerskin.co with the request and the email address you used with us. We will respond within the timeframe required by applicable law, generally 45 days. We may need to verify your identity before acting on a request. An authorized agent may submit a request on your behalf with proof of authorization.

Children's Privacy

The Site is intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us at contact@baselayerskin.co and we will delete it.

International Data Transfers

We operate in the United States, and the service providers listed above process information in the United States and other countries. If you access the Site from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection law may differ from the law in your country.

Security

The Site is served over HTTPS, and all traffic between your browser and our hosting and checkout providers is encrypted in transit. Payment card details are collected and processed by Shopify on its own PCI-DSS compliant infrastructure and never reach our servers. Access to the systems holding customer data is restricted to the people who need it to operate the business. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated effective date at the top of this page.

Contact Us

Questions about this Privacy Policy can be sent to contact@baselayerskin.co.