Privacy Policy
Last updated: September 28, 2026
This Privacy Policy explains how Carré d'AS LLC, trading as Lommy ("Lommy", "we", "us"), collects, uses and shares personal information when you visit or buy from thelommy.com (the "Site"). For UK data protection purposes, Carré d'AS LLC is the controller of your personal data.
1. Information we collect
- Information you provide: name, email address, phone number, billing and shipping address, order details, and any messages you send us (including support requests, reviews and contact forms).
- Payment information: processed securely by our payment providers (such as Shopify Payments, PayPal, Apple Pay and Google Pay). We do not store full card numbers.
- Information collected automatically: IP address, device and browser information, approximate location, pages viewed, referring website, and interactions with our Site and emails, collected through cookies, pixels and similar technologies.
- Information from partners: delivery and tracking updates from carriers, fraud-prevention signals from our payment providers, and campaign performance data from advertising platforms.
We do not ask you to provide medical or health information. Please do not send us health information unless necessary for a support request (for example, reporting an adverse reaction).
2. How we use your information
| Purpose | UK legal basis |
|---|---|
| Processing, delivering and supporting your order; handling returns and refunds | Performance of a contract |
| Preventing fraud, verifying orders and responding to chargebacks and payment disputes | Legitimate interests; legal obligation |
| Sending order and shipping notifications | Performance of a contract |
| Sending marketing emails and SMS | Consent (you can unsubscribe at any time) |
| Advertising, retargeting and measuring ad performance (e.g. Meta, Google, TikTok) | Consent (via cookie preferences) |
| Improving our Site, products and customer experience; analytics | Legitimate interests / consent for non-essential cookies |
| Complying with tax, accounting and legal obligations | Legal obligation |
3. How we share information
We share personal information only as needed with: our e-commerce platform (Shopify); payment processors; fulfilment partners and carriers (name, address, phone and order contents, to deliver your order); email/SMS marketing providers; advertising and analytics partners; customer support tools; professional advisers; and authorities where required by law. We may share information with a buyer or successor in the event of a business transfer. We do not sell your personal information for money.
4. International transfers
We are based in the United States and our service providers and fulfilment partners may be located in the United States, the United Kingdom, the European Union, China and other countries. Where UK personal data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, the UK–US data bridge where applicable, or transfers necessary to perform our contract with you (for example, to ship your order).
5. Cookies
We use strictly necessary cookies to run the Site and the checkout, and — with your consent where required — analytics and advertising cookies. You can manage your preferences at any time via the cookie banner or your browser settings. Refusing non-essential cookies will not prevent you from making a purchase.
6. Retention
We keep order and transaction records for as long as necessary for accounting, tax, fraud-prevention and dispute purposes (generally up to 7 years). Marketing data is kept until you unsubscribe or withdraw consent. Other data is deleted or anonymised when no longer needed.
7. Your rights — United Kingdom
Under the UK GDPR, you have the right to access, correct, delete or restrict the processing of your personal data, to object to processing based on legitimate interests, to object to direct marketing at any time, to data portability, and to withdraw consent at any time. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
8. Your rights — United States
Depending on your state of residence (including California, Colorado, Connecticut, Virginia, Texas, Oregon and others), you may have the right to know and access the personal information we hold about you, to correct it, to delete it, to obtain a copy, and to opt out of the "sale" or "sharing" of personal information for targeted advertising. The use of advertising cookies and pixels may be considered "sharing" or "targeted advertising" under some state laws. You can opt out using the "Your Privacy Choices" / "Do Not Sell or Share My Personal Information" link in the Site footer, and we honour Global Privacy Control (GPC) browser signals. We will not discriminate against you for exercising your rights. You may appeal a decision on your request by replying to our response. Authorised agents may submit requests on your behalf with proof of authorisation.
Some states treat information about the purchase of certain wellness products as consumer health data. We do not use your purchase history to infer health conditions, and we do not sell such data.
9. Exercising your rights
Email support@thelommy.com with your request. We may need to verify your identity before responding. We respond within one month (UK) or 45 days (US), which may be extended where permitted by law.
10. Security and children
We use reasonable technical and organisational measures to protect your information, but no system is completely secure. The Site is not intended for anyone under 18, and we do not knowingly collect personal information from children.
11. Changes and contact
We may update this Privacy Policy from time to time; the updated version will be posted on this page with a new "Last updated" date. Contact: Carré d'AS LLC, 701 Tillery St, Unit 12, 3537, Austin, TX 78702, United States — support@thelommy.com.