Privacy

THE SKIN CLUB is an online skincare and lifestyle store operating from Accra, Ghana, selling products sourced from the USA. This policy explains what personal information we handle when you browse the site, join the waitlist, place an order or hold an account with us.

This policy describes how our website and store systems currently work. It is not legal advice and does not create rights beyond those given by applicable law.

We only collect the information our store actually needs. Depending on how you use the site, that can include:

• Waitlist and invitation information — your first name, email address and, if you choose to provide it, your WhatsApp number, together with your waitlist status, whether you gave marketing consent and when, and the invitation link (token) issued to you, including when it was issued, when it expires and whether it was withdrawn.
• Order and delivery information — the full name, email address, phone number, delivery address, city and region you enter at checkout, any delivery note you add, your chosen delivery method, the products, quantities and options you ordered (including hair length and lace selections where relevant), any discount code used, the packaging (Skin Club Bag) choice, and the order totals.
• Customer record — a customer profile is kept for each email address that orders, which may hold your name, email address, phone number, WhatsApp number, status and internal notes added by our team for customer service.
• Account information — if you create an account, your email address and a password managed by our authentication provider. We never see your password in readable form. Where an order is placed while signed in, the order is linked to your account.
• Payment information — the payment reference, transaction identifier, payment channel (for example card or mobile money), amount, currency, status, verification timestamps and the response message returned by our payment provider. See section 4.
• Operational records — internal logs of order status changes, stock adjustments and payment provider notifications, used to keep orders and inventory correct and auditable.
• Technical information — our hosting, database and payment providers process standard technical data such as IP address, browser/user-agent and request timestamps in their server logs as part of delivering and securing the site. Our own site code does not run advertising, profiling or third-party tracking scripts.

If you contact us directly (for example by email or WhatsApp), we also hold what you send us so we can respond.

• Order processing and fulfilment — to confirm, prepare, deliver and, where needed, correct your order.
• Payment processing and verification — to initiate payment and to verify, on our server, that a payment genuinely succeeded before an order is treated as paid.
• Transactional emails — waitlist confirmations, invitation emails and order confirmations sent after payment is verified.
• Customer support — to answer questions, resolve delivery problems and handle returns or refunds.
• Account management — to let you sign in, view your orders and manage your details.
• Waitlist and invitation management — to manage membership status and to issue or withdraw invitation links that grant access to the store.
• Website security and fraud prevention — to detect mismatched or replayed payment notifications, to restrict admin access to authorised accounts, and to protect the store from abuse.
• Marketing, only where you have opted in — the waitlist form includes an optional, unticked marketing consent box. Your email address is added to our marketing audience only if you tick it, and we record the date you did. If you leave it unticked you still receive the transactional emails above, but no marketing. You can unsubscribe at any time.
• Legal and regulatory obligations — to keep accurate transaction records and to respond to lawful requests.

Payments are processed by Paystack. When you continue to payment you are taken to Paystack's own secure hosted checkout, where you enter your card or mobile money details directly with them.

Our systems do not receive or store card numbers, CVV codes, card PINs, mobile money PINs, one-time passwords or any other payment authentication credentials. What we store against your order is limited to the payment reference we generate, the provider's transaction identifier, the payment channel name (for example card or mobile money), the amount, currency, status, the provider's response message and the verification timestamps.

Every payment is confirmed server-side with Paystack, and the amount, currency and reference must match the stored order before the order is marked as paid.

We share only what each provider needs to perform its function:

• Paystack — payment initiation and verification. Receives your email address, the order reference and the amount/currency, plus the payment details you enter directly with them.
• Resend — sending our transactional emails (waitlist confirmation, invitations, order confirmations) and holding our email marketing audience. Receives your email address, first name and the email content.
• Supabase — the managed database, authentication and file storage behind the store, where the information described in section 2 is held.
• Lovable — hosting and delivery of the website and its server functions.

These providers process the information on our behalf under their own terms and security practices, and may store or process it outside Ghana.

We do not sell your personal information, and we do not share it with advertising networks or data brokers.

Beyond the service providers listed above, information may be shared with people involved in delivering your order (for example a courier receiving the delivery name, phone number and address), with our own authorised staff who operate the store dashboard, and where we are legally required to disclose it or need to do so to establish or defend legal claims.

• Your bag — the products in your bag are saved in your browser's local storage so your selection survives a page reload. This stays on your device.
• Invitation access — if you open the store with an invitation link, the invitation token is saved in your browser's local storage so you don't have to re-enter it. It is verified on our server every time.
• Sign-in session — when you sign in, our authentication provider stores a session in your browser (local storage and/or cookies) so you stay signed in.
• Provider and hosting logs — our hosting, database and payment providers keep standard technical request logs as described in section 2.

Our site code does not set advertising, cross-site tracking or third-party analytics cookies. Clearing your browser storage will empty your bag and sign you out.

The measures we have in place include: payment details being entered only on the payment provider's hosted page; server-side verification of every payment before an order is treated as paid, with checks against replayed or mismatched notifications; database access rules that restrict store records to the customer they belong to or to authorised admin accounts; role-based admin access that is checked on the server; password-based sign-in handled by our authentication provider; and secret keys held only in server-side configuration, never in the website code sent to your browser.

No online service can be guaranteed completely secure. We make no certification claims — in particular we do not claim PCI DSS certification for THE SKIN CLUB; card data handling is performed by our payment provider.

We keep information for as long as it is needed for the purpose it was collected, and for as long as we need order and payment records for accounting, warranty, dispute and legal purposes.

Our systems do not automatically delete records after a fixed period. Waitlist entries, customer records and related information are retained until they are removed by our team, including at your request, subject to records we must keep for legal or accounting reasons. We have not set a single fixed retention period, and we will not state one we do not apply.

Subject to applicable law, you can ask us to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete information we no longer need to keep.
• Restrict or object to certain uses of your information.
• Withdraw your consent to marketing emails at any time — every marketing email includes an unsubscribe option, and you can ask us to remove you from the list.

To exercise any of these, contact us using the details in section 13. We may need to verify your identity before acting on a request.

The store is intended for adults. We do not knowingly collect personal information from children under 18, and accounts and orders should be created only by adults or by a parent or guardian on a child's behalf. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy as the store develops or as our providers change. The current version is always published on this page, with the "Last updated" date at the top. Significant changes will be highlighted where appropriate.

For any privacy question or request, reach us at:

• Email: THESKINCLUBSTORE@GMAIL.COM
• Phone: +233207026972
• WhatsApp: +233203664435
• Address: odum road 330-0258

Our transactional emails are sent from noreply@theskinclub.store, which is not monitored for replies.