Privacy Policy

1. Who is responsible for your data

The data controller is JAVED ASSOCIATES LIMITED("Ember & Blend", "we", "us"), registered in the United Kingdom at 83-85 Cambridge Street Cowcaddens, G3 6RU, United Kingdom. For any privacy question or request, contact support@javeasso.shop or +44 7103071710.

2. What data we collect

• Identity and contact data: name, email address, phone number, shipping address, delivery and billing address, and country.
• Order and fulfilment data: the kits you buy, order value in USD, the shipping address and delivery details used for order fulfilment, dispatch and carrier tracking, order history and support correspondence.
• Account and subscription data: Spice Club tier, subscription status, and preferences you share (for example flavour profile or dietary needs).
• Payment boundary data: we receive confirmation of payment, the last four digits and card type from our payment processor. We never receive or store your full card number.
• Technical and usage data: IP address, device and browser type, and pages visited, collected through cookies and similar technologies.
• Marketing lead data: details you submit through the contact, wholesale or checkout forms, retained so we can respond and follow up.

3. Where we collect it from (collection sources)

Our collection sources for the personal data described above are:

• Directly from you when you order, register, subscribe, or complete a form (including the shipping address you enter at checkout).
• Automatically through cookies and analytics when you use the site (see our cookie policy).
• From our payment processor (Stripe) when a payment is authorised or a subscription renews.
• From delivery carriers in relation to shipping, order fulfilment and tracking of your order.

4. Why we use it and our legal bases

• To process and deliver your orders and manage returns — legal basis: performance of a contract.
• To manage Spice Club subscriptions and billing — legal basis: performance of a contract.
• To provide customer support and respond to enquiries — legal basis: legitimate interests and contract.
• To retain checkout and enquiry details as sales leads and to send marketing where permitted — legal basis: legitimate interests, or consent where required.
• To operate, secure and improve the site and prevent fraud — legal basis: legitimate interests.
• To meet legal, tax and accounting obligations — legal basis: legal obligation.

5. Who we share it with

We share personal data only with processors and partners who help us run the store:

• Payment processing: Stripe, Inc., which handles card data under its own PCI-compliant systems. We do not receive full card numbers.
• Hosting and infrastructure: our website hosting and serverless platform (Vercel).
• Database and authentication: Supabase, where order, account and lead records are stored.
• Delivery and logistics: the carriers that ship and track your parcels worldwide.
• Email and communications: the providers we use to send order, support and service messages.
• Professional advisers and authorities where required by law.

We do not sell your personal data.

6. International transfers

Some processors are located outside the United Kingdom and European Economic Area, including the United States. Where data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or equivalent adequacy mechanisms.

7. How long we keep it

• Order and transaction records: retained as required for tax and accounting, typically up to 7 years.
• Account and subscription data: for as long as your account is active, then deleted or anonymised.
• Marketing lead and enquiry data: retained for up to 24 months from your last interaction, then deleted.
• Cookies and analytics data: retained per the periods described in our cookie policy.

8. Your rights (UK GDPR & EU GDPR)

Subject to law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data ('right to be forgotten').
• Restrict or object to certain processing, including direct marketing.
• Data portability, to receive your data in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any right, email support@javeasso.shop. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to your local EU supervisory authority.

9. California rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as defined by the CCPA. To make a request, email support@javeasso.shop. We will not discriminate against you for exercising your rights.

10. Do Not Sell or Share

We do not sell or share your personal information for cross-context behavioural advertising. No action is needed to opt out, but you may still email us to confirm your preferences.

11. Cookies and analytics

We use essential cookies to run the store (such as your cart and admin session) and, with your consent where required, limited analytics to understand site usage. See our cookie policy for details and controls.

12. Automated decisions and children

The Flavour Finder generates kit suggestions from the answers you provide; it produces recommendations only and does not make decisions with legal or similarly significant effects. See our AI disclaimer. Our products are not directed at children. The site is not intended for anyone under 13, and customers aged 13–17 must have a guardian's consent to order.

13. Security

We use encryption in transit, access controls and reputable processors to protect your data. Payment details are handled by Stripe on PCI-compliant systems. No method of transmission is fully secure, but we take reasonable measures to protect your information.

14. How to contact us

JAVED ASSOCIATES LIMITED, 83-85 Cambridge Street Cowcaddens, G3 6RU, United Kingdom. Email support@javeasso.shop, phone +44 7103071710. This policy is governed by the laws of England and Wales.