Privacy Policy

Last updated: July 19, 2026

1. Information We Collect

When you use Luna & Stone, we may collect:

  • Personal Information: Name, email address, shipping address, and phone number when you place an order or subscribe to our newsletter.
  • Payment Information: Credit card details and billing address. Payments are processed securely through Stripe — we never store full card numbers on our servers.
  • Usage Data: Pages visited, time on site, and referring URLs via Google Analytics. This data is anonymized and aggregated.
  • Communication Data: Messages sent through our contact form or customer service emails.

2. How We Use Your Data

  • To process and fulfill your orders, including shipping and returns.
  • To communicate with you about your order status, inquiries, and customer support.
  • To send marketing emails (only with your explicit consent). You can unsubscribe at any time via the link in every email.
  • To improve our website and product offerings through analytics and customer feedback.
  • To comply with legal obligations, prevent fraud, and enforce our Terms of Service.

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and United Kingdom, we rely on the following legal bases:

  • Contractual necessity: To fulfill your orders and provide our services.
  • Consent: For marketing emails and non-essential cookies. You may withdraw consent at any time.
  • Legitimate interests: For analytics, fraud prevention, and improving our services.
  • Legal obligation: To comply with applicable laws and regulatory requirements.

4. Data Sharing & Third Parties

We share your data only as necessary to operate our business:

  • Stripe: Payment processing. Stripe's privacy policy applies to payment data they handle.
  • Shipping carriers: USPS, UPS, or other carriers receive your name and shipping address to deliver your order.
  • Google Analytics: Anonymized usage data for website analytics. No personally identifiable information is shared.
  • Legal authorities: When required by law, court order, or to protect our legal rights.

We never sell, rent, or trade your personal data to third parties for their marketing purposes.

5. Data Retention

  • Order data: Retained for 7 years for tax and accounting purposes.
  • Marketing data: Retained until you unsubscribe or withdraw consent.
  • Analytics data: Anonymized data retained indefinitely for trend analysis.
  • Contact form messages: Retained for 2 years for customer service continuity.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Correct inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data ("right to be forgotten").
  • Portability: Receive your data in a structured, machine-readable format.
  • Objection: Object to processing based on legitimate interests or direct marketing.
  • Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email us at privacy@cngreentk.com. We will respond within 30 days.

7. Cookies

We use essential cookies for site functionality (shopping cart, checkout) and analytics cookies (Google Analytics) to understand how visitors use our site. Analytics cookies are only set with your consent. You can manage cookie preferences in your browser settings.

8. Data Security

We implement industry-standard security measures to protect your data, including SSL/TLS encryption for all data in transit, secure server infrastructure, and restricted access controls. However, no method of transmission over the Internet is 100% secure — we cannot guarantee absolute security.

9. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. International Data Transfers

Your data is stored and processed on servers located in the United States. If you are accessing our services from outside the US, your data may be transferred to and processed in the US. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email or a prominent notice on our website. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact Us

For questions about this privacy policy or to exercise your data rights: