Overview
CeleBrease, Inc. (“CeleBrease,” “we,” “our,” or “us”) operates the CeleBrease website and holiday decoration rental subscription service (the “Service”). This Privacy Policy explains what personal information we collect, how we use it, when we share it, and what choices you have.
By subscribing to or using our Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please do not use our Service.
This Policy applies to information collected through our website at celebrease.com, our mobile-optimized web app, email communications, and any other means by which you interact with CeleBrease.
Information We Collect
We collect information you give us directly, information we receive automatically when you use our Service, and information from third party partners.
Information you provide directly
- Account information: name, email address, phone number, and password when you create an account.
- Delivery & billing details: shipping address, billing address, and payment card information (processed securely through Stripe, we never store your full card number).
- Subscription preferences: which holidays you select, kit tier preferences, rental duration, and any add ons you choose.
- Communications: messages you send us via contact forms, support requests, or email, including feedback and reviews you submit.
- Newsletter opt in: your email address if you subscribe to seasonal inspiration updates.
Information collected automatically
- Usage data: pages viewed, links clicked, time on page, scroll depth, and navigation paths.
- Device & technical data: IP address, browser type and version, operating system, device identifiers, and referring URLs.
- Cookies and similar tracking technologies: session cookies, preference cookies, and analytics cookies (detailed in Section 5).
- Location data: approximate location derived from your IP address to provide region appropriate shipping options and holiday timing.
Information from third parties
- Payment processors: Stripe provides us with transaction confirmations, payment status, and fraud signals, but never your full card details.
- Authentication providers: if you sign in with Google or Apple, we receive your name, email, and profile photo from that provider.
- Shipping carriers: tracking updates and delivery confirmation from our logistics partners.
How We Use Your Information
We use the information we collect to operate the Service, improve it, and communicate with you. The specific purposes are:
| Purpose | Legal basis |
|---|---|
| Processing your subscription, rental orders, deposits, and refunds | Contract performance |
| Scheduling kit delivery and pickup logistics | Contract performance |
| Sending order confirmations, shipping updates, and deposit refund notices | Contract performance |
| Detecting fraud, preventing chargebacks, and verifying payment | Legitimate interest / Legal obligation |
| Personalising holiday recommendations based on your past rentals | Legitimate interest (you can opt out) |
| Sending promotional emails and seasonal inspiration (newsletter) | Consent (opt in only; unsubscribe anytime) |
| Analysing usage to improve product design and kit curation | Legitimate interest |
| Complying with applicable law and responding to legal requests | Legal obligation |
We do not use your information to train external AI models, and we do not sell it for advertising purposes.
Sharing & Disclosure
We do not sell, rent, or trade your personal information. We share it only in the limited circumstances below:
- Service providers: trusted vendors who help us operate, Stripe (payments), our logistics carrier partners (shipping), Brevo (newsletter delivery), and our cloud infrastructure provider. Each is bound by a data processing agreement and may use your data only to perform services for us.
- Kit deposit protection: where required to assess damage claims, we may share order details with our fulfilment partners.
- Legal requirements: we may disclose information if required by law, court order, or to protect the rights, property, or safety of CeleBrease, our customers, or the public.
- Business transfers: if CeleBrease is acquired, merged, or sells substantially all of its assets, your data may transfer as part of that transaction. We will notify you by email before any such transfer takes effect and you will be given the opportunity to delete your account.
- With your consent: for any other purpose, only with your explicit prior consent.
Cookies & Tracking Technologies
We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how customers use our site. Here is what we use and why:
| Category | Purpose | Can you opt out? |
|---|---|---|
| Essential | Session authentication, shopping cart state, CSRF protection | No, required to use the Service |
| Functional | Remembering your holiday preferences and region | Yes, via account settings |
| Analytics | Understanding page performance and navigation patterns (anonymised) | Yes, via cookie banner or browser settings |
We do not use advertising or cross-site tracking cookies. You can manage cookie preferences through your browser settings at any time. Note that disabling essential cookies will prevent you from signing in or completing a rental.
Data Retention
We retain your personal information for as long as your account is active or as needed to provide the Service. Specific retention periods:
- Account data: kept for the life of your account plus 30 days after deletion, to allow for accidental deletion recovery.
- Order and transaction records: retained for 7 years to satisfy financial, tax, and legal audit requirements.
- Deposit records: retained for 3 years after the final deposit is settled.
- Support communications: retained for 2 years after the conversation closes.
- Newsletter / marketing preferences: retained until you unsubscribe or request deletion.
- Analytics data: aggregated and anonymised after 13 months; no individual level retention beyond that point.
When data is no longer needed, we securely delete or anonymise it in accordance with industry-standard practices.
Your Rights & Choices
Depending on where you live, you may have the following rights with respect to your personal information. We honour all of these requests regardless of your location:
- Access: request a copy of the personal data we hold about you.
- Correction: ask us to fix inaccurate or incomplete information in your account.
- Deletion: request that we delete your account and associated personal data (subject to our legal retention obligations above).
- Portability: receive your data in a machine readable format (JSON or CSV) to transfer to another service.
- Restriction: ask us to stop processing your data in certain ways without deleting it.
- Objection: object to processing based on legitimate interests, including personalised recommendations.
- Withdrawal of consent: unsubscribe from marketing at any time via the link in any email or by updating your account settings. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
To exercise any of these rights, email us at privacy@celebrease.com or use the privacy controls in your account dashboard. We will respond within 30 days. We may need to verify your identity before fulfilling the request.
Children's Privacy
The CeleBrease Service is intended for individuals who are 18 years of age or older. We do not knowingly collect, solicit, or retain personal information from anyone under the age of 13.
If we discover that we have inadvertently collected personal information from a child under 13, we will delete it promptly. If you believe we may have collected information from a child under your care, please contact us at privacy@celebrease.com immediately.
Security
We take the security of your personal information seriously and implement technical and organisational measures to protect it against unauthorised access, loss, or misuse. These measures include:
- TLS encryption for all data in transit between your browser and our servers.
- Payment card data is processed entirely by Stripe (PCI DSS Level 1 compliant), CeleBrease never touches or stores raw card numbers.
- Passwords are stored using a strong one way hash (bcrypt). We cannot recover your plain text password.
- Access to production databases is restricted to authorised personnel and logged.
- Regular security audits and dependency vulnerability scanning.
However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security. If you suspect unauthorised access to your account, contact us immediately at security@celebrease.com.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we do, we will:
- Update the “Last updated” date at the top of this page.
- Email all registered subscribers at least 14 days before material changes take effect.
- Display a prominent notice on our website for 30 days after a material change.
Your continued use of the Service after the effective date of any updated Policy constitutes your acceptance of the changes. If you do not agree to a material change, you may close your account before the effective date and request deletion of your data.
Previous versions of this Policy are available on request by emailing privacy@celebrease.com.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please reach out to our Privacy team:
- Email: privacy@celebrease.com
- Response time: We aim to respond within 5 business days; legally required requests are completed within 30 days.
- Mailing address: CeleBrease, Inc. · Privacy Team · [Address on file at launch]