This page describes what LUBU Skincare (“LUBU”, “we”) actually collects on lubuderma.com, why, and how you can control it. It's written to match what the site genuinely does — not a generic template — and it will be updated if that changes.
The short version
- We use cookies/local storage for your cart, sign-in, and — only if you say yes in the cookie banner — Google Analytics and Meta (Facebook/Instagram) ads measurement.
- Nothing you type into a form (name, phone, address) is ever sent to our analytics tools. See “What analytics never receives” below for exactly what that means in practice.
- Your order details (name, phone, delivery address) go to our order and delivery systems — that's separate from analytics and is how your order actually gets to you.
- You can change your analytics choice at any time — see “Your choices” below.
Information we collect
Information you give us directly
When you place an order, sign in, or contact us, you give us things like your name, phone number, delivery address, and order details. This is handled by our order-processing and delivery systems to fulfil your order and isn't sent to Google Analytics or Meta Pixel — those tools never see your name, phone number, email, or address, by design (see the next section for exactly why that's a structural guarantee, not just a policy).
Information collected automatically — only with your consent
If you accept cookies in the banner, we use:
- Google Analytics (GA4) — which pages you view, what you add to cart, search terms you use on the site, and whether an order completed. Standard GA4 cookies/identifiers apply, set by Google.
- Meta Pixel — similar browsing/purchase-intent signals, used to measure the performance of our ads on Facebook/Instagram. Also sent to Meta's servers directly (Conversions API) using a hashed, one-way version of your email/phone if you're signed in — never the plain value.
If you decline, neither of these loads at all — not a reduced version, not loaded-but-disabled. The scripts themselves never load in your browser.
What analytics never receives
This isn't just a policy promise — it's how the code is actually built. The functions that send data to Google Analytics only accept a product ID, product name, price, and quantity (for shopping events), or a fixed category label (for things like “this form field failed validation” or “this payment attempt failed”). There is no field in that code for your name, phone number, email, address, or anything you type into the checkout form — so there's no way for that information to reach analytics even by accident.
Local storage on your device
We use your browser's local storage (not a server database) to remember your cart contents, whether you're signed in, and your cookie choice from the banner. This stays on your device and is never transmitted to us as a dataset — it's how the site remembers your cart between page loads.
Who we share information with
- Payment processing — Razorpay, to process online payments. We don't see or store your card/UPI details; Razorpay handles that directly.
- Order fulfilment — our order-management and delivery partners, to get your order to you.
- Google Analytics / Meta — only the non-identifying browsing/purchase-event data described above, and only if you've accepted cookies.
We don't sell personal information to third parties.
Your choices
You can change your cookie/analytics choice at any time:
This reopens the same banner from your first visit, where you can accept or decline again — your new choice takes effect immediately, same as the first time.
Questions
Write to care@lubuderma.com with any question about this policy or your data.
Items pending legal review
This page describes our actual technical practices accurately, but it is not a substitute for legal review. The following need sign-off from LUBU's own legal counsel before this page should be treated as a complete, compliant policy:
- Specific data-retention periods for order and account data.
- Formal rights language under India's Digital Personal Data Protection Act, 2023 (access, correction, erasure requests, and the grievance-officer contact it requires).
- Any requirement specific to shipping to Vietnam, if different from India-only data-protection obligations.
- Cross-border data transfer language, given Google/Meta/Razorpay may process data outside India.