Privacy Policy

1. Who is responsible for your data

SleePyllow is the seller operating this website and is responsible for the personal data described here. Our contact details are listed at the bottom of this page.

This policy explains what we collect, why, and what you can ask us to do about it. It only covers this website and our shop. Payment card details are entered on the payment provider's hosted checkout page, not on this site.

2. What we collect

• Contact form: the name, email address, optional phone number, subject and message you enter, plus the fact that you ticked the consent box.
• Discount code popup: the email address you enter, so we can issue your code, and whether you separately opted in to occasional offers.
• Orders: the product, quantity and total of your order. Name, email and delivery address are collected on the payment provider's checkout page; we receive the order details we need to prepare and follow up your purchase.
• Technical data: standard server and security logs kept by our website platform, which can include IP address and browser type, used to run the site and prevent abuse.
• Choices in your browser: your cookie choice and your shopping cart. These are stored on your device (see the Cookie Policy).

3. What we do not do

• We do not store your card details.
• We do not sell your personal data.
• We do not build advertising profiles, and no advertising pixels are installed on this site.
• We do not send marketing emails to anyone who has not opted in.

4. Why we use it and on what basis

• To take payment, confirm and fulfil your order, and handle returns — necessary to perform our contract with you.
• To answer your enquiry or complaint — our legitimate interest in supporting customers, or your request itself.
• To keep the site secure and prevent spam or fraud — our legitimate interest in protecting the shop.
• To count anonymous interaction events (for example a checkout being started) — only with your consent, which you can withdraw at any time.
• To contact you about offers — only with your separate, optional consent.
• To keep order and tax records — to comply with our legal obligations.

5. Who else is involved

We keep the list of suppliers short and only share what each one needs:

• Base44 — the platform that hosts this website and stores contact and order records.
• Base44 Payments (Wix Payments) — processes your payment on its hosted checkout page and handles card data.
• Google Fonts — delivers the fonts used on this site, which means your browser contacts Google's servers.
• Our email provider — delivers and receives the messages you send us.

Some of these providers may process data outside your country. Where that happens, transfers rely on the safeguards those providers have in place under their own terms.

6. How long we keep it

We keep each item only for as long as we need it for the purpose it was collected, or for as long as the law requires. Enquiries are kept while the conversation and any follow-up are open; order and payment records are kept for the accounting period required by law; your marketing preference is kept until you withdraw it.

If you would like to know how long a specific item will be kept, ask us and we will tell you.

7. Your rights

Depending on where you live, you can ask us to show you the data we hold about you, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. You can withdraw consent at any time, and withdrawing it does not affect anything done before that.

To make a request, use the process on our Your data page. You can also complain to your local data protection authority; we would appreciate the chance to sort things out first.

8. Security

The site is served over HTTPS. Access to customer records is limited to the shop administrator, and contact and order data is written by our own server-side functions rather than directly from the browser. No system is perfectly secure, but we take these steps to reduce risk.

9. Children

This shop is intended for adults. We do not knowingly collect personal data from children, and we do not ask for a date of birth. If you believe a child has sent us personal data, contact us and we will delete it.

10. Changes to this policy

If we change how we handle personal data, we will update this page and the date at the top. Where a change materially affects you, we will make it clear on the site.