Privacy Policy

HSL BUILDING SERVICES LIMITED, trading as Hearthfold("we", "us"), is the data controller for personal data processed through hslbuiser.shop. You can reach us at 8 Lomond Crescent Bridge Of Weir, PA11 3HJ, by email at support@hslbuiser.shop or by phone at +44 7255122987.

We sell physical home soft furnishings, decor and storage sets to consumers worldwide, priced and charged in USD.

• Order and delivery data: name, shipping and billing address, email, phone, the items you buy and order history.
• Account and membership data: login details, membership tier, subscription status and preferences.
• Payment data: the last digits and card type as returned by our payment processor. We never receive or store your full card number, CVC or expiry.
• Support and lead data: messages you send us via the contact form and the Room Finisher save-my-plan form, including any room notes.
• Room Finisher inputs: the room, vibe, drill preference and budget you select, and any room photo you optionally upload as a composition reference.
• Technical and usage data: IP address, device and browser type, and pages viewed, collected via cookies and similar technologies.

We collect personal data from the following sources:

• Directly from you — when you shop, create an account, subscribe to a membership, use the Room Finisher, or contact us.
• Automatically from your device — via cookies and similar technologies as you browse.
• From our processors — for example payment confirmations from Stripe and delivery status updates from our carriers and fulfilment partners.

• To fulfil your order and subscription — process payment, ship goods, manage returns (performance of a contract).
• To provide accounts, membership benefits and the Room Finisher (contract and legitimate interests).
• To respond to support requests and saved plans (legitimate interests / consent).
• To send marketing where you have opted in (consent) — you can withdraw at any time.
• To keep the site secure and prevent fraud (legitimate interests and legal obligation).
• To meet tax, accounting and consumer-law duties (legal obligation).

We share personal data only with processors that help us run the store, under contract and only as needed:

• Payments: Stripe, Inc. and its regulated payment partners process card payments and subscriptions.
• Hosting & infrastructure: Vercel Inc. hosts the website and serverless functions.
• Database & storage: Supabase for order, account, membership and lead records, and Room Finisher uploads.
• Delivery: the shipping carriers and fulfilment partners that deliver your parcels.
• Email: transactional and marketing email providers for order and account messages.

We do not sell your personal data. We may disclose data where required by law.

Some processors are located outside the UK/EEA (for example in the United States). Where data is transferred internationally we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum, the EU Standard Contractual Clauses, or an adequacy decision, so your data stays protected.

Order and transaction records are kept for as long as needed to fulfil the order and to meet tax and accounting obligations (generally up to 6–7 years). Account and membership data is kept while your account is active and for a reasonable period afterwards. Support and lead data, including Room Finisher inputs and any uploaded room photo, is kept only as long as needed to help you, and uploaded photos are deleted once the styling plan is delivered or on request.

Depending on where you live, you may have the right to:

• access, correct or delete your personal data;
• restrict or object to processing, and to data portability;
• withdraw consent at any time;
• opt out of marketing;
• (California) know what we collect, request deletion, and not be discriminated against for exercising your rights;
• lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office).

To exercise any right, email support@hslbuiser.shop. We respond within the timeframes required by law.

We do not sell or "share" personal information as those terms are defined under the California Consumer Privacy Act, and we do not process personal data for cross-context behavioural advertising. California residents can still submit a request to support@hslbuiser.shop and we will honour it.

We use strictly necessary cookies to run the cart and checkout, and optional analytics cookies to understand how the site is used. You can control non-essential cookies through your browser and our cookie controls. See our Cookie Policy for details.

The Room Finisher produces informational styling suggestions only; it does not make decisions that produce legal or similarly significant effects about you. Our store is not intended for children: it is not for use by anyone under 13, and shoppers aged 13–17 must have a parent or guardian's consent to place an order. We do not knowingly collect data from children under 13.

Order fulfilment: to fulfil and deliver your order we process your name, delivery and billing address, email, phone, the items purchased and order status, and we share the delivery details with our carriers and fulfilment partners strictly to complete delivery of your physical goods.

Returns and exchanges are handled by our support team, who process the order and address details needed to arrange a collection or replacement. Billing and payment-status data is processed by Stripe during order fulfilment; we retain only the order total, currency (USD) and payment status, never full card details.

We use encryption in transit (HTTPS), access controls and reputable processors to protect your data. Payment card data is handled entirely within Stripe's PCI-DSS environment. No method of transmission is perfectly secure, but we work to protect your information and to notify you and the regulator where the law requires it.

Questions or complaints about privacy? Email support@hslbuiser.shop or write to HSL BUILDING SERVICES LIMITED, 8 Lomond Crescent Bridge Of Weir, PA11 3HJ. UK residents may also complain to the Information Commissioner's Office; EU residents to their local data protection authority.