Privacy Policy

Jeweliful is a wholesale jewelry platform operated by B.F Entreprises, whose registered office is at [REGISTERED ADDRESS]. In this policy, “Jeweliful”, “we”, “us” and “our” mean that company.

This policy covers the jeweliful.com website, the Jeweliful merchant dashboard, and the Jeweliful app you install on your store. It explains what personal information we handle, why, who we give it to, how long we keep it, and what you can ask us to do about it.

What the service does, so that the rest of this policy has something concrete to attach to: you choose pieces from our catalog, set your own retail prices, and publish them to the store you already sell from. When one of your customers buys one, the order comes to us, we make the piece, we put your branding on the packaging, and we ship it to your customer. We then write the tracking number back to your store. That round trip is the only reason we ever see anyone’s address.

It does not cover the websites of other companies we link to, or your own store. When one of your customers buys from you, your privacy notice applies to that sale, not ours.

Data protection law separates the party who decides what happens to personal information from the party who only follows instructions. We are each of those, for different information, at the same time.

For information about you and your business, we are the controller. We decided to collect it, we decided what it is for, and we answer for it. Sections 3 and 5 to 17 of this policy are about that information.

For information about the people who buy from you, you are the controller and we are your processor (in California, your service provider). We receive that information because you sent us an order to fulfil, and we use it only to fulfil it. Section 4 says what that means in practice.

The distinction is not decoration. It decides who a buyer asks when they want their data, who has to answer them, and what we are allowed to do without being told. If we ever started using buyers’ data for a purpose of our own, we would become a controller of it and this policy would have to change. We have designed the service so that does not happen, and section 4 states it as a commitment.

Almost all of it comes from you, when you open an account, set up your brand, place an order or write to us. A small amount is generated automatically as you use the service, and some comes from the store platform you connect (for example, the shop domain and the store name).

We send account and service email: order and payment notices, statements, security messages, and answers to your support requests. We do not send marketing email, and we do not pass your details to anyone who would.

Where we rely on legitimate interests, we have weighed our interest against your rights, and we have written down which interest applies against each purpose in the table above. You can object to any of it: see section 10.

When a sale reaches us from your store, or when you place an order by hand, we receive what a parcel needs. We are your processor for all of it, and the Data Processing Terms are the contract that governs it.

We give personal information to the companies below, and to nobody else except as described at the end of this section. Each of them works on our instructions, under a contract, and for the single purpose named.

One of them is not only our service provider. Stripe also decides some things for itself, for fraud prevention and for the rules the card networks impose on it, and for that part of the processing it is a controller in its own right under its own privacy policy at stripe.com/privacy. We name it here rather than let it sit inside a row, because a second decision-maker in the chain is exactly the kind of thing a reader is entitled to be told about plainly.

We also disclose personal information:

1. (a)to our professional advisers (accountants, auditors, lawyers and insurers) where they need it to advise us, and under a duty of confidence;
2. (b)where the law requires it, or where we must establish, exercise or defend a legal claim, in which case we disclose only what is needed and tell you unless we are forbidden to;
3. (c)to a buyer of the business, or of the part of it that runs this service, if it is ever sold, in which case the information continues to be used for the purposes described here.

We operate from Israel. The application and the database run on providers in the United States and, for the database, in the region we have configured with a provider incorporated in Singapore. Finished orders are produced and posted in the United States. The table in section 5 names each provider and the country it contracts from.

Depending on where you are, that may be a transfer of personal information out of the United Kingdom or the European Economic Area. Where it is, we rely on a mechanism the relevant law recognises. For transfers to Israel that is an adequacy decision, which is in force today. For a destination not covered by one, it is the European Commission’s standard contractual clauses, together with the United Kingdom international data transfer addendum where UK law applies, and with the adaptations the Swiss authority requires where Swiss law applies.

We do not print a list of adequate countries here, because the list changes and a stale list is worse than none. You can ask us for a copy of the safeguards that apply to a particular transfer, using the contact details in section 17.

We do not keep personal information for longer than the purpose it was collected for needs. In practice that means:

Some of this runs on a schedule: aged records that no longer serve a purpose are deleted automatically, and that schedule is suspended in full while any security incident or legal hold is open, so that evidence cannot be swept away while it is needed.

We keep technical and organisational measures appropriate to the risk. These are the current ones:

• Encryption in transit. Every connection to the service, and every connection from it to a provider, runs over TLS.
• Encryption at rest. The database and the file storage encrypt their contents with AES-256.
• A second layer over the keys to a merchant's store. The access tokens that let us read a connected store are encrypted field by field with a rotating key, on top of the storage encryption.
• Personal data is stripped from logs before they are written, and error reporting is configured to send none.
• An access log over end-customer data. Every read or export by our staff, and every send to our shipping provider, is recorded with who, what, why and when.
• Least privilege. Every route in the application is permission-guarded by construction, staff accounts exist only by invitation, and the ability to move money is narrower than the ability to fulfil an order.
• Separation of test and production. Development and preview environments run on their own databases and never receive production data.
• Retention limits that run on a schedule, with a hold switch that suspends every one of them while an incident is open.
• A written security incident response policy with severity levels, containment runbooks and notification duties.

No system is perfect, and we would rather say what we do than promise what nobody can. If something goes wrong, we have a written incident response policy with severity levels, containment steps and notification duties, and we follow it.

Where the United Kingdom or European Union data protection law applies, you have the following rights over the information we hold about you as controller. Most of them are not absolute, and we will tell you plainly if an exception applies rather than simply declining.

1. (a)Access. Ask us for a copy of the personal information we hold about you, and for an explanation of what we do with it.
2. (b)Rectification. Have information that is wrong corrected, and information that is incomplete completed.
3. (c)Erasure. Ask us to delete information, where we no longer need it for the purpose we collected it for.
4. (d)Restriction. Ask us to stop using information while a dispute about its accuracy or our use of it is resolved.
5. (e)Portability. Receive the information you gave us in a structured, commonly used, machine-readable form, or have us send it to someone else where that is technically possible.
6. (f)Objection. Object to processing we do on the basis of legitimate interests. Section 10 sets this out on its own.
7. (g)Withdrawal of consent. Where we rely on your consent for something, withdraw it at any time. Withdrawing it does not undo what was done while it was in force.
8. (h)Automated decisions. Not be subject to a decision based solely on automated processing that produces legal effects for you or similarly significantly affects you. Section 13 explains why this does not arise here.

To use any of them, write to privacy@jeweliful.com. We answer within one month, and we will tell you within that month if a request is complex enough to need longer. We may need to check who you are before we act, and we will ask for no more than we need in order to do that. There is no charge, unless a request is manifestly unfounded or excessive, in which case we will explain why before doing anything.

If your request is about information one of your customers gave you, send it to us as the merchant on that account, and see section 4.

If you think we have handled your personal information badly, please tell us first at privacy@jeweliful.com, so that we get the chance to put it right.

You also have the right to complain to a data protection supervisory authority, and doing so does not depend on asking us first. In the United Kingdom that is the Information Commissioner’s Office (ico.org.uk). In the European Economic Area it is the authority for the country you live in, work in, or where you think the problem happened; the European Data Protection Board publishes the list of them.

We use no advertising cookies, no advertising pixels and no cross-site trackers. The cookies we set are the ones the service needs in order to work:

We also use Vercel Web Analytics to count page views and see which pages of our own site are used. It is operated by Vercel on our behalf and reports traffic in aggregate. It has no interface that would let us look up what a named person did, and we do not try to build one.

We make no decision about you, and none about your customers, that is based solely on automated processing and that produces a legal effect or similarly significantly affects anyone.

The service does raise an automatic flag when a merchant account’s payment standing needs attention. That flag suspends nothing by itself. Any decision to restrict an account is taken by a person, who looks at the account first, and you can ask us to explain and to reconsider.

This is a service for businesses. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to privacy@jeweliful.com and we will delete it.

For the personal information of your customers that reaches us through an order, we act as your service provider under the California Consumer Privacy Act. We do not sell or share that information, we use it only for the business purposes set out in the Data Processing Terms, we do not use or disclose it outside our business relationship with you, and we do not combine it with personal information from any other source. Those undertakings are written out in full in section 14 of the Data Processing Terms.

For your own account information, we do not sell or share it either. The categories we collect and the purposes we collect them for are in section 3, who receives them is in section 5, and how long we keep them is in section 7. To make a request about it, write to privacy@jeweliful.com. We will not treat you differently for exercising a privacy right.

When this policy changes, we change the date printed at the top of it. If a change matters to you, for example a new purpose or a new recipient, we will tell account holders before it takes effect rather than leave it to be discovered.

For anything in this policy, including a request about your own information, write to privacy@jeweliful.com, or to B.F Entreprises at [REGISTERED ADDRESS].