Privacy Policy
What we hold, why we hold it, who else sees it, and how to get it back or have it taken away. Written to be read rather than clicked past.
Last updated: 31 October 2026 · Effective: 31 October 2026
Who we are
3rd Eye Supply is a sole proprietorship run out of Las Vegas, Nevada, in the United States. We sell metaphysical goods — crystals, curios, and the supplies that go with them — and ship to customers in the United States and the European Union.
Under the EU General Data Protection Regulation and the UK GDPR we are the data controller for the personal data described here. That means we decide what is collected and why, and we answer for it.
- Legal entity: 3rd Eye Supply, sole proprietorship (Las Vegas, Nevada)
- Business address: [FILL: street address], Las Vegas, Nevada [FILL: ZIP], United States
- Privacy contact: support@3rdeyesupply.com
- EU representative (GDPR Article 27): [FILL: name and EU address, or a note that none is appointed and why]
- UK representative (UK GDPR Article 27): [FILL: name and UK address, or a note that none is appointed and why]
- Data Protection Officer: none appointed. We are a one-person business and the GDPR reserves that role for specific situations. Privacy questions reach the owner directly, at the address above.
What this policy covers
This policy covers the storefront at [FILL: domain], including browsing, creating an account, placing orders, and using the Oracle. It does not cover other companies’ sites, and it does not cover the payment page once you are handed to Stripe, which runs under its own privacy notice.
The data we hold
We try to hold as little as the shop can run on. Here is all of it.
- Account details. Your email address and password. The password is stored as a one-way hash — we cannot read it, and neither can anyone who gets into the database.
- Phone number, if you give one. Optional, and only used so you can sign in with a one-time SMS code instead of a password. Skip it and nothing changes.
- Addresses. The shipping address you ask us to send to, and the billing address your card issuer checks against. Saved to your account so you do not retype them.
- Order history. What you bought, when, what it cost, and where it went — including tracking and delivery status, which comes back to us from the fulfilment partner.
- Cart and session. What is in your cart, the identifier that ties it to your browser, the token that keeps you signed in, and your locale and region choices. All carried in cookies — the table below lists them by name.
- Oracle conversations. The messages you send to the Oracle, the replies it gives, and a profile we build from them (see The Oracle, and what it infers below).
- Analytics events. Pages viewed, buttons used, device and browser type, referring page, and an approximate location derived from your IP address. Used to see which parts of the shop are confusing.
- Support correspondence. Emails you send us, and our replies.
We never see your card number. It goes straight to Stripe and stays there; we receive only the last four digits, the brand, and whether the charge succeeded.
If you give us someone else’s details — a gift sent to a friend, for instance — please make sure they are happy for you to hand them over.
Why we hold it, and on what legal ground
Every purpose below has a lawful basis under GDPR Article 6. We do not process personal data without one, and we do not quietly use data for a purpose that is not listed here.
| What we do | Data involved | Lawful basis |
|---|---|---|
| Create your account and sign you in | Email, password hash, optional phone | Contract — Art. 6(1)(b) |
| Send one-time SMS sign-in codes | Phone number, code issue time | Contract — you asked for this way of signing in |
| Take payment and screen for fraud | Name, email, billing address, order total, IP address | Contract; legitimate interests for fraud prevention |
| Pack and ship your order | Name, shipping address, phone for the carrier, order contents | Contract — Art. 6(1)(b) |
| Send order emails — receipt, dispatch, delivery | Email address, order details | Contract |
| Handle returns, refunds, and chargebacks | Order history, correspondence, refund records | Contract; legal obligation for accounting records |
| Keep tax and accounting records | Invoices, amounts, addresses, dates | Legal obligation — Art. 6(1)(c) |
| Run Oracle conversations | Messages you send, replies, your account identifier | Contract — the Oracle is a members-only feature you ask for |
| Keep the profile built from those conversations | Extracted preferences and interests, not the transcript | Legitimate interests — so a later reading picks up where the last one stopped. [FILL: confirm this is the basis we will defend, and record the assessment] |
| Answer product searches | Search terms; catalogue text | Contract; legitimate interests for running the shop’s search |
| Measure and improve the shop | Pages viewed, events, device, browser, IP-derived location | Consent for non-essential cookies in the EU/UK; legitimate interests for aggregate measurement elsewhere |
| Keep the shop secure and stop abuse | Session data, IP address, request logs, rate-limit counters | Legitimate interests — Art. 6(1)(f) |
| Send marketing email, if we ever do | Email address, order history | Consent only — Art. 6(1)(a). [FILL: confirm whether any marketing email is sent today] |
| Establish or defend a legal claim | Whatever the claim requires | Legitimate interests; legal obligation |
Where we lean on legitimate interests we have weighed our need against yours and written the reasoning down [FILL: confirm the assessment exists and where it is kept]. You can object to that processing at any time, and we will stop unless we have a compelling reason to continue.
Where we rely on consent, you can withdraw it as easily as you gave it. Withdrawal stops the processing from that point; it does not undo what happened while consent was in place.
Cookies
Cookies are small files the shop leaves in your browser. We use a handful, and only these.
| Cookie | What it does | Category | Lasts |
|---|---|---|---|
_medusa_cart_id | Keeps your cart attached to your browser between pages | Strictly necessary | [FILL: duration] |
_medusa_jwt | Keeps you signed in; holds a signed session token, not your password | Strictly necessary | [FILL: duration] |
_medusa_cache_id | Lets served pages be cached per visitor so one person’s cart never appears in another’s page | Strictly necessary | [FILL: duration] |
_medusa_locale | Remembers the language and region you chose | Functional / preference | [FILL: duration] |
ph_* (PostHog) | Tells us, anonymously where possible, which pages and features get used | Analytics — set only if you accept | [FILL: duration] |
The first four are set without asking, because sign-in and checkout do not work without them. Analytics cookies are set only if you accept them in the consent banner — declining, or never answering, means no analytics runs at all. We do not use advertising cookies, cross-site tracking, or advertising profiles.
You can block or delete cookies in your browser. Blocking the strictly necessary ones will break signing in and checking out.
Who else sees your data
We are a small shop and we do not run our own infrastructure. The companies below process data on our instructions, under written contracts that limit them to that job.
| Processor | What they do | What they receive | Where |
|---|---|---|---|
| Stripe | Takes payment, issues receipts, screens for card fraud | Name, email, billing address, order total, IP address; card details go to Stripe directly | United States and Ireland [FILL: confirm the contracting entity and data region] |
| CJ Dropshipping | Fulfils and dispatches your order | Recipient name, shipping address, phone where the carrier needs it, order contents | [FILL: confirm company and storage location, and whether any warehouse is outside the US/EU] |
| [FILL: Resend or the SMTP provider] | Delivers transactional email — receipts, dispatch notices, password resets | Email address, the contents of the message | United States [FILL: confirm] |
| Twilio | Delivers SMS one-time sign-in codes | Phone number, the code message | United States |
| PostHog | Product analytics — which pages and features are used | Events, pages, browser and device, IP-derived location, a pseudonymous identifier | United States (US Cloud) |
| Hostinger | Hosts the virtual server that runs the shop, its Postgres database, and Redis | Everything the database holds — account, order, and Oracle data | [FILL: confirm the VPS datacentre country] |
| DeepSeek | Runs the Oracle’s language model, and the extraction step that turns a conversation into a profile | The text of your Oracle messages and the replies; we do not send your address or payment data | China |
| Voyage AI | Embeds catalogue text so search can match meaning, not just spelling | Product catalogue text [FILL: confirm whether customer search queries are also sent] | United States |
Beyond those, we share data only: with professional advisers, such as an accountant, who are bound by their own duties of confidence; with a court or law-enforcement body where the law actually requires it; and with a buyer, in the unlikely event the business is sold — in which case your data would move with it and you would be told before anything changed.
We do not sell your personal data. We do not hand it to data brokers, and we do not share it for cross-context behavioural advertising.
The Oracle, and what it infers
The Oracle is a member-only conversation counter. It is the one place on this site where we do something that deserves its own paragraph rather than a table row, because it involves inference — and inference is where privacy gets interesting.
What happens. You write a message. We send it to a language model, which writes back. Your conversation is saved to your account so the next reading can pick up where the last one stopped. Separately, a second pass distils the conversation into a short profile — the kinds of things you are drawn to, what you asked about, what you dismissed — and stores that in our database alongside your account.
Why we are telling you this. A profile built by a machine, kept across sessions, is profiling in the legal sense. It can be wrong. It can record an impression rather than a fact, and it may draw a conclusion you never stated. You have the right to see it, correct it, object to it, or have it erased, and you can do that without giving a reason.
What the Oracle does not do. It does not decide whether you get an account, a price, a discount, or a delivery. No automated decision here has a legal effect on you or otherwise affects you significantly. A person — the owner — is reachable for anything the Oracle says.
Please do not type health or belief information into the Oracle
That means symptoms, diagnoses, pregnancy, medication, mental-health crises, disability, or details of religious and spiritual belief. The same goes for ethnicity, sexual orientation, political views, union membership, genetic or biometric data, and any government identifier.
We ask for two reasons. The law treats that information as a special category requiring an explicit legal basis, which we do not have for a chat feature — so we cannot lawfully collect it, however kindly it is meant. And once it leaves our server for a model provider, we cannot promise to reach every copy of it on request.
The Oracle is not a doctor, therapist, lawyer, financial adviser, or emergency service. If you are in crisis, please contact a local emergency number rather than this shop.
We instruct the model not to solicit that kind of detail. If it surfaces anyway, we delete what we can [FILL: describe the deletion process and who performs it]. If you have already sent something you regret, write to support@3rdeyesupply.com and we will remove the conversation and any profile drawn from it.
Because this is profiling at scale, GDPR Article 35 requires a data protection impact assessment before the feature runs. Status: [FILL: DPIA completed on date / in progress / not yet started]. A transfer impact assessment covering the China transfer is [FILL: status].
Sending data outside your country
We are a US business and most of our systems sit in the United States. If you are in the EU, the UK, or Switzerland, that means your data crosses a border. We rely on the European Commission’s Standard Contractual Clauses, and where a processor is certified, on the EU–US Data Privacy Framework [FILL: confirm which mechanism applies to each processor]. The UK addendum applies to UK data [FILL: confirm].
A specific caveat about the Oracle. The Oracle’s language model provider, DeepSeek, processes data in China. There is no adequacy decision for China. The transfer rests on the Standard Contractual Clauses plus a documented transfer impact assessment [FILL: date completed, or note that it is outstanding]. Chinese law — including its national security and intelligence legislation — can permit public authorities to require access to data held in China, which is a risk we cannot contract away. We limit it by sending only the conversation itself, never your address, phone, or payment details, and by encrypting the link in transit.
If that trade-off is not one you want to make, simply do not use the Oracle. Browsing, ordering, and everything else on this site work without it. You can also ask us for a copy of the safeguards we rely on for any processor, at support@3rdeyesupply.com.
How long we keep it
We keep things for as long as we need them and no longer. Where a law forces us to hold records — tax and accounting, mostly — that period wins.
| Data | Kept for | Why |
|---|---|---|
| Account — email, password hash, phone | Until you close it, then [FILL: period] | You are still signed in and can still reorder |
| Addresses | [FILL: period] | Saved for repeat orders |
| Order and invoice records | [FILL: the statutory tax/accounting period that applies] | Legal obligation |
| Cart and session cookies | [FILL: duration] | Keep your basket and your sign-in working |
| Oracle conversations | [FILL: period, or “until you delete them”] | So you can return to a reading |
| Oracle profile | [FILL: period, and whether it is rebuilt or decayed] | Continuity between conversations |
| Analytics events | [FILL: the PostHog retention setting] | Seeing what is broken |
| Support email | [FILL: period] | Resolving what you asked about |
| Backups | [FILL: rotation period] | Recovering from a failure |
Your rights — EU, EEA, UK, and Switzerland
- Access. A copy of the personal data we hold about you, and an explanation of what we do with it.
- Correction. Fix anything wrong, including an Oracle profile that has misread you.
- Erasure. Ask us to delete it, where no legal duty requires us to keep it.
- Restriction. Freeze the processing while a dispute about accuracy or lawfulness is settled.
- Portability. Take the data you gave us — in a structured, machine-readable form — and move it elsewhere.
- Objection. Object to processing based on legitimate interests, including the Oracle profile, and to direct marketing at any time.
- Automated decisions. Not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect. We do not make one.
- Withdraw consent. Where we rely on consent, take it back whenever you like.
Write to support@3rdeyesupply.com and say what you want. We answer within one month. If a request is genuinely complex we may extend that by two further months and will tell you why before the first month is up. Requests are free. If we cannot be confident who is asking, we may ask you to verify — proportionate to what is at stake, and never more than we need.
If we get it wrong, you can complain to your local supervisory authority. [FILL: identify the lead supervisory authority and add its contact, or note that the competent authority is the one in the complainant’s own member state]. We would rather you told us first, but you do not have to.
Your rights — California
If you live in California, the CCPA as amended by the CPRA gives you the following. We extend them to any US customer who asks, because it is easier than working out where the line falls.
- To know. The categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties we disclosed it to.
- To delete. Deletion of the personal information we have collected from you, subject to the exceptions the statute allows — an unfinished order or a tax record, for instance.
- To correct. Correction of inaccurate personal information.
- To opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We honour Global Privacy Control as a signal all the same.
- To limit use of sensitive personal information. The sensitive information we hold is your account login, which we use only to keep your account secure — a purpose the statute permits.
- Not to be discriminated against. Exercising any of these rights will not change your prices, your service, or the quality of what you get.
Ask at support@3rdeyesupply.com. We respond within 45 days, and may extend once by a further 45 with notice. An authorised agent may ask on your behalf, with written permission we can check.
Nevada residents: we do not sell covered information as Nevada law defines it, so there is no opt-out to exercise.
How we protect it
- Traffic to and from the shop is encrypted in transit with TLS.
- Passwords are hashed, never stored in readable form, and never emailed to you.
- The database lives on a private server, reachable over the network only from the application [FILL: confirm firewall and access configuration].
- Access to production systems is limited to the owner [FILL: add any contractor or helper with access].
- Disk-level encryption on the server: [FILL: confirm enabled].
- Backups are taken [FILL: frequency] and kept [FILL: period].
- Software and dependencies are updated [FILL: cadence].
No system is perfect, and we will not pretend otherwise. If a breach happens that is likely to put your rights at risk, we notify the supervisory authority within 72 hours of becoming aware of it, and we tell you directly, without undue delay, if the risk to you is high.
We will never ask for your password by email. If a message claims to be from us and does, it is not.
Children
The shop is for adults. We do not knowingly collect personal data from anyone under 16 in the EU or under 13 in the United States, and we do not direct the Oracle at children. If you believe a child has given us information, write to support@3rdeyesupply.com and we will delete the account and its data.
Changes to this policy
When our practice changes, this page changes with it, and the date at the top moves. If a change materially affects you — a new purpose, a new processor outside the US or EU, a longer retention period — we will say so on the site and by email to account holders [FILL: notice period before the change takes effect].
Contact
One person reads these, so please be direct and we will be too.
- Privacy and data requests: support@3rdeyesupply.com
- General support: support@3rdeyesupply.com
- Post: 3rd Eye Supply, [FILL: street address], Las Vegas, Nevada [FILL: ZIP], United States
If any part of this policy conflicts with the law where you live, the law wins and this policy is read down to match it. Nothing here takes away a right the law gives you.