Privacy policy
Who we are
Interface Agency Limited, a company registered in Malta under number C-74082, with its registered office at 19-25 Strait Street, Valletta, Malta VLT 1432, is the controller of the personal data described here. For any question about this policy, or to exercise the rights set out below, write to privacy@veganuniverse.io.
What we collect
Creating an account stores your first and last name, your e-mail address and the language you chose, together with the credentials and security settings that protect the account, including any sign-in providers you connect and the record of your active sessions. Your profile holds whatever you add to it, and we keep the bookmarks you save and the notification preferences you set, with a record of the notifications we sent you.
Registering an account stores the name and e-mail address you enter, together with the sign-in sessions that account opens. If you sign in through Facebook, Google or Apple, we receive your name, e-mail address and the identifier that provider assigns you; we never receive your password with them. Placing an order stores the items you buy and the delivery and billing details you give us. Content you submit is stored with your account. Our servers keep short-lived technical logs, and once you grant analytics storage, Google Analytics records how the site is used.
Placing an order stores the items you bought, the delivery and billing details you gave us, and the record of the payment. Card details are entered directly with our payment provider and are processed by them; we hold a payment reference and the result, never your full card number.
How we use it
We use your account details to sign you in, to keep your bookmarks, notifications and preferences, and to answer you when you contact us. We use your order and delivery details to fulfil what you buy and to meet our tax and accounting duties. We use technical logs to keep the service secure and available, and analytics data to understand how the site is used so we can improve it. We do not sell your personal data, and we do not use it to make decisions about you by automated means alone.
Why we are allowed to
We rely on your contract with us to run your account and to fulfil your orders, on your consent for analytics and marketing storage, on our legitimate interest in keeping the service secure and functioning, and on our legal obligations where tax, accounting or law-enforcement duties apply. Where we rely on consent, you may withdraw it at any time, and withdrawing is as easy as granting was.
Who else sees it
We share personal data only with the providers who run this service for us, and only as far as each needs: Google Cloud hosts the site and its data, MongoDB Atlas stores it, Twilio sends our e-mail and our text messages, Google Analytics measures use once you consent and Stripe processes payments — we never see or store your full card number. Some of these providers operate outside the European Economic Area; where they do, the transfer is covered by the European Commission's standard contractual clauses. We disclose data to public authorities only where the law requires it.
How long we keep it
We keep your account data for as long as your account is open. If you close your account we erase or anonymise it within 30 days, except where the law requires us to keep records longer — order and invoice records are kept for the statutory accounting period, technical security logs are kept for up to 12 months. Analytics data is retained for 14 months.
Your rights
You have the right to ask for a copy of the data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. You can withdraw your consent to analytics and marketing storage at any time with the manage button below, and withdrawing is as easy as granting was. Write to privacy@veganuniverse.io to exercise any of these rights; we answer within one month. If you believe we have handled your data wrongly, you may complain to the Information and Data Protection Commissioner in Malta, or to the supervisory authority where you live.
Deleting your account and data
You can delete your account and the personal data attached to it at any time. Sign in, open your account settings and choose to close your account; the account, your profile, your bookmarks, your preferences and your sign-in sessions are erased within 30 days. If you signed in through Facebook, Google or Apple, deleting your account here also removes the link to that provider, and you can additionally revoke our access in that provider's own settings. If you cannot sign in, write to privacy@veganuniverse.io from the address on the account and we will carry out the deletion for you. Records we must keep by law, such as invoices, are retained for the statutory period and then erased.
Changes
We update this policy when the service or the law changes. The date at the top tells you when it last changed, and material changes are announced on the site before they take effect.