Privacy policy
Effective date: 2026-06-22
Last updated: 2026-10-01
1. Who we are
NUCLEORA SKINCARE INC. ("NUCLEORA", "we", "us") is a British Columbia corporation (BC1587377), located at 2155 Emerson St, Abbotsford, BC V2T 3H8, Canada.
Our Privacy Officer can be reached at privacy@nucleoraskin.com. We generally respond to privacy requests within 30 days, subject to any extension permitted by law.
2. Personal information we collect
Information you provide
- Email address, consent status, consent time, and sign-up source when you join our email list or request a promotional code.
- For referrals, a personal referral identifier, the link used to sign up, email-confirmation and subscription records, account or customer identifiers, and records of eligibility decisions, offer limits, codes, and delivery. Restricted eligibility records may include an email address or its hash. A hash remains personal information where it can be linked to you.
- Name, shipping and billing address, email address, and phone number, if provided, when you place an order.
- Order and payment-related details, including products ordered, order history, discounts, payment-method type, and transaction references. Payment providers process card details. We do not receive or store your full card number.
- Review information, including the display name you choose, email address, rating, review text, and any photo you submit.
- Messages and attachments you send us, including customer-service messages and product-quality or safety concerns sent to safety@nucleoraskin.com.
Information collected automatically
- Technical and usage information needed to operate and protect the store, such as IP address, browser and device type, referring page, pages viewed, cart and session information, and security events.
- When a page displays Judge.me reviews, Judge.me receives technical information needed to deliver the widget and may use a cookie or browser-storage entry for its operation.
- The site stores limited preferences on your device, such as region, supply selection, sound choice, and Welcome Draw state. If delivery of a Welcome Draw code fails, the email address you entered may remain in your browser storage so you can retry. It is removed when the retry succeeds, when the site clears it, or when you clear your browser data.
We do not knowingly collect personal information from anyone under 16.
3. Why we use personal information
- To process, fulfil, deliver, cancel, return, and refund orders.
- To provide customer service and send transactional messages, such as order and shipping updates.
- To send marketing messages when you have consented, and to record and honour an unsubscribe request.
- To issue and administer promotional codes and offers.
- To verify referral signups and current email subscription permission, apply eligibility and duplicate-claim limits, and deliver an earned-offer confirmation. A friend enters their own email address and chooses to receive updates; we do not ask referrers to upload friends' contact lists.
- To collect, moderate, publish, and remove reviews that customers choose to submit.
- To investigate product-quality or safety concerns, keep appropriate quality records, and communicate with an authority when appropriate or required by law.
- To prevent fraud, enforce offer limits, secure the store, and resolve payment disputes.
- To operate, troubleshoot, and improve the store and understand its use.
- To maintain records and meet legal, tax, accounting, and regulatory obligations.
We do not sell or rent personal information.
4. Consent and permitted uses
Canadian privacy laws generally require meaningful consent for the collection, use, and disclosure of personal information, subject to exceptions permitted by law. The form of consent depends on the information and purpose:
| Activity | How it is authorized |
|---|---|
| Processing an order, delivering it, providing support, and sending transactional messages | Your request for those services and the uses reasonably necessary to provide them |
| Marketing messages | Your express consent, unless another permission recognized by Canada's Anti-Spam Legislation applies |
| Publishing a review | Your decision to submit it for publication; you may later ask us to remove it |
| Optional analytics, personalization, or advertising technology | Your choice where consent is required; see section 5 |
| Fraud prevention, security, disputes, quality and safety records, and legal compliance | Consent where required, or another authorization or exception permitted by applicable law |
You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent does not affect uses already lawfully made and may prevent us from providing a service that requires the information.
5. Cookies and browser storage
- Essential store technology: Shopify uses cookies and similar technology for the cart, checkout, security, fraud prevention, and core store functions. These functions remain active because the store cannot operate without them.
- Store measurement: Shopify may process technical and store-usage information as part of hosting and operating the store. Where applicable law requires a choice for an optional function, that function must remain off until the required choice is made.
- Review widget: Judge.me loads where reviews are shown and may use technical information, a cookie, or browser storage to operate the widget. We do not use it for cross-site advertising.
- Local preferences: the site uses browser storage for the limited preferences and retry function described in section 2. This information remains on your device unless the site or you clears it.
- Advertising and third-party analytics: as of the last-updated date, we do not use Google Analytics, Meta Pixel, TikTok Pixel, or Klaviyo onsite tracking.
If we add optional analytics, personalization, or advertising technology, we will update this policy and implement the required privacy choices before activating it. You can also block or delete cookies and browser storage through your browser settings, although doing so may affect store functions.
6. Service providers and other recipients
We disclose only the information reasonably necessary for the purposes below. Providers operate under their applicable terms, privacy commitments, and contractual or other safeguards. We review material providers and update this table when our practices change.
| Provider or recipient | Purpose | Where processing may occur |
|---|---|---|
| Shopify, including Shopify Payments and its subprocessors | Store hosting, checkout, payment processing, order records, security, and store operations | Canada, the United States, and other countries where Shopify and its subprocessors operate |
| Klaviyo and its subprocessors | Marketing and transactional email, consent and native email-confirmation records, promotion delivery, and review invitations when enabled | United States and other countries used by its subprocessors |
| Make (Celonis) and its subprocessors | Restricted referral and offer-eligibility records, duplicate prevention, and coordination with Klaviyo and Shopify for earned-offer confirmation | Outside Canada, including the United States and other countries used by its subprocessors |
| Judge.me and its subprocessors | Review collection and display, and confirmation of a submitted review; review invitations are handled through Klaviyo when enabled | Outside Canada, including countries where Judge.me and its subprocessors operate |
| Canada Post or another carrier selected for an order or return | Delivery, tracking, and returns | Primarily Canada |
| Domain and email-routing providers, including Shopify and Tucows | Routing messages sent to our business email addresses | Canada, the United States, and other service locations |
| Google services, including Gmail and Drive | Receiving customer correspondence and maintaining restricted business and quality records | May include the United States and other countries where Google and its subprocessors operate |
| Card networks, financial institutions, and fraud or dispute participants | Authorization, clearing, settlement, refunds, fraud prevention, and payment disputes | Countries involved in the payment transaction |
| Government, regulatory, law-enforcement, or professional advisers | Only where disclosure is permitted or required by law, or reasonably necessary to establish, exercise, or defend a legal claim | Relevant jurisdiction |
7. Processing outside your province or Canada
Some providers process personal information outside your province or outside Canada. Information in another jurisdiction may be accessible to courts, law-enforcement agencies, or national-security authorities under that jurisdiction's laws.
We assess material cross-border arrangements and use safeguards appropriate to the sensitivity, purpose, volume, and destination of the information. These may include provider terms, contractual protections, access restrictions, data minimization, and account-security controls. For personal information governed by Quebec law, we conduct the assessment required before communicating it outside Quebec and proceed only where the arrangement provides adequate protection in the circumstances.
8. How long we keep information
| Information | General retention approach |
|---|---|
| Marketing subscriber information | While you remain subscribed. After you unsubscribe, we retain only the information reasonably needed to honour the opt-out and demonstrate consent and withdrawal for as long as reasonably necessary. |
| Referral and offer-eligibility decision records | Information used to make a decision about you is retained for at least one year after the decision where Quebec law applies. It is retained longer only as reasonably necessary to honour an offer, enforce its limits, resolve a dispute, demonstrate consent or withdrawal, or meet a legal requirement. Records are deleted or reduced when those purposes no longer require them. |
| Order, payment-reference, guarantee, accounting, and tax records | For the periods required by applicable tax, accounting, consumer-protection, and limitation laws, generally at least six years after the end of the relevant tax year. |
| Product-quality, safety, and complaint records | Generally six years under our internal quality and safety schedule, or longer where reasonably necessary for an investigation, legal claim, or legal requirement. |
| Product reviews | While published and for a reasonable period afterward for moderation, backup, legal, or dispute purposes. We remove a published review on request, subject to lawful retention needs. |
| Technical and store-usage information | According to the applicable provider's settings and retention schedule, and only as long as reasonably necessary for the stated purpose. |
| Information stored on your device | Until the site overwrites or clears it, or you clear your browser data. |
We may retain information longer when required by law, while a complaint, investigation, or legal claim is active, or to establish, exercise, or defend legal rights. When information is no longer required, we delete or destroy it. If we keep anonymized information for a serious and legitimate purpose permitted by law, we anonymize it in accordance with applicable legal requirements.
9. Your privacy rights
Depending on where you live and which law applies, you may have the right to:
- request access to personal information we hold about you and information about its use and disclosure;
- request correction of inaccurate or incomplete information;
- withdraw consent, subject to lawful restrictions;
- request deletion of information that we no longer need and are not required or permitted to retain;
- for information governed by Quebec law, request that computerized personal information collected from you, but not information created or inferred using information about you, be communicated to you or to a person or body authorized by law in a structured, commonly used technological format, unless doing so raises serious practical difficulties;
- for information governed by Quebec law, request cessation of dissemination or de-indexing where the statutory conditions apply; and
- make a complaint to us or to the applicable privacy regulator.
To exercise a right, email privacy@nucleoraskin.com. We may need to verify your identity before responding. We generally respond within 30 days, subject to any extension permitted by law.
Referral eligibility may be decided automatically using signup confirmation, subscription history, and offer records. We inform you when communicating an entirely automated decision. You may ask which personal information was used, the reasons, main factors and parameters behind the decision, correct the information used, and present your observations to a person able to review the decision. Contact privacy@nucleoraskin.com.
You may also contact the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec, as applicable.
10. Governance, complaints, security, and confidentiality incidents
NUCLEORA's sole director acts as Privacy Officer and approves and oversees our privacy governance practices. The Privacy Officer controls access, reviews material service providers, responds to privacy requests and complaints, and oversees retention, destruction, incident response, and required privacy assessments. Any contractor given access must use personal information only for the assigned purpose, protect it, and promptly report a suspected incident.
To make a privacy complaint, email privacy@nucleoraskin.com and describe your concern with enough detail for us to review it. The Privacy Officer records the complaint, investigates it, may ask for information needed to complete the review, and provides a written outcome and any corrective action. We generally aim to complete this process within 30 days after receiving the information needed for the review, subject to any extension permitted by law. You may contact the applicable privacy regulator at any time.
We use safeguards appropriate to the sensitivity and amount of information, including encrypted transmission for the storefront, provider access controls, restricted access, and data minimization. No security measure can guarantee absolute security.
We maintain incident procedures and a confidentiality-incident register where required. If an incident creates a real risk of significant harm or a risk of serious injury, we will notify affected people and the appropriate regulator when required by applicable law.
11. Children
The store is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a minor has provided personal information, contact privacy@nucleoraskin.com.
12. Changes to this policy
We update this policy when our practices or legal obligations change. The last-updated date identifies the current version. We will provide any notice and obtain any new consent required by law for a material change. A change does not alter the terms that governed an order before the change.
This policy is available in French at nucleoraskin.com/fr/policies/privacy-policy.
13. Contact
Privacy Officer: privacy@nucleoraskin.com
General inquiries: hello@nucleoraskin.com
Product-quality and safety concerns: safety@nucleoraskin.com
NUCLEORA SKINCARE INC.
2155 Emerson St, Abbotsford, BC V2T 3H8, Canada