Privacy Policy

1. Who is responsible for your information

Blenford Pvt Ltd operates Aériné and is responsible for deciding how personal information is used in connection with this store. References to “we”, “us”, and “our” mean Blenford Pvt Ltd. For privacy questions or requests, email info@aerine.lk.

2. Information we collect

We receive information directly from you, from your use of the website, and from payment or delivery providers when they confirm payment or fulfilment status. Required account and checkout details are needed to provide those services. Without them, we may be unable to create your account, process payment, deliver your order, or assess a claim.

• Account information, including your name, email address, sign-in information, and profile details.
• Order information, including your telephone number, delivery address, selected products, payment references, receipts, and order status.
• Customer service information, including emails, order enquiries, refund requests, and photographs or videos you provide to support a claim. Please send images of the garment and packaging only; we do not need photographs of you wearing the garment.
• Technical information that our hosting provider may record to operate and protect the website, such as your IP address, browser details, request time, and pages requested.

3. How and why we use information

We use account and order information to provide the services you request, process payments, deliver purchases, provide order history, and handle returns and refunds. The legal basis for these uses is taking steps at your request before a purchase and performing our contract with you.

We use relevant records to meet legal obligations, including accounting requirements and lawful requests from authorities. We also use necessary information for our legitimate interests in securing the store, preventing fraud, resolving enquiries and disputes, and maintaining reliable business records, while taking your privacy rights into account.

Where we rely on your consent for an optional use of your information, we will explain that use when asking for consent. You can withdraw that consent by emailing info@aerine.lk. Withdrawal does not affect processing that took place before you withdrew consent.

4. Service providers and sharing

We use Supabase to manage customer sign-in and store account and order information. Authorised store administrators can access information needed for their duties.

If you choose Google sign-in, Google shares account information, such as your name, email address, and profile information you authorise, with our authentication service to create or sign in to your Aériné account. Google also processes information under its own privacy policy.

OnePay processes payments and receives your name, email address, telephone number, order reference, and payment amount. Card details are entered on OnePay’s hosted payment page; Aériné does not collect your card details.

We share the contact and delivery information needed by couriers to deliver your order or arrange an authorised return. Hosting and email service providers may process information needed to operate the website and deliver account or customer service messages.

We may disclose relevant information where required by law, to respond to a lawful request, or to establish, exercise, or defend legal claims.

5. Cookies and information stored in your browser

We use authentication cookies to keep you signed in, local storage to remember your bag, and temporary session storage to help prevent duplicate checkout submissions. Blocking or clearing this storage may sign you out, empty your bag, or affect checkout.

Inner Circle membership is linked to your signed-in Aériné account. We store your joining date in Supabase and use your account profile and verified paid order records to show your membership activity and Air Points across devices. Inner Circle membership is included with your account and cannot be cancelled separately. Clearing browser data does not delete information held by us.

6. Marketing, analytics, and advertising

We may use your name, contact details, purchase history, and preferences to send relevant product news, offers, and membership updates where permitted by applicable law and your communication choices. Our optional email marketing checkbox is unchecked by default at email signup or during delivery onboarding after Google signup. We save your choice with its date, source and consent wording version in your account. Making a purchase or creating an account does not by itself mean you have consented to optional marketing.

You can change your email marketing preference in account settings. You can also stop promotional emails using the unsubscribe option included in those messages or by emailing info@aerine.lk. This does not stop necessary account, order, payment, delivery, or customer service communications.

We may analyse sales and order information to understand product demand, plan stock, improve our services, and assess promotions. Where permitted, this supports our legitimate interests in operating and growing the business, while taking your privacy rights into account. We use aggregated information where practicable.

With your separate analytics consent, we use Google Analytics 4 to understand visits, product interest, bag and checkout activity, offer usage and verified purchases. Google receives analytics cookie identifiers, sanitized page locations, campaign labels, product information, order transaction references and purchase amounts. We do not send names, email addresses, telephone numbers, delivery addresses, private voucher codes or payment credentials to Google Analytics. Google processes network information when your browser connects to its services and may process information outside Sri Lanka under its terms and privacy policy at https://policies.google.com/privacy.

When enabled and with your analytics consent, we also use Microsoft Clarity to understand browsing through heatmaps, masked session recordings, clicks, scrolling and technical performance signals. Microsoft receives browser and device information, public page URLs, analytics cookie identifiers (_clck and _clsk), and limited shopping action names such as adding to your bag or opening the size guide. Microsoft also processes network information when your browser connects to its services. All page content is masked, and account, membership, sign-in, checkout, payment and administration pages are excluded from recording. We do not send customer identifiers, order references, payment details or free-form form values as Clarity events or tags. Some visits are excluded when their URLs or referring pages may contain private information. Clarity advertising storage remains denied. Microsoft may process information outside Sri Lanka under its privacy statement at https://privacy.microsoft.com/privacystatement.

Clarity remains off until you allow analytics or accept all after seeing the notice that includes session recordings. A previous choice covering only Google Analytics does not activate Clarity. You can withdraw analytics consent through Privacy choices in the footer; this stops the recorder and clears Clarity’s first-party cookies in this browser. A page reload may occur to stop a recorder that is already loaded. Withdrawal cannot recall recordings already transmitted or in flight. Microsoft controls the retention of data already received under its Clarity service settings and documentation.

Analytics stays off until you choose Allow analytics or Accept all while analytics is enabled. You can reject or withdraw analytics consent from Privacy choices in the footer, independently of advertising. Your choice lasts up to 180 days. Withdrawal stops future collection and suppresses queued purchases; it cannot recall events already sent or in flight. A later grant does not import past orders. Our server removes analytics browser identifiers from pending purchase context after at most 72 hours plus the hourly cleanup interval, and removes transmitted payloads immediately after transport acceptance. Minimal order delivery identifiers are retained for up to 180 days for duplicate prevention. Google Analytics event retention is configured separately; our recommended setting is 14 months. Shopping, account access and order processing do not depend on analytics consent.

With your explicit advertising consent, we use Meta Pixel and the Meta Conversions API to measure Facebook and Instagram advertising and support relevant advertising. Meta may receive page and product activity, cart and checkout activity, verified purchase information, cookie identifiers (_fbp and, when available, _fbc), your browser user agent, and your IP address when available through a trusted connection. For eligible purchase events we also send email addresses and telephone numbers after normalization and SHA-256 hashing. Hashing helps protect these identifiers but does not make them anonymous. We do not send your delivery address, delivery notes or card details for advertising.

Advertising is off until you choose Yes, personalize my ads or Accept all while advertising is enabled. Use Privacy choices in the footer to reject or withdraw consent at any time; this does not affect shopping, your account, membership, or necessary order communications. Withdrawal stops subsequent advertising events and suppresses queued events that have not been sent. It cannot undo an event already transmitted or in flight. Granting consent later does not import historical purchases. Advertising consent is separate from email marketing preferences and acceptance of our terms.

Meta may process advertising information outside Sri Lanka under its applicable terms and privacy policies. Our consent preference lasts up to 180 days. Scheduled cleanup normally removes matching data from our local advertising queue and order attribution context after seven to eight days. We monitor cleanup failures and retry when service is restored. We retain minimal delivery and event identifiers to prevent duplicate conversions. Necessary financial order records have separate retention requirements. Meta’s retention and your controls are described in its Privacy Policy at https://www.facebook.com/privacy/policy/.

7. Overseas processing

Cloud service providers may store or process personal information outside Sri Lanka. The location depends on the provider and the service configuration. Overseas processing must be handled in accordance with applicable data protection requirements.

For information about the locations and arrangements applicable to your information, email info@aerine.lk.

8. How long information is kept

We keep personal information for as long as needed for the purpose for which it was collected. The period depends on whether your account remains active, whether an order, refund, enquiry, or dispute is unresolved, and any applicable legal recordkeeping requirements.

Order and payment records may need to be retained after an account is closed for accounting, legal obligations, or legal claims. Support messages and refund evidence are kept as needed to resolve the matter and meet related recordkeeping requirements. Browser-stored information remains until it is removed through the site or your browser settings.

9. Your privacy requests and complaints

Subject to applicable law, you may request access to your personal information, correction of inaccurate or incomplete information, or deletion where the conditions for deletion apply. You may also withdraw consent or object to processing based on legitimate interests where applicable. Email info@aerine.lk with your request. We may ask for information reasonably needed to verify your identity.

We will explain any decision to retain information or refuse a request, subject to legal restrictions. Deleting an account does not necessarily require deletion of records we must keep by law.

We will respond to privacy requests without undue delay and within one month of receipt. If an extension is permitted by applicable law and needed, we will explain the reason and notify you within that first month.

If you have a privacy concern, contact info@aerine.lk. You may also contact Sri Lanka’s Data Protection Authority through www.dpa.gov.lk and use any complaint or appeal procedure available under applicable law.

10. Updates to this policy

We may update this policy when our services, data practices, or legal requirements change. The date above identifies the latest revision. If we intend to use your information for a new purpose, we will provide the information and obtain any consent required by applicable law before doing so.