Privacy Policy

1. Who we are

This Privacy Policy describes how Zhongshan Kailei Personal Care Supplies Co., Ltd., trading as CALLA Skincare ("CALLA", "we", "us"), processes personal data collected through skincraftlab.com (the "Site").

For privacy enquiries, contact us at privacy@skincraftlab.com.

2. What data we collect

Information you provide via forms: when you submit an inquiry, request a quote, or download materials, we collect your name, business email, company name, country, product interest, and any message you choose to send.

Information collected automatically: with your consent (see Cookies, below), we collect basic usage analytics including pages viewed, device type, approximate region, and referring URL. We do not use cross-site tracking.

We do not collect special category data (health, biometric, religious, political) and we do not knowingly collect data from anyone under the age of 16.

3. Why we use your data (legal bases)

To respond to your inquiry, send proposals, samples, and follow-up communications — basis: performance of pre-contractual measures at your request (GDPR Art. 6(1)(b)).

To send occasional manufacturing updates, certifications, or new product notifications — basis: legitimate interest in maintaining a B2B supplier relationship (GDPR Art. 6(1)(f)); you can opt out at any time.

To operate, secure, and improve the Site — basis: legitimate interest (GDPR Art. 6(1)(f)).

To comply with legal, accounting, and tax obligations — basis: legal obligation (GDPR Art. 6(1)(c)).

4. Who we share data with

Service processors acting on our instructions only: Supabase Inc. (database hosting, US/EU regions), Vercel Inc. (web hosting and analytics, US), Resend Inc. (transactional email, US), Cloudflare Inc. (CDN and image hosting, global), Anthropic PBC (AI chat assistant, US). Each processor is bound by a data processing agreement.

We do not sell or rent personal data. We do not share data with advertising networks.

We may disclose data when required by law, court order, or to protect our rights.

5. International transfers

Your data is processed in mainland China (where CALLA is located), the United States, and the European Union (where our service processors host data). Transfers outside your home jurisdiction rely on Standard Contractual Clauses or equivalent safeguards. Contact us for a copy.

6. How long we keep your data

Inquiry and quotation records: up to 36 months after our last interaction, then deleted or anonymized.

Customer/order records: as required by Chinese tax and accounting law (typically 10 years).

Analytics data: aggregated and retained for up to 24 months.

You can request earlier deletion at any time — see Section 8.

7. How we protect your data

Encrypted transport (TLS) for all form submissions, encrypted storage at rest in Supabase, scoped access keys, and audit logging on administrator actions. We do not host raw payment data — quotes are paid via bank transfer through your own banking provider.

8. Your rights

Under GDPR (EU/UK), CCPA (California), LGPD (Brazil), PIPEDA (Canada), and similar regimes, you have the right to access, correct, delete, restrict, or port your personal data, and to object to processing based on legitimate interest. You also have the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, email privacy@skincraftlab.com from the address you submitted. We will verify your request and respond within 30 days.

California residents may also designate an authorized agent and have the right to opt out of any "sale" or "sharing" of personal information — we do not engage in either.

9. Cookies and tracking

We use only strictly necessary cookies by default. Analytics cookies (Vercel Analytics) and AI chat cookies load only after you consent via the banner on first visit. See our Cookie Notice for the full list.

10. Changes to this policy

We will post any material changes on this page and update the "Last updated" date. Continued use of the Site after a change indicates acceptance of the revised terms.