Last updated 5 October 2026.
Velvet Sylph LLC runs velvetsylph.com. This explains what we collect, why, and what we do not do. Questions go to contact@velvetsylph.com and a real person answers.
The short version
We collect what we need to take your order, send you a bottle, and write to you if you asked us to. We do not sell your information and we do not trade it. We do use a handful of outside services to take payment, deliver the parcel, send our email, run our ads and measure how the store is doing, and every one of them is named below.
What we collect
When you order: your name, email address, shipping and billing address, and your phone number if you give us one. Also what you bought and when.
When you join The Letter: your email address.
When you leave your email on a scent finder result: your email address, and the match and runner-up it gave you.
When you make an account: your email address and a password, which is stored scrambled and cannot be read by us.
Automatically: our server keeps standard logs including your IP address, browser type and the pages you requested. These are used to run and secure the site, including blocking repeated failed logins, and they age out on their own.
When you browse: a tool called Microsoft Clarity records how the visit went. It keeps the pages you opened, what you clicked, how far you scrolled and how your mouse moved.
Payment
Card payments are handled by Stripe. Your full card number goes to Stripe, not to us, and we never see or store it. We keep a record of the amount, the last four digits, and whether the payment succeeded.
Stripe’s scripts load on our checkout, including a fraud-prevention script, which Stripe uses to tell real shoppers apart from card testing. Stripe’s own privacy policy governs what they do with it.
Bot protection
Our forms and login are protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a script. To do that, Cloudflare sees your IP address and some browser characteristics. It does not track you across other websites and it is not an advertising product. This is here because the store has been targeted by automated card testing before, and it is what keeps that off your checkout.
Our mailing list runs on Klaviyo. Your email address, your name if you gave us one, and what you have ordered are held there, so that we send you the right thing and not the wrong thing. Once you have signed up or clicked one of our emails, Klaviyo can also connect what you look at on this site to your subscriber record.
If you ask the scent finder to email your result, we pass your email address and that result to Klaviyo, which sends it. After that we may write to you about a new scent or a restock, or about a scent you looked at or left in your cart here. Every one of those emails has an unsubscribe link.
If you join The Letter we will write about new scents, restocks and occasional offers. Every one of those has an unsubscribe link and it works immediately. Order and delivery emails are part of the service, so those keep coming as long as you have an open order.
Who else touches your information
- Stripe, to take payment, to store your payment method if you hold a membership that renews, and to prevent fraud.
- Cloudflare, whose Turnstile check screens our forms for bots.
- Our shipping carriers, who need your delivery address to deliver.
- WooCommerce Shipping, which we use to calculate rates and print labels.
- Akismet, which screens form submissions for spam.
- WooCommerce receives non-personal statistics about how the store itself is used. No customer details are included.
- Google, which runs our analytics, our advertising measurement and our Customer Reviews survey. When your order confirmation page loads, we pass Google your email address, your order number, your delivery country and the date we expect the parcel to arrive, so it can offer you a short survey about how we did. Google emails you that survey only if you accept it on that page. Decline and nothing further happens.
- Meta, whose advertising pixel tells us whether an ad on Facebook or Instagram led to a visit or an order, and makes it possible for us to show ads to people who have been here.
- Klaviyo, which holds our mailing list and sends our email.
- Microsoft, whose Clarity tool records how people use this site. Microsoft holds those recordings, and we watch them there.
That is the whole list. We do not sell, rent or trade your information, and we do not hand it to data brokers.
Analytics and advertising
Google Analytics runs on every page here. It tells us how many people came, which pages they read, and which of those visits became an order. It also records a few things people do here: adding a bottle to the cart, starting checkout, creating an account, leaving an email address for our emails or a restock notice, and finishing the scent finder. It records that these happened, never the email address or anything else typed into a form. Meta’s advertising pixel runs on every page too, so we can tell whether an ad we paid for did anything, and so we can show ads to people who have already visited. The pixel has a Meta feature called automatic advanced matching switched on. When you press a button on a form on this site, for example the email signup or a restock notice, the pixel reads the fields in that form and, if it finds an email address, a name, a phone number, or a city, state, postal code or country, sends Meta a scrambled, one-way version (a hash) of them, so Meta can match the visit to a Meta account. Both are outside companies. Both set and read their own cookies in your browser, and both use small tracking pixels in the page to do it. What they collect is governed by their own privacy policies as well as by this one.
Google Ads is here as well. When your order confirmation page loads, the store tells Google that a purchase happened, its order number, which bottles were in it and what they cost, and whether it was your first order with us, so we can tell whether one of our ads led to it. Along with that goes a scrambled, one-way version (a hash) of the email address, phone number and name on the order. The postal code and country go as they are. Google compares those with the same scrambled details on Google accounts to work out whether the buyer had clicked an ad of ours. We send it to measure our advertising, and what Google does with it is governed by Google’s privacy policy as well as by this one.
Microsoft Clarity runs here too. It records what happens on the screen during a visit: the pages you open, what you click or tap, how far you scroll and where your mouse moves. It also notes your browser, your device, and the city, state and country you are in. We can play a visit back and watch what happened. We can also see a map of where people click most. We use both to find the parts of the store that are hard to use, so we can fix them.
Some things are hidden or left out. The words you type into a form are hidden before they leave your browser. Clarity does send Microsoft a short code worked out from each thing you type. The code is not your words, but the same words always make the same code. The search box is different: what you search for shows in the page address, and the recording keeps that. Your card number is typed into Stripe’s own box, which the recording cannot see at all.
Clarity does not run on your account pages, your order pages or the order lookup page, so it does not see them. On the checkout it does run, but every word is hidden. There the recording shows only blank shapes, and where a click or a scroll happened. On the cart it records the bottles and the totals.
The recordings are held by Microsoft, an outside company, and we watch them there. Microsoft can set cookies of its own. It can use what it collects for its own business too, and that includes its ads. Microsoft has its own rules for what it does with this. You can read them in the Microsoft Privacy Statement.
You can turn all of it off. Every browser lets you block or clear cookies from its settings, and any of the usual content blocker extensions will stop these scripts loading in the first place. Blocking cookies does not stop Clarity. Most content blockers do. So does the Global Privacy Control switch that some browsers have: when it is on, we do not load Clarity at all. The store works exactly the same either way, and nothing here is held back from you for switching them off.
What we do not do
We do not sell, rent or trade your information, and we do not hand it to data brokers. We do not run a TikTok or Pinterest pixel. We do not buy information about you from anyone else, and we do not ask you for anything we do not need to take the order and get the bottle to you.
Cookies
The cookies here remember what is in your cart, keep you signed in if you have an account, let Stripe check that a payment is genuine, let Cloudflare’s bot check know you have already passed it, let Google Analytics count one visit as one visit, let Meta’s pixel and Google Ads connect an ad click to what happened next, and let Klaviyo connect what you look at here to your subscriber record once you have signed up or clicked one of our emails. The last three are analytics and advertising cookies, set by those companies rather than by us. Your browser settings can block or clear any of them, and a content blocker extension stops them being set at all. We also keep a small cookie of our own that remembers which ad or link brought you here, so an order can be matched to it.
Clarity sets cookies as well. Two of them are named _clck and _clsk. They let it know a browser it has seen before. They also join the pages of one visit into one recording. Microsoft can also set cookies of its own. It uses those for its ads and its own analytics.
How long we keep things
Order records are kept for as long as tax and accounting law requires, which in practice means several years. Membership records are kept while the membership is active and then with your order history. Subscriber addresses are kept until you unsubscribe. Scent finder results are kept until you ask us to delete them. Microsoft keeps most of the Clarity recordings for 30 days. It keeps a few of them, and the click maps, for up to 9 months. Server logs age out on their own within a short period.
Your choices
Write to contact@velvetsylph.com and you can ask us to show you what we hold about you, correct it, or delete it. We will do it. If you are in a state with specific privacy rights, such as California, those rights apply and this is how you use them. We will not treat you differently for asking. There is one thing we cannot do. Microsoft gives us no way to delete just one recording. So we cannot remove just yours. Each one is deleted when its time is up.
You can unsubscribe from marketing email at any time from the link in any of those emails.
Children
This site is not intended for anyone under 18 and we do not knowingly collect information from children.
Changes
If this changes we will update the date at the top. If it changes in a way that matters, we will say so.
On 5 October 2026 we added Microsoft Clarity to this page. It has run on the site since 18 September 2026.
Contact
Velvet Sylph LLC
contact@velvetsylph.com