Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect information through our authentication provider, Clerk. This may include:

• Your name and email address
• Profile picture (if provided)
• Authentication identifiers (e.g., your Clerk user ID)

Order & Purchase Information

When our store launches and you place an order, we collect the details needed to fulfill it:

• Shipping and billing addresses
• Items ordered, sizes, and quantities
• Order history and order status

Payment Information

All card payments are processed by our payment provider, Stripe. We do not store full card numbers on our systems. LALA retains only a Stripe customer identifier and the status of your orders or subscriptions. Your card details are handled directly by Stripe under their security standards.

Marketing & Waiting-List Data

If you sign up for early access, our waiting list, or our newsletter, we collect your email address so we can notify you at launch and send you updates. We do this on the basis of your consent, which you can withdraw at any time.

Usage & Technical Data

We automatically collect limited technical information when you use our site, such as your browser type, device characteristics, and general usage patterns. This helps us keep the site secure and improve the experience.

2. How We Use Your Information

We use the information we collect to:

• Process and fulfill your orders
• Arrange shipping and delivery of your garments
• Process payments securely through Stripe
• Authenticate and secure your account through Clerk
• Send transactional and order-related notifications
• Send marketing and early-access updates where you have consented
• Improve and personalize our store and content
• Analyze usage to understand how our site is used, via our analytics provider, PostHog

3. Third-Party Services

We rely on a small set of trusted third-party processors to operate LALA. Each maintains its own privacy policy governing how it handles your data.

Clerk (Authentication)

Clerk manages account login and provides us with a verified identity. It processes your name, email, and authentication identifiers.

Stripe (Payments)

Stripe processes all card payments. Your payment details are provided directly to Stripe; we receive only a customer identifier and order or subscription status.

Convex (Data Storage & Backend)

Convex is our real-time backend, where account, order, and content data are stored and served.

PostHog (Analytics)

PostHog provides product analytics that help us understand how the site is used and where it can be improved.

Shipping & Fulfillment Partners

Carriers and logistics partners receive your name and delivery address so they can ship and deliver your order.

Email & Marketing Provider

Where applicable, we use an email service provider to send transactional and marketing messages. It processes your email address for the purpose of delivering those messages.

4. Data Storage and Security

Your data is stored on Convex. Access is protected by JSON Web Token (JWT) authentication that is verified on every request, together with ownership checks that ensure you can only access your own data. Data is encrypted in transit using HTTPS/TLS, and authentication tokens are stored securely.

While we take reasonable technical and organizational measures to protect your information, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

5. Cookies and Tracking

We use a limited set of cookies:

• Theme preference cookie — stores your light or dark display preference.
• Authentication cookies — set by Clerk to keep you securely signed in.
• Analytics cookies — set by PostHog to help us understand usage.

We do not sell your personal data, and we do not work with third-party advertising brokers.

6. Data Retention

We retain your personal data while your account is active and for as long as needed to fulfill your orders and meet our legal obligations. Certain records — such as tax and accounting records — may be retained for longer where the law requires it.

When you delete your account, we delete or anonymize your personal data within 30 days, subject to any legal retention requirements described above.

7. International Data Transfers

LALA operates from Montenegro within the broader European region. Your data may be processed within the EU/EEA and by US-based processors such as Clerk, Stripe, Convex, and PostHog. Where data is transferred outside the EU/EEA, we rely on appropriate safeguards — for example, the European Commission's Standard Contractual Clauses — to protect it.

8. Your Rights

Depending on your location, and in particular if you are in the EU/EEA, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete your personal data.
• Portability — request an export of your data in a portable format.
• Restriction — ask us to limit how we process your data.
• Objection — object to certain processing.
• Withdraw consent — withdraw consent for marketing at any time.

To exercise any of these rights, contact us at info@ohhlala.me. You also have the right to lodge a complaint with your local data protection supervisory authority.

9. Children's Privacy

LALA is not intended for children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will provide a more prominent notice where appropriate.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at info@ohhlala.me.

LALA is operated by House of LALA d.o.o., Gjokaj Street 2, Tuzi 81206, Montenegro.