Privacy Policy
Effective: May 13, 2026
Plain-English version: we collect very little, we don’t sell anything to anyone, we use a small set of third-party services to run this site, and you can ask us to delete anything we have at any time.
The longer version is below.
Who we are
This site (journal.elelaf.com) and the connected store (elelaf.com) are operated by Elelaf, an independent skincare brand. For any privacy question:
Email: [email protected]
Business address: Elelaf Skincare, 11311 W Forest Home, Franklin, WI 53132, USA
We are the “data controller” for the personal information collected through this site.
What we collect
There are two ways your information might come to us:
Automatic. When you visit the site, our hosting and CDN providers (SiteGround, Cloudflare) log basic technical information — your IP address, browser type, the page you visited, referring URL, and time of visit. This is standard server logging used for security and basic analytics.
Voluntary. When you sign up for our newsletter or send us an email, you give us your email address and whatever else you choose to include. We don’t require you to give us anything beyond an email to subscribe.
We do not have user accounts on this site. We don’t ask for your name, phone, address, or payment details. (The store at elelaf.com has its own privacy policy that covers shopping data.)
How we use it
For automatic data: site security, fraud detection, basic analytics (page views, country, device). We don’t try to identify individuals from this data.
For voluntary data: to send the newsletter you signed up for. To reply to your emails. That’s it.
We don’t sell your data. We don’t share your email with advertisers or other brands.
Third-party services we use
This site uses a small number of vendors, each handling a specific piece:
- SiteGround — web hosting. Stores server logs.
- Cloudflare — DNS and CDN. Sets a small number of security and performance cookies.
- Google Analytics 4 — page-view analytics. Uses cookies. Configured for IP anonymization.
- Klaviyo — newsletter delivery. Stores your email address only if you subscribe.
Each of these vendors has its own privacy policy. By using this site you consent to that data flow.
Cookies
We use cookies sparingly. The categories:
- Strictly necessary — Cloudflare security cookies, session state. Required for the site to work.
- Analytics — Google Analytics page-view tracking. Anonymized IP.
- Marketing — none. We don’t run advertising trackers.
If you’d rather not have analytics cookies, your browser has settings for this. We set the smallest set of cookies we can.
Your rights
If you live in California (CCPA), the EU/UK (GDPR), or another region with privacy laws, you have specific rights including:
- The right to access what data we have on you
- The right to delete it
- The right to correct inaccurate information
- The right to opt out of “sale” of data (we don’t sell, so this is moot)
- The right not to be discriminated against for exercising these rights
To exercise any of these: email [email protected]. We’ll respond within 30 days.
Data retention
Email newsletter data: retained as long as you’re subscribed. When you unsubscribe, we delete it within 30 days.
Server logs: retained for 90 days for security purposes, then deleted.
Children
This site is not directed at children under 13 (under 16 in the EU). We don’t knowingly collect data from anyone under those ages.
International transfers
If you’re outside the US, your data is transferred to and stored in the US (where our hosting is). For EU users, we rely on Standard Contractual Clauses with our US vendors.
Updates
If we change this policy, we’ll update the “Effective” date at the top and (for material changes) notify newsletter subscribers by email.