Privacy policy | Caratstone

Who we are

Caratstone Jewels Inc ("Caratstone", "we", "us") sells fine diamond jewellery and loose diamonds to trade customers through this website. We decide how and why the personal data described here is used, which makes us the data controller for it.

You can reach us about anything in this policy at sales@caratstone.com or by post at 1177 Avenue of the Americas, Suite 5123, New York, NY 10036, United States.

What we collect and why

This is a trade site: most of what we hold comes from the application you make for a business account and from using that account afterwards.

Account application: your name, company, the sales agent you work with (if any), phone number, country, business address and email address. We use these to verify that you are a trade customer, to decide whether to open an account, and to contact you about your application.
Account and sign-in: your email address, the password you choose (stored only in hashed form, never readable by us), the one-time codes we email you, and the time and device of your sign-ins. We use these to keep your account secure and to spot sign-ins that don't look like you.
Enquiries and orders: anything you send us by email or WhatsApp, and the diamonds or jewellery you ask about or order, so that we can answer and fulfil your request.
Technical data: your IP address, browser and device type, the pages you open and the links you use. We use these to keep the site working, to limit abuse (for example repeated sign-in attempts), and to understand how the site is used.

We don't collect payment card details on this website. Prices are shown only to approved trade customers who are signed in.

Cookies and analytics

Until you sign in, this site sets no analytics cookies and stores nothing in your browser for analytics: visits are measured with a temporary identifier that is discarded when you leave. That is why there is no cookie banner.

When you sign in to your trade account, we keep a small number of cookies and browser entries so that the site remembers you:

Sign-in cookies set by this site, which keep you signed in and protect the session. They are strictly necessary and last until you sign out or the session expires.
An analytics identifier set by PostHog (cookie and local storage, named ph_…) that links your activity on the site to your account so that we can see how trade customers use the catalogue and where they get stuck. It is removed when you sign out.

Our analytics provider is PostHog, Inc. (United States). It records page views, clicks, page performance and, for signed-in customers, a replay of how the page was used. Everything you type into a form is masked in those replays, and passwords are never captured. Analytics requests are sent through our own domain. We identify you to PostHog only by your account identifier and your account role; your email address and name are not sent.

You can block analytics with a tracking blocker or by disabling cookies for this site; the catalogue and your account keep working either way.

We don't sell personal data. We share it only with the service providers that run this site for us, each under a contract that limits what they may do with it:

PostHog, Inc. (United States): analytics, as described above.
Resend, Inc. (United States): the emails we send you, such as password reset links, verification codes and decisions about your application.
Amazon Web Services, Inc. (United States): hosting for product photography and video, and our infrastructure.
WhatsApp (Meta Platforms, Inc.): only if you choose to message us on WhatsApp; their own privacy policy applies to that conversation.

We may also disclose personal data where the law requires it, to protect our rights, or as part of a sale or reorganisation of our business.

Where your data is kept

We are based in the United States and the providers above store data there. If you are in the United Kingdom, the European Economic Area, Switzerland or Australia, that means your personal data leaves your country. We rely on the providers' standard contractual clauses and, where available, their participation in the EU–US and UK–US data bridge frameworks to protect it.

Our legal basis

Where the UK GDPR or EU GDPR applies, we process personal data on these bases:

To take steps at your request before and after opening an account, and to fulfil orders (performance of a contract).
To keep the site and accounts secure, to prevent abuse and to understand how the site is used (our legitimate interests, which we have balanced against yours).
To meet legal obligations, such as record keeping for sales and tax.
Your consent, where we ask for it; you can withdraw it at any time.

How long we keep it

Applications that are not approved: the application record is kept for 12 months so that we can answer questions about the decision, then deleted.
Trade accounts: for as long as the account is open, and for 7 years afterwards for the records we must keep for tax and sales purposes.
Sign-in codes expire after 15 minutes and password reset links after 1 hour; both are deleted when used.
Analytics: PostHog keeps events and replays for the retention period set in our PostHog project, after which they are deleted.
Server logs: up to 90 days.

Your rights

Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent. If you are in California, you also have the right to know what we collect and to ask us not to sell or share it (we don't).

To use any of these rights, email sales@caratstone.com. We will answer within one month, and we may ask you to confirm your identity first. You can also complain to your data protection authority, for example the Information Commissioner's Office in the UK or the supervisory authority of your EU member state.

Security

Connections to this site are encrypted, passwords are stored in hashed form only, password changes are confirmed by a code or link sent to your email address, and access to customer data inside Caratstone is limited to the staff who need it.

Children

This site is for businesses and is not directed at anyone under 18. We don't knowingly collect personal data from children.

Changes to this policy

When we change this policy we will update the date at the top of this page. If a change materially affects how we use your personal data, we will tell account holders by email first.