Privacy Policy

This notice explains how OneStow handles personal information when you browse our store, contact us, sign in or buy a product. It covers this store, including its customer support and order services.

1. Who is responsible

The controller is LLC VAPERI, identification code 433102484, registered at Village Tsodniskari, Lagodekhi Municipality, Georgia. Contact support@onestow.com for privacy questions or requests. Our Legal Notice provides company information.

2. Information we collect and its sources

• Information you provide: your name, email, delivery address, phone number, product choices, support messages and any photos or attachments you choose to send.
• Order and payment records: order numbers, amounts, currency, payment status, transaction references, refunds and disputes. Stripe processes payment details on its checkout. Our application does not receive or store your full card number or card security code.
• Account information: your email, sign-in history and session records. Sign-in codes and session tokens are stored as hashes rather than readable codes or tokens.
• Technical information: request and security logs, IP addresses, device/browser details and error information needed to operate and protect the service. Optional browser diagnostics run only with permission.
• Optional analytics: browser identifiers, pages and selected interactions, referral/campaign information and purchase events, when analytics is enabled in your preferences.
• Information from service providers: payment confirmations from Stripe and fulfilment status, carrier information and tracking from our fulfilment and delivery partners.

Information needed for payment, delivery or responding to a request is necessary to provide that service. Optional analytics and live chat are not required to shop. Please do not send card details, passwords, government identity documents or sensitive health information through our contact form or chat.

3. Purposes and legal grounds

Where applicable law requires a legal basis, we use the basis appropriate to each purpose:

• Contract and steps you request before a contract: processing orders and payments, arranging delivery, providing order updates, handling returns and answering product questions.
• Legal obligations: accounting, tax, consumer protection, lawful authority requests and required records.
• Legitimate interests, where permitted: protecting the store against abuse, troubleshooting service failures and establishing or defending claims, balanced against your rights and expectations.
• Consent: optional analytics, browser diagnostics and loading the live-chat service. You can withdraw this permission through Cookie settings. Processing already carried out lawfully is not undone by withdrawal.

Accepting our Terms or placing an order is not consent to optional tracking or marketing. Transactional messages about your order or security are service communications.

4. Providers and other recipients

• Stripe: payment processing, receipts, fraud prevention, refunds and disputes.
• Fulfilment, warehouse and carrier partners: recipient name, delivery details, phone number and order contents necessary to fulfil and track shipments.
• SuiteNode Mail: delivery of sign-in codes, order updates and support messages.
• Vercel and MongoDB: hosting and storage of store, account and order information.
• PostHog: optional product analytics, including selected purchase events when an analytics identifier is supplied at checkout.
• Crisp: optional live chat, conversation identifiers, technical connection information and the messages you submit.
• Sentry: error diagnostics; browser diagnostics are optional, while server error reporting supports operation and security.

Providers may also process information for their own legal, payment or security obligations. Their notices explain those activities. We may disclose relevant information to professional advisers, authorities where legally required, or parties to a business transfer subject to applicable safeguards.

We do not sell personal information or use cross-context behavioural advertising on this store. Optional analytics is used to understand our own store. We do not use session replay or make solely automated decisions that produce legal or similarly significant effects on you.

5. International processing

We operate from Georgia. Our providers and fulfilment partners may process data in other countries, including the United States, European countries and countries from which goods are fulfilled. These countries may have different privacy protections.

Where a transfer requires a legal safeguard, the applicable transfer rules must be met, for example through an adequacy decision or approved contractual safeguards. You may contact us for details of the destinations and safeguards relevant to your information. Cookie consent does not replace required international-transfer safeguards.

6. How long information is kept

We keep personal information for the purposes above, taking account of the duration of an order or support issue, applicable accounting and tax requirements, dispute periods and legal holds. Different record types may therefore have different retention periods. We delete or de-identify information when it is no longer needed, subject to those obligations; copies in backups may remain until the backup cycle replaces them.

• Sign-in codes expire after 10 minutes. Sessions expire after 12 hours, or up to 30 days when you choose to be remembered.
• Privacy choices are valid for 180 days in this browser. We ask again after expiry or a new consent version.
• Our optional campaign-attribution record is used for up to 30 days. Browser identifiers and provider-side records have separate lifetimes; see our Cookie Policy.
• Order and correspondence records may need to remain after an account is closed to complete an order, meet legal obligations or resolve a dispute.

7. Cookies, browser storage and signals

Optional services remain off until you choose them. You can accept, reject or select categories, and reopen Cookie settings at any time. The Cookie Policy describes the technologies and how withdrawal works.

We treat a supported Global Privacy Control signal as a reason to keep optional analytics disabled, even if a previous choice allowed it. This setting applies to this browser. It is not a request to erase existing order records.

8. Your privacy rights

Depending on the law applicable to you, you may request access or a copy, correction, deletion, restriction, portability, withdrawal of consent, or object to certain processing. US state laws may also provide rights to opt out of sale, sharing, targeted advertising or qualifying profiling, to limit certain sensitive-data uses, and to appeal a refusal. We do not require optional tracking as a condition of a purchase and do not discriminate for exercising applicable rights.

To make a request, email support@onestow.com or use our contact form, stating the right you wish to exercise and the email used with the store. We may ask for proportionate verification or evidence of an authorised agent's authority. Do not send an identity document unless we explain why it is needed and provide a suitable method.

We respond within the period required by applicable law. Where GDPR applies, this is generally one month; where applicable US state law provides 45 days, that period applies. We explain any lawful extension or refusal and available appeal options. These examples do not replace shorter deadlines under other applicable laws. Some information must be retained despite a deletion request, such as records needed by law.

You may complain to the competent privacy authority or seek other available remedies without contacting us first. Where relevant, this includes your local EEA supervisory authority, the UK Information Commissioner, an applicable US state authority or the competent Georgian authority.

9. Security and children

We use access controls, protected sessions and other technical measures to reduce unauthorised access. No transmission or storage system is risk-free. Report suspected misuse to our support email. We will assess incidents and give notices where required by law.

The store is intended for adults making purchases, not directed to children under 13, and we do not knowingly collect their information. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

10. Changes to this notice

The date above identifies this version. We will provide additional notice or request fresh consent when required for a material change. A policy update does not itself authorise a new optional tracking purpose.