Privacy policy

Last updated 21 October 2026

This policy explains what personal information Omorfia collects, why, who we share it with, and what you can do about it. We follow the Privacy Act 2020.

1. Who holds your information

Omorfia is a trading name of the owner's full name, or your company name, a postal address (a PO Box is fine). The Privacy Act asks us to say who holds your information and where.

2. What we collect

• When you order: your name, email address, delivery address, phone number if you give one, what you bought, what you paid, any offer code you used and any gift message you add. If you send a gift, we also collect the recipient's name and address, so please make sure they're happy for you to share them.
• If you subscribe: your chosen formula, delivery frequency, billing dates and payment status.
• Payments: handled by Stripe. We never see or store your full card number. Stripe tells us the type of card and its last 4 digits, and whether a payment succeeded.
• If you start a checkout and don't finish it: the email address and items in that checkout, which we can see in our records, to understand where checkout goes wrong and to help if you contact us.
• When you browse: which pages you visit, how long you spend on them and how far you scroll, which formulas you look at, whether you use the skin quiz, what you add to or remove from your cart, the site or ad that sent you here, your device, browser, operating system, language and screen size, and roughly where you are (city, region and postcode area) and your internet provider's name, worked out from your connection. Our own records keep these against a random visitor number stored in your browser. We don't store your IP address with them.
• If you sign up for our offer or newsletter: your email address, where you signed up, and the offer we sent you. When you sign up or sign in, we link your email to the visitor number in that browser.
• If you create an account: your email address. The sign-in codes we email you, and the session that keeps you signed in, are stored only in scrambled (hashed) form.
• If you refer a friend: your share code, which orders used it, and the rewards you've earned and used.
• If you ask us to tell you when a formula is back in stock: your email address and which formula.
• If you claim on our First-jar promise: your order details, your delivery address, and what you tell us about it.
• When your order is sent: the courier and tracking number, which we show in your account.
• When you contact us: whatever you tell us, such as details of a problem with an order.
• To stop misuse of our forms: when you use a form that limits repeated attempts, such as the First-jar promise or back-in-stock forms, we keep a scrambled (hashed) version of your IP address to count attempts, not the address itself.

You don't have to give us your information, but we can't take, send or support an order without your name, email address and delivery address. Most of this comes from you. Some comes from Stripe (your order and payment details), our courier (delivery updates) and our analytics providers.

3. Why we use it

• To process, send and track your orders and subscriptions, and to run your account.
• To answer questions and handle returns, refunds, First-jar promise claims and problems.
• To run our offers and refer a friend scheme, and to check who is eligible for them.
• To see how people use the website and our ads so we can improve them. This includes looking at each visitor's path through the site, and sorting visitors into broad groups based on it, such as people who looked around or who left something in their cart. If we know your email, this is linked to it. We don't use these groups to change the prices you see.
• To send the back-in-stock alerts you ask for and, only if you've agreed, marketing emails.
• To prevent fraud and misuse, respond to payment disputes, enforce our terms and keep the records the law requires.

We don't sell your personal information.

4. Automated checks on offers and claims

To keep offers and the First-jar promise fair, our website checks some things automatically:

• it compares email addresses in a standard form, ignoring capital letters, "+" tags and, for Gmail, dots, so addresses that reach the same inbox count as one customer
• it compares delivery addresses (the first line and postcode) with earlier orders and claims, for example to spot referrals to yourself or a second claim from the same address
• it checks your order history with Stripe, for example whether you've ordered before
• it counts attempts from the same connection, using the scrambled IP address described above.

These checks decide whether a code works on an order. First-jar promise claims are always reviewed by a person before they're refunded or declined. If you think a check got it wrong, message us and a person will look at it.

5. Who we share it with

We share only what each service needs to do its job:

• our payment provider, Stripe, to take payment, run subscriptions and the customer portal, and prevent fraud
• NZ Post, CourierPost, NZ Couriers, Aramex or another New Zealand courier, to deliver your order
• our email provider, Resend, to send account sign-in codes, order and delivery emails, the back-in-stock alerts you ask for and, if you've agreed, marketing such as your welcome offer
• Cloudflare, which hosts this website and its database and protects it from attacks
• Google Analytics and PostHog, which tell us how the website is used. If you enter your email for the welcome offer, PostHog links your visits to that email. Google never receives it.
• Meta (Facebook and Instagram), through the Meta Pixel, which tells us which of our ads led to a visit, a cart add or an order, and lets us show our ads to people who have visited. Meta receives the pages you view and what you add to your cart or buy, not your email.

Google, Meta and our payment provider also receive the technical details your browser sends, such as your IP address and their own cookies, and use them under their own privacy policies. We may also share information with our professional advisers, with your bank or our payment provider in a payment dispute, with a business that takes over Omorfia, or where the law requires or allows it, for example to prevent fraud or to help the police.

6. Information stored overseas

Some of these services store or process information outside New Zealand, including in the United States, Japan, Australia and Europe. Where a provider only stores or processes information for us, we remain responsible for it under the Privacy Act. Where a provider uses information for its own purposes, such as Google and Meta for analytics and advertising, or Stripe to prevent fraud, we use well-known providers that commit to protecting personal information in their contracts and privacy policies, which we believe gives protection comparable to the Privacy Act. You can limit what Google and Meta receive by blocking their cookies (see section 7).

7. Cookies

• Needed for the site to work: your browser keeps your cart and any offer code, and a cookie keeps you signed in to your account for 30 days. If we're testing a new design, a cookie also remembers which version you see.
• Analytics: we use analytics cookies and similar browser storage from Google Analytics and PostHog, and our own random visitor number, to count visits and see which pages and products people use.
• Advertising: we use the Meta Pixel, an advertising cookie, to measure our Facebook and Instagram ads.
• Payment: our checkout and payment provider may also use cookies that are needed for payment to work and to prevent fraud.

You can block or clear cookies in your browser settings. The shop still works without the analytics and advertising ones, but you'll need to sign in to your account again.

8. Marketing emails

• We only send marketing emails, such as the welcome offer and referral rewards, if you've signed up or otherwise agreed to receive them.
• Every marketing email clearly comes from Omorfia and includes an unsubscribe link, and you can always reach us through our contact form. Unsubscribing takes effect straight away, and always within 5 working days. It also cancels any back-in-stock alerts still waiting for that email.
• You can also opt out at any time through our contact form. If you sign up again later, you're opted back in.
• Opting out doesn't stop emails about your orders, subscription, account or claims, such as sign-in codes, receipts, delivery updates and how-to emails for your order.

9. How long we keep it

We keep order and payment records for 7 years, as New Zealand tax law requires. Sign-in codes expire after 10 minutes and account sessions after 30 days. We keep other information only as long as we need it for the reasons above, for example to apply our offer and First-jar promise rules or to deal with a dispute, then delete it or remove the details that identify you.

10. Keeping it safe

We take reasonable steps to protect your information from loss, misuse and unauthorised access, for example by limiting who can see it, protecting our admin tools with a password and storing sign-in codes only in scrambled form. If a privacy breach happens that is likely to cause serious harm, we'll tell you and the Privacy Commissioner as soon as practicable, as the law requires.

11. Children

Our website isn't aimed at children. You must be 18 or over to order, or have a parent's or guardian's permission. We don't knowingly collect information from children without that permission. If you think we have, please tell us and we'll delete it.

12. Your rights

You can ask to see the personal information we hold about you, and ask us to correct it. Send us a message through our contact form and choose "Privacy or my information". We'll check it's you before we share or change anything, and we'll respond within 20 working days. If we don't agree to a correction, you can ask us to note your request with the information.

If you're not happy with how we've handled your information, please tell us first. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If a change significantly affects how we use information we already hold, we'll tell you by email or on our site before it applies.