Privacy policy

ScareEm is run by Nembrix. Nembrix decides how your data is used and is responsible for it. Contact: agents@nembrix.com.

When you order: your name, email address, delivery and billing address, and phone number. We need these to deliver your order and to contact you about it.

Card details are entered directly into Stripe's checkout and never reach our servers. We only see the card brand and last four digits.

When you email us: whatever you choose to write, kept so we can answer you and handle any follow-up.

When you browse: we count visits, to improve the shop and to see which ads bring people here. Each page view records the page (not the full address), your country, the type of device and browser, and, on the first page of a visit, the site or ad you came from. It doesn't include your IP address, name or email. To tell how many different people visited in a day, we use a code made from your connection and browser that changes every day and can't be turned back into either, so it can't follow you from one day to the next. Visitors who send a Do Not Track or Global Privacy Control signal aren't counted.

If you create an account: your name, your email address and your password. We store the password only as a scrambled (hashed) value that nobody, including us, can read back. Your account page shows the orders placed with your email, read from our payment provider.

If you review something you bought: your star rating, what you wrote, the product and size, the country it was delivered to and, only if you leave the box ticked, your first name and the first letter of your surname. Reviews are public, on the product's page. We keep no copy of your order number with a review, only a code that stops the same order reviewing a product twice.

Order data is used because it's necessary to perform our contract with you: we can't deliver a costume without an address. Account data is used because you asked us for an account. A review is published because you chose to write it; writing one is never required, and we don't email you again to ask.

Support emails are handled on the basis of our legitimate interest in running the shop, and so is counting visits: it's anonymous in practice, sets no cookie and stores nothing on your device. We keep order records because tax and accounting law requires it.

Stripe, to take your payment.

Our fulfilment partner and the couriers it uses, which receive your name, delivery address and phone number so they can send your order to you.

Resend, our email provider, to send order, shipping and account emails, and Vercel, which hosts this website and stores account data in its Frankfurt (Germany) data centre.

Upstash, the database service (connected through Vercel) that keeps the anonymous visit records described above.

If you accept advertising cookies (see Cookies and storage), Meta, TikTok and Google receive what their tags collect on this site: the pages you view, what you add to your bag and, when you buy, the order value and number. They use it to measure our ads and to show you ours. Without your consent, none of this is sent.

Each receives only what it needs for its job. We don't sell personal data. Some of these providers are based outside the EU or use services there; we only use providers that commit to protecting personal data to the standard EU data-protection law requires.

Order records are kept for as long as tax and accounting law requires, which can be up to 10 years.

Support emails are kept for two years after your last message.

Individual visit records are deleted after 35 days. Only daily totals, which contain nothing about any one person, are kept after that.

Accounts are kept until you delete yours (on your account page, straight away) or ask us to.

A review stays on the product's page until you ask us to remove it, or replace it by writing a new one from the same link.

You can ask for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Email agents@nembrix.com and we'll respond within 30 days.

We honour deletion requests except where the law requires us to keep order records; in that case we limit them to accounting use only.

If you're unhappy with how we've handled your data, you can complain to the data-protection authority in your country.

Advertising and analytics cookies (Meta Pixel, TikTok Pixel and Google tags) are set only if you choose Accept in the cookie banner. You can change your mind at any time with Cookie settings at the bottom of every page. Without consent we set none of them.

Counting visits sets no cookie and stores nothing on your device, so it doesn't depend on the cookie banner.

Your browser stores what's in your treat bag (product and size identifiers only, no personal data) and your cookie choice; neither leaves your device.

Stripe sets its own cookies during checkout to prevent fraud. They're necessary for payment to work.

If you sign in to an account, we set one necessary cookie that keeps you signed in for up to 30 days. It holds a signed sign-in token, nothing that tracks you, and it's removed when you sign out.