Privacy Policy | NORONEL

What we collect

Account details (optional for shoppers): your name, email address and sign-in information. Passwords are handled by our authentication provider and are never visible to us. If you choose Google sign-in, Google shares your name and email with us.
Wishlist: the products you save, linked to your account.
Orders: at checkout our checkout partner collects your name, email, shipping address, payment details and order contents. NORONEL can see order details such as items, status, totals and email address so we can provide support, and we show signed-in customers the orders that match their account email. We never receive your full card number.
Author applications and partnerships: your legal and pen name, email, story details, signed applications and agreements, design files and feedback, and royalty and payout records.
Messages you send us, and technical data such as your IP address, browser type and request logs kept by our hosting provider for security.
On your device: your bag is stored in your browser’s local storage, and signing in stores a session so you stay signed in. We don’t use advertising cookies or third-party analytics.

How we use it

To show the store, process and deliver your orders, and help with order problems.
To run accounts, wishlists and password resets.
To run the author programme: reviewing applications, contracts, designs, royalties and payouts.
To keep the site secure and prevent fraud.
To meet legal, tax and accounting obligations.

We only send account and order-related emails. We won’t send marketing emails unless you choose to receive them.

Legal bases (UK, EU and EEA)

We process data to perform our contract with you (orders, accounts, author agreements), for our legitimate interests in running and securing the store, to comply with legal obligations, and with your consent where we ask for it. You can withdraw consent at any time.

Who we share it with

We don’t sell your personal information. We share it only with service providers who help us run NORONEL, under contracts that limit how they use it:

our checkout, payment and production/fulfillment partners, who process and ship your order;
Supabase, which provides customer sign-in and stores account data;
our website hosting and email delivery providers;
Google, if you choose Google sign-in, and Google Fonts, which loads our typefaces and receives your IP address when you visit.

We may also share information if the law requires it, to protect rights and safety, or as part of a sale or reorganisation of the business.

International transfers

Our providers may process information in the United States and other countries. Where required, transfers are protected by safeguards such as standard contractual clauses.

How long we keep it

Account and wishlist data: until you delete your account or ask us to.
Order records: as long as needed for support, tax and accounting law, usually up to seven years.
Author records, agreements and payout records: for the length of the partnership and as long afterwards as legal and tax rules require.
Security logs: for a short period, unless needed to investigate abuse.

Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your information, object to or restrict how we use it, and withdraw consent. California residents can ask what we collect and request deletion; we don’t sell or share personal information for cross-context advertising. To make a request, email our contact page. You can also complain to your local data protection authority.

Children

NORONEL isn’t directed at children. Please don’t create an account if you are under 16; if you think a child has given us information, contact us and we’ll delete it.

Security

We use encrypted connections, verified sign-in, and limited access to personal data. No method is perfectly secure, so please use a strong, unique password.

Changes

We’ll update this policy when our practices change and show the new date below.

Last updated October 13, 2026.