Privacy policy
Last updated: May 23, 2026
1. OVERVIEW
This Privacy Policy describes how Cradlux ("Company," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit, use, or make a purchase from our website or otherwise interact with our services (the "Services").
Our online store is hosted by Shopify Inc., which provides the ecommerce platform enabling us to sell our products and services. Shopify acts as a data processor on our behalf.
2. DATA CONTROLLER
Data Controller:
Jakob Leuchtweis
Neuhauser Straße 7a
78576 Emmingen-Liptingen
Germany
Email: support@cradlux.com
3. PERSONAL INFORMATION WE COLLECT
Information you provide directly
Name
Billing and shipping address
Email address and phone number
Order and payment details
Customer support communications
Information collected automatically
IP address
Browser, device, and operating system information
Website usage and interaction data
Cookies and similar tracking technologies
We do not knowingly collect sensitive personal data.
4. LEGAL BASES FOR PROCESSING (GDPR)
We process personal data based on the following legal grounds:
Performance of a contract (order processing and fulfillment)
Compliance with legal obligations
Legitimate interests (fraud prevention, analytics, service improvement, marketing)
Consent (email/SMS marketing and certain tracking technologies)
5. HOW WE USE PERSONAL INFORMATION
We use personal information to:
Process and fulfill orders
Provide customer support
Send transactional communications
Improve and optimize our Services
Prevent fraud and abuse
Comply with legal and regulatory obligations
Conduct marketing and advertising activities
6. CATEGORIES OF PERSONAL INFORMATION (CCPA / CPRA)
Within the past 12 months, we have collected the following categories:
Identifiers (e.g., name, email address, IP address)
Commercial information (e.g., purchase history)
Internet activity (e.g., website interactions)
Approximate location data (derived from IP address)
Inferences used for analytics and marketing
Sale and Sharing of Personal Information
We do not sell personal information for monetary consideration.
We may share certain personal information with advertising and analytics partners for purposes such as measuring advertising performance and delivering relevant ads, which may be considered "sharing" under California law.
You have the right to opt out of such sharing.
7. TRACKING, COOKIES AND ADVERTISING
We use cookies, pixels, and similar technologies, including but not limited to:
Meta Pixel
Google Ads
TikTok Pixel
Microsoft Clarity
Shopify Analytics
Triple Whale
Microsoft Clarity is a behavioral analytics tool that may record mouse movements, clicks, and scroll behavior to help us understand how visitors interact with our website. This data is processed by Microsoft and subject to Microsoft's privacy practices.
These technologies help us analyze site usage, measure advertising effectiveness, and deliver relevant advertisements.
Where required by applicable law (including the GDPR and the ePrivacy Directive), tracking technologies are deployed only after user consent via a cookie consent mechanism.
We honor Global Privacy Control (GPC) signals where legally required.
8. PAYMENT PROCESSORS
Payments are processed by secure third-party payment providers.
We do not store full credit card numbers or sensitive payment credentials on our servers.
9. DISCLOSURE OF PERSONAL INFORMATION
We may share personal information with:
Shopify and ecommerce service providers
Payment processors
Fulfillment and shipping partners
Advertising and analytics providers
Legal or regulatory authorities when required by law
All service providers process personal data under contractual obligations consistent with applicable privacy and data protection laws.
10. DATA RETENTION
We retain personal information only for as long as necessary for the purposes described in this Policy or as required by law:
Order and transaction data: up to 7 years
Customer support communications: up to 3 years
Marketing data: until consent is withdrawn or opt-out occurs
Analytics data: up to 26 months
Legal or regulatory obligations may require longer retention periods in certain cases.
11. YOUR RIGHTS UNDER GDPR
If you are located in the European Economic Area (EEA), you have the right to:
Access your personal data
Correct inaccurate or incomplete data
Request deletion of your data
Request data portability
Restrict or object to certain processing activities
You also have the right to lodge a complaint with your local data protection authority.
12. U.S. PRIVACY RIGHTS
Residents of certain U.S. states (including California, Colorado, Virginia, and others) may have the right to:
Request access to or deletion of personal data
Opt out of targeted advertising or data sharing
Limit certain data uses
Requests may be submitted by contacting support@cradlux.com.
We may verify your identity before processing requests and may require additional information for security purposes. Authorized agents may submit requests on your behalf where permitted by law.
We will respond within the timeframes required by applicable law and will not discriminate against users for exercising their privacy rights.
13. INTERNATIONAL DATA TRANSFERS
Personal data may be transferred to countries outside your country of residence.
Where required, such transfers are safeguarded through Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.
14. SECURITY
We implement reasonable administrative, technical, and organizational safeguards designed to protect personal information.
However, no method of transmission over the internet or electronic storage is completely secure.
15. CHILDREN'S PRIVACY
Although the Cradlux device is intended for use in infant nurseries, the Services — including this website — are directed exclusively at adults (parents, caregivers, and gift buyers). The Services are not directed at children under the age of 13.
We do not knowingly collect personal information from children under 13. If such data is identified, it will be deleted promptly.
This Policy does not create any obligation under the Children's Online Privacy Protection Act (COPPA) with respect to online collection of data from child visitors, as the Services are not directed at children and we do not have actual knowledge that we are collecting data from users under 13.
16. AUTOMATED DECISION-MAKING
We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.
17. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time.
Any changes will be posted on this page with an updated "Last updated" date.
18. CONTACT
For privacy-related inquiries or to exercise your rights, contact:
Email: support@cradlux.com