Your position: Home > Privacy Policy

Privacy Policy

Last updated: September 2026

This Privacy Policy explains what personal information Zhithera., Limited ("Zhithera", "we", "us") collects when you visit zhithera.shop, buy from us, or contact our team — and what we do with it.

We keep this deliberately short on jargon. If anything here is unclear, write to [email protected] and we will explain it in plain terms.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use it to profile you by health status.

1. Who we are

Zhithera is a home-fragrance brand. We design waterless micro-mesh diffusers and the essential oils and fragrance oils made for them, and we sell them directly to customers through zhithera.shop. There is no marketplace and there are no third-party sellers on this Website — when you buy here, you buy from us.

The company responsible for your personal information (the "controller", in the language of European law) is:

Zhithera., Limited
5/F, Yau Lee Centre, 45 Hoi Yuen Road, Kwun Tong, Hong Kong
[email protected]

This policy covers the Website, our customer-service channels, and the marketing email we send. It does not cover sites we do not operate — see section 14.

2. Information we collect

2.1 Information you give us

Order details — name, shipping and billing address, email address, telephone number, and what you bought.
Account details — email address and password, plus anything you choose to save such as an address book.
Payment details — handled by our payment providers. Zhithera does not receive or store your full card number.
Contact and support — the content of your messages, including photos or video you send us for a warranty or return claim.
Marketing preferences — your email address if you subscribe, and whether you have opted in or out.
Reviews — the name or display name and content you choose to publish.

2.2 Information collected automatically

Device and connection data — IP address, browser type and version, operating system, and language.
Usage data — pages viewed, referring page, time on page, and products viewed or added to a cart.
Cookies and similar technologies — described in our Cookie Policy. Non-essential cookies load only after you accept them.

2.3 What we do not collect

We do not ask for and do not want special category or sensitive data — information about health, religion, ethnicity, political opinions, precise geolocation, or biometrics. Please do not include such details when you contact us.

In particular, we do not collect health information and we do not profile customers by health status. Zhithera products are home-fragrance products. They are not medical devices, they are not sold or described as treating any condition, and nothing we collect is used to infer one.

3. How we use it, and our legal basis

The "legal basis" column applies where UK or EU data protection law governs the processing. If you are in the United States, see section 8.3 and section 9.

Purpose	Legal basis (UK/EU GDPR)
Processing and delivering your order; handling returns, refunds and warranty claims	Performance of a contract
Managing your account and answering your enquiries	Performance of a contract; legitimate interests
Fraud prevention, security, and protecting the Website	Legitimate interests; legal obligation
Understanding how the Website is used so we can improve it	Consent (analytics cookies) or legitimate interests
Sending marketing emails about products and offers	Consent; or legitimate interests for existing customers, subject to opt-out
Measuring advertising and referrals, where you have accepted marketing cookies	Consent
Keeping tax, accounting and customs records	Legal obligation

4. Who we share it with

We share personal information only with service providers who need it to do a job for us, and only for that job. They act on our instructions and may not use your information for their own purposes. The categories, and the providers we currently rely on, are:

Payment providers — Stripe and PayPal, to take payment and process refunds. They receive your payment and billing details directly; we receive only a result and the last digits of the card.
Shipping and fulfilment partners and carriers — including China Post, USPS and DHL, to pick, pack, ship and deliver your order, and to clear customs where required.
Email and marketing platforms — Mailchimp, to send order notifications and, where you have subscribed, marketing email.
Analytics — Matomo, which we host on our own servers rather than sending your browsing data to a third party.
Advertising and measurement — Google (Tag Manager, Analytics and Ads) and Pinterest. These load only after you accept marketing cookies, and your choice is passed to Google directly through Consent Mode.
Affiliate programme — GoAffPro, to attribute referrals to the partner who introduced you.
Customer messaging — SalesMartly, to run live chat and support conversations. Live chat is treated as a necessary service so that you can always reach us, including if you decline non-essential cookies.
IT, hosting and security — our hosting provider and Cloudflare, to run and protect the Website.

We may also disclose information where we are required to by law, to enforce our terms, or in connection with a merger, acquisition or sale of assets — in which case we will tell you.

We do not sell personal information, and we do not disclose it to third parties for their own advertising purposes.

5. International transfers

Zhithera., Limited is established in Hong Kong. Orders are fulfilled from our warehouse in Hong Kong and from mainland China, and are then carried to you by international postal and courier services. Our service providers are located in several countries, including the United States and the European Union.

Your information may therefore be transferred to and processed in a country other than your own, including countries that may not offer the same level of data protection as your home country.

Where we transfer personal information out of the UK, EEA or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with additional measures where needed.

6. How long we keep it

Order and transaction records — for as long as needed to complete the order, then for the period required by tax, accounting and customs law.
Account data — while your account is open, and for a short period afterwards.
Support correspondence — normally up to 24 months after the matter is closed.
Marketing data — until you unsubscribe, plus a suppression record so we do not contact you again.
Consent records — a record of what you agreed to and when, kept for as long as we need to evidence it.
Analytics data — in aggregated or de-identified form beyond the retention period set in the tool.

When we no longer have a legitimate need for your information, we delete it or make it anonymous.

7. How we protect it

The Website is served over encrypted connections (TLS). Access to customer data is limited to staff who need it, payment card data is handled by PCI-compliant providers rather than by us, and our systems are patched and monitored.

No method of transmission or storage is completely secure. If a breach occurs that is likely to present a risk to you, we will notify you and the relevant authority as required by law.

8. Your rights and choices

8.1 Everyone

Whatever your location, you may ask us to:

Give you a copy of the personal information we hold about you;
Correct information that is wrong or incomplete;
Delete information we no longer need;
Stop sending you marketing email.

8.2 UK, EEA and Switzerland

You additionally have the right to restrict or object to processing, the right to data portability, and the right to withdraw consent at any time without affecting processing already carried out. You may also lodge a complaint with your local supervisory authority.

8.3 United States residents

Depending on where you live, state privacy law may give you the rights below. We extend all of them to every US resident, whether or not your state has passed such a law.

Know and access — the categories and specific pieces of personal information we have collected, the purposes, the categories of sources, and the categories of third parties we disclose to. Section 9 sets this out in advance.
Delete — subject to exceptions such as completing a transaction or meeting a legal obligation.
Correct — inaccurate personal information.
Portability — a copy in a portable, readily usable format.
Opt out of sale or sharing — we do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We will say so plainly here if that ever changes.
Limit the use of sensitive personal information — we do not collect sensitive personal information (see section 2.3), so this right does not arise.
No retaliation — exercising any of these rights will never result in a worse price, a worse service level, or any other penalty.

Global Privacy Control. We honour the Global Privacy Control (GPC) browser signal. If your browser or extension sends GPC, we treat it as a valid opt-out of sale and of sharing for cross-context behavioural advertising: advertising and personalisation cookies are switched off for that browser automatically, and you do not need to contact us or click anything. Our own site analytics is first-party software that we host ourselves, is not a sale or share, and stays under your separate control. If you later choose to switch advertising cookies back on yourself while GPC is active, we treat that as your express instruction and respect it.

How to exercise the opt-out choices. Non-essential cookies do not load at all until you accept them, and you can withdraw that acceptance at any time from the cookie settings link in the footer. Where advertising and analytics tools are used, we signal your choice to them directly through Google Consent Mode, so your decision applies at source rather than after the fact.

Authorised agents. You may use an authorised agent to make a request on your behalf. We will ask the agent for written proof of authorisation and may still ask you to confirm the request directly.

These rights come from laws including the California Consumer Privacy Act as amended by the CPRA, and comparable statutes in Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states. Residents of any US state may use the process in section 8.4.

8.4 Making a request

Email [email protected]. We may need to verify your identity — usually by confirming details of a recent order. We respond within 45 days where US state law applies and within one month where UK or EU law applies, and will tell you if we need longer because the request is complex. There is no charge for a reasonable request.

If we decline a request, we will tell you why and how to appeal. Several US states give you the right to appeal a refusal; to do so, reply to our decision and we will review it and respond within the period that state law allows.

9. Categories of personal information

This section is the advance disclosure required by California and several other US states. It describes the last 12 months.

Category	Do we collect it?	Why, and who we disclose it to
Identifiers — name, postal address, email, phone, IP address, account ID	Yes	To fulfil orders, run your account and secure the site. Disclosed to payment, shipping, email, hosting and security providers.
Customer records — billing and delivery address, payment result	Yes	To take payment and deliver goods. Disclosed to payment and shipping providers.
Commercial information — products viewed, cart contents, order history, reviews	Yes	To fulfil orders, provide support and improve the range. Disclosed to analytics and support providers.
Internet activity — pages viewed, referring page, interaction with the site	Yes	To measure and improve the Website. Disclosed to analytics providers, and to advertising providers only with your consent.
Audio, electronic or visual information — photos or video you send with a warranty or return claim	Yes, only if you send it	To assess your claim. Not disclosed except to a carrier or insurer where the claim requires it.
Inferences — preferences drawn from browsing or purchase history	Limited	To recommend products on the Website. Not disclosed for third-party advertising.
Sensitive personal information — precise geolocation, health, race, religion, biometrics, government ID, account credentials of other services	No	Not collected. See section 2.3.
Personal information of children under 16	No	Not collected knowingly. See section 13.

We collect these categories from you directly, from your device when you browse, and from our payment and shipping providers when they report the outcome of a transaction. We have not sold or shared any of these categories in the last 12 months.

10. Marketing communications

You can unsubscribe from marketing email at any time using the link in any message, or by emailing us. We honour unsubscribe requests promptly and in any event within ten business days, and we keep the opt-out in place permanently.

Every marketing email we send identifies Zhithera as the sender, carries a subject line that reflects its content, is identifiable as an advertisement, and includes our postal address — the requirements of the US CAN-SPAM Act.

We do not send marketing text messages. If we ever do, we will obtain your prior express written consent first, will not make it a condition of purchase, and will support STOP and HELP replies, as the US Telephone Consumer Protection Act requires.

Unsubscribing does not stop transactional messages such as order confirmations, dispatch notices and warranty correspondence, which are part of fulfilling your order.

11. Cookies and tracking

We use cookies and similar technologies to run the Website, remember your cart and preferences, and understand how the site is used. Non-essential cookies load only after you accept them, and you can change your choice at any time from the cookie settings link in the footer.

What each cookie does, and how to control them, is set out in our Cookie Policy.

12. Your responsibilities

Keep your account secure. Choose a password you do not use elsewhere and do not share it. Tell us immediately if you think someone else has used your account.
Give us accurate delivery details. We cannot redirect a parcel that has been despatched to an address you entered incorrectly.
Do not send us sensitive information. When you contact support, please leave out health details, identification documents and card numbers. We will never ask for your full card number or your password.
Respect other people's information. If you ship an order to someone else, please make sure they are content for you to give us their name and address.

13. Children

The Website is intended for adults. We do not knowingly collect personal information from children under 16, and we do not sell or share the personal information of anyone under 16 under any circumstances. If you believe a child has provided us with personal information, contact us and we will delete it.

14. Other websites

Our pages may link to sites we do not operate, including our profiles on social platforms. Those sites have their own privacy practices, and we are not responsible for them. Please read their policies before providing personal information.

15. Changes to this policy

We update this policy as our business and the law change. The revised version takes effect when posted and the "last updated" date changes. Where a change materially affects how we handle your information, we will take reasonable steps to notify you.