Scalyx Inc. ("Scalyx", "we", "us", or "our") operates the Laura Rose Jewelry privacy platform on behalf of retail businesses ("Retailers") that use our software. This Privacy Policy explains how Scalyx and Retailers collect, use, disclose, and protect personal information about consumers ("you") who interact with Retailer storefronts, websites, or applications powered by the Laura Rose Jewelry platform.
Who controls your data? The Retailer you purchased from or interacted with is the primary data controller. Scalyx acts as a service provider (under CCPA) and data processor (under GDPR) on the Retailer's behalf. For data requests, you may submit directly via this portal and we will coordinate with the applicable Retailer.
1. Information we collect
Information you provide directly Name, email address, phone number, and mailing address Purchase history, transaction records, and order details Payment information (processed and stored by our PCI-compliant payment partners; Scalyx does not store full card numbers) Account credentials if you create a customer account with a Retailer Communications you send to Retailer staff or customer service Repair, customisation, or special order requests Loyalty programme membership and redemption history Information collected automatically Device identifiers, IP address, and browser type when you visit a Retailer's website Pages viewed, time spent, and navigation patterns (analytics) Cookie and tracking technology data (see our Cookie Notice) Information from third parties Fraud prevention and identity verification services Credit and financing providers (e.g. Synchrony Financial) if you apply for in-store financing Social media platforms if you interact with a Retailer's social presence Sensitive personal information (CPRA) We may collect the following categories of sensitive personal information: precise geolocation (if you use store locator features with location enabled), and financial account information for financing applications. We use sensitive personal information only for the purpose it was collected and do not sell or share it for advertising purposes.
2. How we use your information
Fulfilling orders and providing services — processing purchases, repairs, and special orders Customer support — responding to enquiries, complaints, and service requests Account management — creating and maintaining your customer account and loyalty profile Marketing communications — sending promotional emails, SMS, or catalogues where you have opted in or where permitted by applicable law Analytics and improvement — understanding how customers use Retailer services to improve them Fraud prevention and security — detecting and preventing fraudulent transactions Legal compliance — meeting our obligations under applicable law, including tax and consumer protection requirements Personalisation — recommending products or services based on your purchase history and preferences, where you have not opted out.
3. How we share your information
Service providers We share personal information with companies that provide services on our behalf, including payment processors, cloud hosting providers, email delivery services, analytics providers, and fraud detection services. These parties are contractually restricted from using your data for any purpose other than providing services to us. Retailers If you submit a data request through this portal, your information will be shared with the Retailer whose data we are processing on your behalf. Business transfers If Scalyx is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a notice on our website prior to your information being transferred and becoming subject to a different privacy policy. Legal requirements We may disclose your information where required by law, court order, or governmental authority, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others. We do not sell your personal information Scalyx does not sell your personal information to third parties for monetary consideration. California residents may exercise their right to opt out of sharing for cross-context behavioural advertising using the Data Request form.
4. Cookies and tracking
We use cookies and similar tracking technologies on Retailer websites. For detailed information about the types of cookies used, how to manage your preferences, and your opt-out options, please see our Cookie Notice.
5. Data retention
We retain personal information for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law. Typical retention periods are: Transaction records: 7 years (tax and accounting requirements) Customer account data: duration of the account relationship plus 3 years Marketing consent records: 3 years from last interaction Data request records: 2 years (legal compliance) Website analytics: 26 months (rolling) When you request deletion of your personal information, we will delete or anonymise it within 45 days, except where retention is required by law (e.g. transaction records for tax purposes).
6. Your privacy rights
Depending on your state of residence, you may have the following rights regarding your personal information. Submit a request via our Data Request form.
STATE
LAW
YOUR RIGHTS
RESPONSE WINDOW
California
CCPA / CPRA
Access, deletion, correction, portability, opt-out of sale/sharing, limit sensitive PI use, right to non-discrimination
45 days (extendable to 90)
Virginia
VCDPA
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Right to appeal within 45 days of denial
45 days (extendable to 45)
Colorado
CPA
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Right to appeal within 45 days
45 days (extendable to 45)
Connecticut
CTDPA
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Right to appeal within 45 days
45 days (extendable to 45)
Texas
TDPSA (eff. Jul 2024)
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Right to appeal
45 days (extendable to 45)
Oregon
OCPA (eff. Jul 2024)
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Right to appeal
45 days (extendable to 45)
Montana
MCDPA (eff. Oct 2024)
Access, deletion, correction, portability, opt-out of sale/sharing, limit sensitive PI use, right to non-discrimination
45 days (extendable to 45)
Montana
MCDPA (eff. Oct 2024)
Access, deletion, correction, portability, opt-out of sale/sharing, limit sensitive PI use, right to non-discrimination
45 days (extendable to 45)
Delaware
DPDPA (eff. Jan 2025)
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Right to appeal
45 days (extendable to 45)
Iowa
ICDPA (eff. Jan 2025)
Access, deletion, portability, opt-out of sale & targeted advertising. Note: no correction right or profiling opt-out under this law. Right to appeal
90 days
Nebraska
NDPA (eff. Jan 2025)
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Right to appeal
45 days (extendable to 45)
New Hampshire
NHPA (eff. Jan 2025)
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Right to appeal
45 days (extendable to 45)
New Jersey
NJDPA (eff. Jan 2025)
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Right to appeal
45 days (extendable to 45)
Tennessee
TIPA (eff. Jul 2025)
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Right to appeal within 60 days of denial
45 days (extendable to 45)
Minnesota
MHMDA (eff. Jul 2025)
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Strong health data protections. Right to appeal
45 days (extendable to 45)
Maryland
MODPA (eff. Oct 2025)
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Sale of sensitive data prohibited. Data minimisation required. Right to appeal
45 days (extendable to 45)
Indiana
IDCPA (eff. Jan 2026)
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Right to appeal
45 days (extendable to 45)
Kentucky
KCDPA (eff. Jan 2026)
Access, deletion, correction, portability, opt-out of sale, targeted advertising & profiling. Right to appeal
45 days (extendable to 45)
All other states
Company policy
We honour access, deletion, and correction requests from all US residents as a matter of policy
45 days
California Shine the Light — Civil Code §1798.83 California residents may request once per calendar year, free of charge, the categories of personal information we disclosed to third parties for their direct marketing purposes in the preceding year, and the names of those third parties. Submit a request via our Data Request form and note "Shine the Light" in the details field.
How to exercise your rights Submit a request through our Data Request form. We will verify your identity before fulfilling any request by matching your submission against records on file. For deletion or sensitive requests, we may send a one-time verification code to your email address. You will not be discriminated against for exercising your privacy rights. We will not deny you goods or services, charge you different prices, or provide you a different level of service because you exercised a right under applicable privacy law. Authorised agents You may designate an authorised agent to make a request on your behalf. We may require written authorisation or a signed power of attorney before fulfilling such requests, consistent with CCPA §1798.130(a)(3)(B) and equivalent state law requirements.
7. International transfers
Scalyx is based in the United States. If you are located outside the US, please be aware that your personal information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. By using Retailer services powered by Laura Rose Jewelry, you consent to this transfer.
8. Children's privacy
Our services are not directed at children under 13 (or under 16 in California). We do not knowingly collect personal information from children under these ages. If you believe we have inadvertently collected information from a child, please contact us at privacy@Laura Rosejewelry.com and we will promptly delete it.
9. Security
We implement industry-standard technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These include encryption in transit (TLS 1.2+) and at rest, access controls, and regular security assessments. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date above. For significant changes, we will provide additional notice, such as an email notification. Your continued use of Retailer services after changes take effect constitutes your acceptance of the revised policy.
11. Contact us
For privacy-related questions or to exercise your rights, please use our Data Request form or contact our Data Protection Officer: Email: privacy@Laura Rosejewelry.com DPO contact form: Contact DPO Mailing address: Scalyx Inc., Privacy Officer, [Address], United States
