Last updated 14 October 2026
This policy explains what we collect when you use aerieloom.com or shop with us, why we collect it, and what we do with it. It is written to be read, not to be survived.
Aerie Loom Studio Ltd, trading as Aerie Loom, of Shop G01, Novare Lekki Mall, Sangotedo, Lagos, is the data controller. We handle personal information in line with the Nigeria Data Protection Act 2023.
When you place an order: your name, email address, phone number and delivery address. We need these to take the order, deliver it and contact you if something changes.
When you create an account: your name, email address and password. Your password is never visible to us; it is stored by our authentication provider in a form that cannot be read back.
When you start a checkout and do not finish: the details you typed and what was in your bag. If the order is still unpaid an hour later, we send you one email with a link back to it, and a member of our team may message you once, on the number you gave, to ask if you need help. Nothing more.
News and new arrivals: only if you tick the box at checkout or tell us yes in the store. We record when you said yes. Say stop at any time, by replying to any message or telling us in the store, and we stop that day.
On this device: if you leave "Remember my details on this device" ticked at checkout, your name, contact details and address are saved in your own browser so the form fills itself next time. They stay on your device for 30 days; untick the box, or tap "Not you?", to clear them sooner.
Address suggestions at checkout: as you type in the address box, the words you have typed so far are sent to Photon (photon.komoot.io), a free address lookup run by komoot in Germany, so we can offer matching Nigerian addresses to tap. Only the text in that one box is sent, never your name, phone number or anything else on the form.
When you simply browse: which pages you looked at, and where you arrived from, if you came through a link from Instagram, Google or WhatsApp. This is stored against a random session identifier that is not linked to your name.
We never collect your card details. When you pay, you are handed to Paystack, a licensed Nigerian payment processor. Your card number is entered on their system and never touches ours. We are told only whether the payment succeeded and a reference number for it.
We do not sell your information to anyone. We do not let anyone else advertise on this website. We do not send marketing emails unless you have asked us to.
We advertise on Instagram and Facebook. To know which of those ads actually bring people to the shop, we use the Meta pixel, a small piece of code from Meta Platforms, and the ad measurement cookie it sets. It runs when you arrive, unless you say no. On your first visit a line at the foot of the page lets you choose, with two buttons: "No thanks" turns it off, and "Okay" keeps it on.
While it is on: the Meta pixel tells Meta which pages you visit here, what you add to your bag, when you start to pay and when an order is paid, along with a browser identifier Meta stores in a cookie. When you go to the payment page, and again when a website order is paid, our own server also tells Meta, so it is counted even if your browser blocked the pixel. With it we send your email, phone number, name and city in scrambled (hashed) form that cannot be read back, plus your IP address and browser type from the moment you checked out. Meta uses these to match the checkout and the sale to an ad you saw. We never send your card details, your address or what you wrote in your order notes.
When you buy in our shop or through WhatsApp: if you give us your phone number or email for the receipt or the order, we may include it, with your name, the amount and the date, in a file we upload to Meta from time to time. Meta scrambles (hashes) it as it is uploaded and uses it only to tell us whether one of our ads brought you in. Ask us at the till, or write to us (see "Your rights"), and we leave you out.
If you tap No thanks: the Meta pixel stops on that page and never loads again in this browser, its cookies are cleared, and nothing more about your visit or your order is shared with Meta. If you arrived through one of our ads, the ad's reference kept from the link is thrown away. The shop works exactly the same either way.
Your answer is kept in your own browser, and you can change your mind at any time: Change my cookie choice clears it and shows the line again. You can also limit ads in the Ad Preferences of your Facebook or Instagram account.
Tapping "Okay" also lets us replay visits to the shop: a recording of how the pages moved, where the pointer went and what was tapped, so we can see where something confused or failed someone and fix it. It is made with PostHog, in its European Union cloud. Nothing you type is recorded: every field is hidden in your browser before anything is sent, and on the order page all the text is hidden too. Addresses are recorded without the part after "?", where private links keep their keys. It is not tied to your name or account, it never runs on the sign-in, account, password or receipt pages, and it is kept for one month. Unless you tap Okay, it never runs.
Separately, and whatever you choose, the site tells us when one of its pages goes wrong for you: a script error, an image that would not load, or a button that did nothing when tapped again and again. That report holds the page, the browser type and a short description of the button (its label, never anything you typed), and nothing about who you are.
Besides the Meta pixel (on unless you tap No thanks), the visit replay (only after you tap Okay) and their cookies above, what this site stores is small and functional:
All of these are stored on your own device and are cleared when you clear your browser data.
Only the services that make the shop work, and only the part each needs:
Some of these providers run outside Nigeria. Our database (Supabase) is hosted in the European Union, and Vercel and Resend run their systems abroad too, so your order and account details are stored and processed there. Each of them keeps that information under the security and contractual safeguards they provide, and we share only the part each one needs to do its job.
We may also disclose information where the law requires it.
Order records are kept for six years, because tax and accounting rules require it. Account details are kept until you ask us to close your account. Details from a checkout that was never paid are kept with the order records; ask and we will delete them. Your yes to news is kept until you tell us to stop, and the record of it for as long as the law asks. Browsing statistics are kept for two years and are not linked to a name.
Under the Nigeria Data Protection Act you may ask us to show you what we hold about you, correct anything wrong, delete your information where we are not required to keep it, or stop using it for a particular purpose. Write to aerieloomstudio@gmail.com or message 0814 530 7344 and we will respond within 30 days.
If you are not satisfied with our response you may complain to the Nigeria Data Protection Commission.
The site is served only over an encrypted connection. Access to customer records is limited to named members of staff, each with their own login, and every change is recorded against the person who made it.
This shop is intended for adults. We do not knowingly collect information from anyone under 18.
If this policy changes we will update the date at the top. Material changes will be announced on the website.
Aerie Loom Studio Ltd
Shop G01, Novare Lekki Mall
Sangotedo, Lagos, Nigeria