Your privacy.

Last updated: 11 November 2026

This policy explains what personal information J.N & CO (“J.N & co”, “we”, “us”), of 68, daramapalapura, Ruwaneliya, Nuwara Eliya, collects when you use our website, why we collect it, who we share it with, and the choices you have. We are responsible for how we handle this information. For privacy requests, contact support@jncocreation.com.

1. Information we collect

When you create an account

• Your email address and password. Our website passes your password securely to Supabase for sign-in. We do not store it in our shop database.
• Your name.

When you order, join a waiting list or ask for a custom piece

• Delivery details: recipient name, phone number, address, city and postal code.
• What you ordered: products, sizes, colours, quantities, prices, the delivery estimates you accepted, and the version of our terms you agreed to, with the time you agreed.
• Payment records: method, amount, status, PayHere or PayPal references, and any bank-transfer evidence used to verify payment. If you agree to a bank refund, we may also collect the account details needed to pay it. We do not receive or store your card number.
• For custom requests: your description, size, colour, measurements, notes, an optional reference photo, and the messages you exchange with the studio about the request.
• Cancellation requests: your reason, and our decision and any refund.

When you write a review

Your rating, review text, the name shown with it, and any photos you add. We re-encode review photos when you upload them, which removes hidden data such as camera details and GPS location.

When you choose WhatsApp updates

Your phone number and the date and time you opted in.

Automatically

• Sign-in cookies that keep you logged in (see section 8).
• Your shopping bag, saved in your own browser’s storage rather than on our servers until you check out.
• Standard technical logs kept by our hosting provider (such as IP address, browser type and the pages requested), used for security and troubleshooting.

We do not use analytics, advertising cookies or tracking pixels.

Testimonials from social media. With the author’s permission, we may publish a review someone left on our Facebook or Instagram page. We store the name shown on that post, its text, its date, a link to it and a note of the permission given.

2. How we use your information

• To make and deliver your order: to take payment, plan production, show you estimated timelines, dispatch your parcel and handle refunds and cancellations.
• To keep you updated: we send order, waiting-list and quote updates on your account page and by email, and also by WhatsApp if you opted in. These messages are about your orders, not marketing. External messages contain a link to your sign-in-protected order page instead of payment details.
• To consider custom requests: to judge whether a piece is feasible, prepare a quote and make it to your measurements.
• To publish reviews: after moderation, your review appears with the name you chose. Only verified purchase reviews count toward product ratings.
• To protect the business and our customers: to confirm payments, prevent fraud and duplicate charges, and keep an audit trail of payment and refund decisions.
• To meet legal obligations: for example, keeping tax and accounting records.

We will not use your information for a new purpose without telling you first and, where required, asking for your consent.

3. Legal basis

• Taking steps you request or fulfilling a contract: account, waitlist, order, delivery, payment, custom-request and necessary service updates. We explain which fields are required on each form. Without required details we may be unable to process the request or order.
• Consent: WhatsApp updates, public reviews and photos, and republished social-media testimonials. You can withdraw consent at any time.
• Legal obligation: retaining order and payment records for tax and accounting.
• Legitimate interests: security logs, fraud prevention, and the payment and refund audit trail.

4. Who we share information with

We do not sell or rent your personal information. We share it only with the service providers that run the studio:

We may also disclose information when the law requires it, or to protect our rights in a dispute such as a chargeback.

5. Overseas processing

Our hosting and database providers may process information in India. Email, messaging and payment providers may also process information in the United States and other countries. Australian delivery requires sharing delivery information with providers serving Australia. Contact us for details of the providers, locations and safeguards relevant to your information.

6. How long we keep it

• Account: until you delete it.
• Orders, payments, refunds and delivery records: for as long as needed to fulfil the order, meet accounting or legal obligations and resolve claims. Required records may be kept after account deletion.
• Custom requests and waitlist entries: while we manage the request, quote, waitlist place or resulting order, and as needed for follow-up or disputes. This includes measurements and reference photos you supply.
• Notification history: as needed for support and to keep a record of order updates.
• Reviews: while published or under moderation. Withdrawal removes the review and photos from public display. We may keep records needed to manage your review, resolve disputes or meet legal duties.
• Hosting logs: according to our hosting provider’s standard retention.

7. Your rights

• See and correct your information: your account and order pages show most of it. For anything else, contact us.
• Delete your account from the Account page once no order is in progress. We remove your sign-in, replace your name, phone and email with placeholders, withdraw your waiting-list places and open custom requests, and hide your reviews. Past orders, payments and delivery addresses are kept as described in section 6.
• Stop WhatsApp updates at any time by contacting us with the number you used to opt in. You can also leave the WhatsApp box unticked on your next order.
• Withdraw consent for anything we do on the basis of consent.
• Complain to the Data Protection Authority of Sri Lanka where available. If Australian privacy law applies and we cannot resolve your complaint, you can contact the Office of the Australian Information Commissioner.

We aim to reply within 21 working days, or sooner where required by law. We may need to confirm your identity first. You can also ask us to erase information or stop a particular use where applicable law gives you that right. We explain how we handled your request and any available escalation route.

8. Cookies and browser storage

We don’t use analytics or advertising cookies, so there is no cookie banner. If you block cookies, you can browse but not sign in.

9. Security

Connections to our site use HTTPS, and sign-in cookies are protected from page scripts and sent only over secure connections. Only studio administrators can see order and customer details, and every admin page checks their role on the server. Reference photos are private and shown to the studio through links that expire after five minutes. We check photo type and size and use generated filenames. Newly uploaded review and custom reference photos are re-encoded to remove embedded metadata such as GPS coordinates. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

10. Children

Our shop is for people aged 18 and over. We don’t knowingly collect information from children. If you think a child has given us information, contact us and we will delete it.

11. Changes to this policy

We update the date above when we change this policy. We will tell affected customers about material changes where required.

12. Contact

J.N & CO, 68, daramapalapura, Ruwaneliya, Nuwara Eliya. Email: support@jncocreation.com. Phone: +94702158531.

See also our terms and conditions, refund policy and delivery information.