Privacy policy
This Privacy Policy explains how The Aura Rug ("we", "us", "our") collects, uses, shares, and protects your personal information when you visit theaurarug.com, make a purchase, or otherwise interact with us.
The Aura Rug is a brand operated by NguyenDucDuyAnh LLC, a limited liability company registered in the United States, located at 1500 N Grant St, Ste N, Denver, CO 80203, United States. We are the data controller responsible for your personal information.
We have written this policy in plain language. If anything is unclear, email us at support@theaurarug.com and we will explain it.
1. Information We Collect
Information you give us
When you place an order, create an account, or contact us, you provide:
- Identity and contact details — name, email address, phone number
- Shipping and billing address
- Order details — the products you selected, sizes, quantities, and any personalisation text you enter
- Payment information — card details are entered directly into our payment processor's secure form. We never see or store your full card number.
- Correspondence — the content of emails, messages, and any photos you send us when making a claim
If you subscribe to our emails, we collect your email address and your consent to contact you.
Information collected automatically
When you visit our site, we automatically collect:
- Device and browser information — browser type, operating system, screen resolution, language settings
- IP address and approximate location (city or region level, derived from IP)
- Usage data — pages viewed, products viewed, time spent, referring website, search terms used on our site
- Cookie and pixel data — see Section 5 below
Information from third parties
We may receive information about you from:
- Shopify, the platform that hosts our store and processes orders
- Payment processors, who confirm whether a transaction succeeded and flag suspected fraud
- Shipping carriers, who provide delivery status updates
- Advertising and social platforms, where you have interacted with our ads or content
2. How We Use Your Information
We use your personal information to:
- Fulfil your order — process payment, produce your rug, arrange shipping, and send tracking updates
- Communicate with you — order confirmations, shipping notifications, replies to your questions, and claim resolutions
- Handle returns, refunds, and warranty claims under our Return & Refund Policy
- Prevent fraud — screen orders for suspicious activity and protect against unauthorised transactions
- Improve our store — understand which products and pages perform well, and fix problems
- Send marketing, but only where you have opted in, and you can withdraw at any time
- Comply with legal obligations — tax records, accounting, and responding to lawful requests
We do not use automated decision-making that produces legal or similarly significant effects on you.
3. Legal Bases for Processing (EEA and UK Visitors)
If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Fulfilling your order | Performance of a contract |
| Order and shipping notifications | Performance of a contract |
| Marketing emails | Your consent |
| Analytics and advertising cookies | Your consent |
| Fraud prevention and site security | Legitimate interests |
| Tax and accounting records | Legal obligation |
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
4. How We Share Your Information
We share your personal information only with the parties below, and only to the extent necessary.
Shopify Inc. — our e-commerce platform. Shopify hosts our store, processes orders, and stores customer data on our behalf. Shopify's own privacy policy is available at shopify.com/legal/privacy.
Printify — our print-on-demand production partner. We share your name, shipping address, and order details so your rug can be produced and shipped. Printify does not use your information for its own marketing.
Payment processors — including Shopify Payments, PayPal, and any other provider shown at checkout. They receive your payment and billing details directly and process them under their own privacy policies.
Shipping carriers — including USPS, UPS, FedEx, and international postal operators. They receive your name, address, and phone number to deliver your parcel.
Email and marketing platforms — where you have subscribed, to deliver our newsletters.
Analytics and advertising providers — see Section 5.
Professional advisers and authorities — accountants, legal counsel, or law enforcement, where we are legally required to disclose information or need to establish or defend legal claims.
We do not sell your personal information
We do not sell your personal information for money, and we never have.
However, we use advertising and analytics cookies from platforms such as Meta (Facebook and Instagram), TikTok, and Google. Under the California Consumer Privacy Act, this activity may qualify as "sharing" personal information for cross-context behavioural advertising. You can opt out at any time — see Section 9.
We do not knowingly share the personal information of anyone under 16 for advertising purposes.
5. Cookies and Tracking Technologies
Cookies are small files stored on your device. We use:
Strictly necessary cookies — required for the site to function. These keep items in your cart, remember your login, and secure checkout. These cannot be disabled.
Analytics cookies — help us understand how visitors use our site so we can improve it.
Advertising cookies and pixels — allow us to show you relevant ads on Meta, TikTok, and Google, and to measure whether those ads work.
Preference cookies — remember settings such as your currency and language.
You can control cookies through your browser settings, and visitors in regions with applicable privacy laws will see a consent banner on their first visit. Disabling non-essential cookies will not prevent you from browsing or purchasing.
We honour Global Privacy Control (GPC) signals sent by your browser as a valid opt-out request where required by law.
6. Marketing Communications
We send marketing emails only to people who have opted in.
Every marketing email includes an unsubscribe link at the bottom. Clicking it removes you immediately, and we honour every unsubscribe request.
Unsubscribing from marketing does not stop transactional messages — order confirmations, shipping notifications, and replies to your enquiries. These are necessary to fulfil your order and are sent regardless of marketing preferences.
7. Data Retention
We keep your personal information only as long as we need it:
| Data type | Retention period |
|---|---|
| Order and transaction records | 7 years, for tax and accounting compliance |
| Customer account information | Until you ask us to delete it |
| Marketing subscriber data | Until you unsubscribe, then removed |
| Customer service correspondence | 3 years after the enquiry is resolved |
| Analytics data | Typically 26 months |
When a retention period ends, we delete or anonymise the data.
8. International Data Transfers
We are based in the United States, and our service providers operate in the United States and other countries. If you are located outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.
Where we transfer personal data from the EEA or the UK, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as incorporated into our agreements with Shopify and our other processors.
9. Your Privacy Rights
Everyone
Regardless of where you live, you may ask us to:
- Access the personal information we hold about you
- Correct information that is inaccurate or incomplete
- Delete your personal information, subject to records we must legally retain
- Unsubscribe from marketing at any time
To exercise any of these, email support@theaurarug.com with the subject line "Privacy Request". We will verify your identity — usually by confirming details of a recent order — and respond within 30 days.
We will never charge you for making a request, and we will never treat you differently for exercising your rights.
California residents (CCPA / CPRA)
In addition to the rights above, you have the right to:
- Know the categories and specific pieces of personal information we have collected, the sources, our purposes, and the categories of third parties we disclose it to
- Opt out of the sharing of your personal information for cross-context behavioural advertising
- Limit the use of sensitive personal information — although we do not collect sensitive personal information as defined by the CPRA
- Non-discrimination for exercising your rights
- Designate an authorised agent to submit a request on your behalf
To opt out of advertising cookies, decline non-essential cookies in our consent banner, or enable Global Privacy Control in your browser.
EEA and UK residents (GDPR)
In addition to the rights above, you have the right to:
- Restrict how we process your data
- Object to processing based on legitimate interests
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time
- Lodge a complaint with your national supervisory authority, or with the UK Information Commissioner's Office if you are in the UK
We would appreciate the chance to address your concern first, so please contact us before escalating.
10. Data Security
We take reasonable measures to protect your personal information:
- Our entire site runs over HTTPS with TLS encryption
- Payment card data is handled by PCI-DSS compliant processors and never stored on our systems
- Access to customer data is limited to people who need it to do their job
- Our platform provider maintains industry-standard physical and network security
No method of transmission over the internet is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required by law.
11. Children's Privacy
Our store is not directed at children. We do not knowingly collect personal information from anyone under 16 years of age.
If you believe a child has provided us with personal information, contact us at support@theaurarug.com and we will delete it promptly.
12. Third-Party Links
Our site and our social media profiles may link to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing them with any information.
13. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or for legal reasons. The "Last updated" date at the top will always show the most recent revision.
If we make a material change, we will notify you by email or through a prominent notice on our site before the change takes effect.
14. Contact Us
For any question about this policy, or to exercise your privacy rights:
The Aura Rug NguyenDucDuyAnh LLC 1500 N Grant St, Ste N Denver, CO 80203 United States
Email: support@theaurarug.com Phone: +1 (609) 780-1419 Response time: within 24 hours, 7 days a week
Related pages: Shipping Policy · Return & Refund Policy · Terms of Service · Contact Us
"use strict";!function(){let e="remote_reload_attempted:",t=document.documentElement.dataset.buildTimestamp??"",n=0,i=0,o=!1,r=!1;function a(){r=!0,o=!1,clearTimeout(i),document.removeEventListener("visibilitychange",l),window.__CLIENT_HEALTH__={disabled:!0},window.dispatchEvent(new Event("clienthealth"))}function c(){return"hidden"===document.visibilityState?72e5:18e5}function l(){if(clearTimeout(i),r)return;let e=Math.min(c(),n+c()-Date.now());e>0?i=window.setTimeout(l,e):d()}function d(){if(r||(n=Date.now(),l(),o))return;let i=function(e){let t=document.cookie.match(new RegExp("(?:^|; )"+e+"=([^;]*)"));if(!t)return"";try{return decodeURIComponent(t[1])}catch{return t[1]}}("anthropic-device-id").replace(/[^\x20-\x7E]/g,"").trim();fetch("/edge-api/client-health/check?"+new URLSearchParams({platform:"web",bundle:t,locale:navigator.language||"en-US"}).toString(),{cache:"no-store",credentials:"omit",headers:i?{"anthropic-device-id":i}:{}}).then(e=>410===e.status?(a(),null):e.ok?e.json():null).then(t=>{if(r||!t||"object"!=typeof t)return;window.__CLIENT_HEALTH__=t,window.dispatchEvent(new Event("clienthealth"));let n=t.control;if(!n)return;if("lockout"===n.type){try{sessionStorage.setItem("client_health_lockout",JSON.stringify({message:n.message,cta:n.cta}))}catch{}let e=window.location;return void e.replace("/health/update-required?returnTo="+encodeURIComponent(e.pathname+e.search))}if("load-shed"===n.type){let e=window.location,t=n.retryAfter;return void e.replace("/health/unavailable?returnTo="+encodeURIComponent(e.pathname+e.search)+("number"==typeof t&&t>0?"&t="+t:""))}if("reload"!==n.type)return;let i=n.id;if("string"==typeof i&&/^[A-Za-z0-9_-]{1,64}$/.test(i)){try{if(null!==sessionStorage.getItem(e+i))return}catch{return}o=!0,u(i,0)}}).catch(()=>{})}function u(t,n){r||n>=30?o=!1:fetch("/edge-api/client-health/reload-request",{cache:"no-store",credentials:"omit"}).then(n=>{if(410!==n.status){if(!n.ok)throw new Error;try{sessionStorage.setItem(e+t,String(Date.now()))}catch{return void(o=!1)}location.reload()}else a()}).catch(()=>{setTimeout(()=>u(t,n+1),6e4)})}document.addEventListener("visibilitychange",l),i=window.setTimeout(d,5e3)}()