Privacy policy

Last updated: 6 September 2026

1. Who We Are and Scope

Inheart International Limited (Hong Kong company number 77534056), trading as AURASOUL LAB ("AURASOUL LAB," "we," "us," or "our"), operates this store and website and is the controller of personal information processed for our own business purposes. Our store is powered by Shopify, which provides the commerce platform and certain related services.

This Privacy Policy explains how personal information is collected, used, disclosed, and protected when you visit or use www.aurasoullab.com, create an account, purchase or return a product, use AuraTouch or the Energy Quiz, submit a review, use customer support or chat, subscribe to marketing, or otherwise communicate with us (collectively, the "Services").

If this Privacy Policy conflicts with our Terms of Service on the collection, use, or disclosure of personal information, this Privacy Policy controls for those matters. This Policy is a notice and does not ask you to waive rights that cannot lawfully be waived.

2. Personal Information We Collect or Process

The information we collect depends on how you interact with the Services and may include:

  • Contact and delivery details, such as your name, email address, telephone number, billing address, and shipping address.
  • Order and transaction information, such as products viewed, saved, added to a cart or wishlist, purchased, returned, exchanged, or cancelled; order history; discounts; delivery status; and customer-service records.
  • Account information, such as account identifiers, profile details, preferences, and settings. Authentication may be provided by Shopify or Shop. We do not generally receive your complete authentication credentials from those providers.
  • Payment information. Complete card or financial-account details are collected and processed directly by Shopify and applicable payment providers. We generally receive transaction details, payment method type, authorization or payment status, and limited billing information rather than complete payment-card numbers.
  • Communications and support information, including emails, support requests, chat messages, attachments, feedback, and any information you provide when communicating with us. Messages sent through Shopify Inbox, including AI-assisted chat, are visible to us and processed by Shopify to provide the chat service.
  • Review and user-content information, such as your display name, email address, rating, review text, photos, or videos submitted through our review provider. Information designated as public may appear publicly with your review.
  • Loyalty and rewards information, such as membership status, points, referral activity, reward redemptions, discount eligibility, and related account or order identifiers when you participate in a rewards program.
  • Device, network, and usage information, such as IP address, browser and device type, operating system, language, approximate location inferred from IP address, unique identifiers, pages viewed, links or buttons selected, referring pages, and dates and times of activity.
  • Marketing and cookie information, such as cookie identifiers, advertising identifiers, consent choices, campaign interactions, and inferences used to measure or personalize content and advertising where permitted.
  • Personalization interactions, such as Energy Quiz selections and recommendation results. The quiz does not ask you to enter your name or email address, but quiz-page activity may generate device and usage data through the website and configured analytics or pixel tools.

Please do not submit medical information, government identification numbers, financial credentials, or other sensitive personal information through the Energy Quiz, reviews, or customer chat unless it is necessary and we specifically request it through an appropriate channel.

3. Sources of Personal Information

We may collect personal information:

  • Directly from you, when you place an order, create or use an account, subscribe, submit a review, use chat or support, participate in the Energy Quiz, or otherwise provide information.
  • Automatically, from your device and use of the Services through cookies, pixels, local storage, and similar technologies.
  • From Shopify and service providers, when they provide commerce, payment, account, fraud-prevention, analytics, review, chat, translation, localization, shipping, or other services to us.
  • From business and marketing partners, such as advertising platforms or social networks, where permitted by law and consistent with your settings and choices.

4. How We Use Personal Information

  • Provide and administer the Services, including processing payments and orders, arranging delivery, managing accounts, handling returns and exchanges, operating AuraTouch features, administering loyalty or rewards features, and providing product recommendations.
  • Communicate with you, including responding to requests, providing customer support, sending service or order notices, and following up on reviews or chat conversations.
  • Personalize and improve the website, products, recommendations, customer experience, and business operations; measure performance; and understand how the Services are used.
  • Marketing and advertising, including sending promotional communications where permitted, measuring campaigns, and displaying or supporting interest-based advertising subject to applicable consent and opt-out rights.
  • Security and fraud prevention, including authenticating accounts, protecting payments and transactions, detecting abuse, and safeguarding customers, our business, Shopify, and other parties.
  • Legal and business purposes, including complying with law, tax and accounting obligations, lawful requests, enforcing our terms and policies, resolving disputes, establishing or defending legal claims, and managing a corporate transaction.

5. Legal Bases for EEA, UK, and Swiss Users

Where European data-protection law applies, we process personal information under one or more of the following legal bases:

  • Contract: to take steps at your request and perform our contract, including processing orders, payments, delivery, returns, accounts, and requested support.
  • Legitimate interests: to operate, secure, analyze, improve, and appropriately market our business and Services, provided those interests are not overridden by your rights and interests.
  • Consent: for non-essential cookies, certain personalized advertising, and direct marketing where consent is required. You may withdraw consent at any time without affecting earlier lawful processing.
  • Legal obligation: to meet applicable legal, tax, accounting, consumer-protection, and regulatory duties.
  • Legal claims and vital interests: where processing is necessary to establish, exercise, or defend legal claims, or to protect a person's vital interests as permitted by law.

Product recommendations, including Energy Quiz results, do not produce legal or similarly significant effects. We do not use solely automated decision-making that produces such effects about you.

6. Cookies, Analytics, and Advertising

We and our service providers use cookies, pixels, local storage, and similar technologies for functions that may include:

  • Strictly necessary functions, such as security, authentication, cart, checkout, fraud prevention, and remembering privacy choices.
  • Functional services, such as localization, language and currency selection, wishlist features, chat, and account preferences.
  • Analytics and performance, such as understanding visits, interactions, purchases, and site performance.
  • Marketing and advertising, such as campaign measurement and personalized or targeted advertising where permitted.

Where required, non-essential technologies are used only after you make an applicable consent choice. You can manage available choices through our cookie banner or Your Privacy Choices page. Browser settings may also allow you to block or delete cookies, although some Services may not work correctly as a result.

Depending on where you live, disclosures for cross-context behavioral or targeted advertising may be treated as a "sale" or "sharing" of personal information under applicable law. You may opt out through Your Privacy Choices. Where legally required and technically supported, we also treat the Global Privacy Control signal as an opt-out request for the browser and device sending the signal. Learn more at globalprivacycontrol.org.

Our current customer-event settings include Pinterest web and server-side integrations for analytics, campaign measurement, and advertising. The information available to Pinterest depends on the event, your consent choices, applicable law, and Shopify's data-sharing controls.

7. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients for the purposes described above:

  • Shopify, which hosts the store and provides commerce, account, payment, analytics, fraud-prevention, Shop, Inbox, and related functionality.
  • Payment providers, banks, card networks, and fraud-prevention providers involved in completing and protecting transactions.
  • Operational service providers, including hosting, cloud, IT, customer support, email, fulfillment, shipping, returns, translation, localization, currency, and professional advisers.
  • Review, loyalty, and customer-experience providers, including Judge.me for reviews and submitted review media, Smile.io for loyalty or rewards functionality, Shopify Inbox for chat, and Hextom services used for translation or regional presentation.
  • Analytics and marketing partners, including Pinterest and providers connected through Shopify Customer Events, app pixels, custom pixels, advertising integrations, or social-media tools, subject to applicable consent and opt-out requirements.
  • Authorities and other parties for legal reasons, when reasonably necessary to comply with law or lawful process, protect rights and safety, investigate misuse, or enforce our agreements.
  • Parties to a business transaction, such as an actual or proposed merger, financing, acquisition, restructuring, or sale of assets, subject to appropriate protections.
  • Other recipients you direct or authorize, such as a delivery recipient, social platform, or integration you choose to use.

We do not disclose personal information to unrelated third parties merely so they can use it for their own independent direct marketing, except with your direction or consent or as otherwise permitted by applicable law.

8. Relationship with Shopify

Shopify collects and processes personal information about your access to and use of the Services in order to provide and improve its services. Information submitted through the Services may be transmitted to Shopify and service providers in countries other than the country where you live.

We use Shopify enhanced features that may combine information from your interactions with our store, Shopify, and other merchants to help protect, grow, and improve our business. For certain processing connected with those enhanced services, Shopify may act as an independent controller and is responsible for responding to applicable requests relating to that processing.

For more information, review the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal for available Shopify-specific choices and requests.

9. Energy Quiz, AuraTouch, Reviews, Loyalty, and Chat

Energy Quiz. Quiz selections are used to generate product recommendations. The quiz is a general wellness and product-preference tool, not a medical assessment. It does not ask you to submit your name or email address. Ordinary website analytics and configured pixel tools may process device, usage, and interaction information associated with quiz pages.

AuraTouch. Current AuraTouch products can be accessed by tapping the product with a compatible NFC-enabled smartphone. When an AuraTouch link opens a webpage, the same device, usage, cookie, and communication practices described in this Policy apply to that webpage. We do not state that AuraTouch collects additional categories of personal information unless a feature actually does so.

Reviews. If you submit a review, your display name, rating, review text, and approved media may be public. Your email address is used for verification or follow-up and is not intended to be displayed publicly unless you include it in the review itself.

Loyalty and rewards. If you join or use a rewards program, Smile.io may process account identifiers, order activity, points, referrals, rewards, and redemption information to operate the program and help prevent misuse. Any marketing communication remains subject to your applicable communication choices.

Chat. Shopify Inbox may offer automated or AI-assisted responses. Your messages and attachments are visible to AURASOUL LAB and are processed by Shopify to provide and improve the chat service. Do not rely on automated chat for medical, legal, financial, or emergency advice.

10. International Transfers

We are established in Hong Kong and use service providers that operate internationally. Your personal information may therefore be transferred to, stored in, or processed in Hong Kong, the United States, Canada, and other countries where Shopify or our service providers operate. Those countries may have data-protection laws different from those where you live.

Where required for transfers from the EEA, UK, or Switzerland, we or our service providers use recognized safeguards, such as adequacy decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another lawful transfer mechanism.

11. Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain an account, complete transactions, comply with tax, accounting, consumer-protection, and other legal obligations, resolve disputes, prevent fraud, and enforce agreements. The period depends on the type of information, the relationship with you, legal requirements, and whether continued retention is necessary and proportionate. We delete or de-identify information when it is no longer reasonably needed, unless retention is required or permitted by law.

12. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please do not send sensitive or confidential information through unsecured channels. You are responsible for protecting any account access method available to you and for notifying us if you suspect unauthorized use.

13. Your Rights and Choices

Depending on where you live and subject to applicable exceptions, you may have the right to request access to, correction of, deletion of, or a portable copy of personal information; restrict or object to certain processing; withdraw consent; opt out of targeted advertising or the sale or sharing of personal information; or appeal a decision on a privacy request.

Hong Kong users may request access to and correction of personal data in accordance with applicable law. You may also ask us to stop using your personal data for direct marketing at any time and without charge.

You may unsubscribe from promotional emails using the link in the message. Even after opting out of marketing, we may send non-promotional communications about orders, accounts, security, or customer service.

To exercise a right relating to our processing, contact us using either email address in the Contact section. You may also use Your Privacy Choices for applicable advertising opt-outs. We may need to verify your identity and authority before completing a request. We will not discriminate against you for exercising an applicable privacy right.

If we decline a request, you may have the right to appeal by replying to our decision. You may also complain to your local data-protection authority. EEA users can find supervisory authorities through the European Data Protection Board. Hong Kong users may contact the Office of the Privacy Commissioner for Personal Data.

14. Children's Privacy

The Services are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If applicable law sets a higher minimum age for a particular processing activity, we follow that higher age. A person who has not reached the legal age to enter into a purchase contract in their jurisdiction should use the Services with the authorization and supervision of a parent or legal guardian where required.

If you believe a child has provided personal information to us in a manner not permitted by law, please contact us so that we can review and, where required, delete it. As of the date of this Policy, we do not have actual knowledge that we sell or share, as those terms are defined by applicable US state privacy laws, personal information of individuals under 16.

15. Third-Party Websites and Services

The Services may link to websites, apps, social platforms, or other services operated by third parties. Their privacy and security practices are governed by their own notices. We are not responsible for third-party services that we do not control. Information you post in public or semi-public areas may be visible and used by others.

16. Changes to This Privacy Policy

We may update this Policy to reflect changes in our practices, services, technology, or legal obligations. We will post the revised Policy on this website, update the "Last updated" date, and provide any additional notice required by applicable law.

17. Contact

For questions, complaints, or requests concerning privacy, contact:

Inheart International Limited
Trading as AURASOUL LAB
Hong Kong company number 77534056

Email: info@aurasoullab.com
Customer support: support@aurasoul.com