Legal

Privacy Policy

How we collect, use, and protect your information for the NishLabs beta program.

Draft — legal review required: This is a plain-language draft for the beta launch. The data controller / legal entity name, registered address, and any data protection contact must be finalized and legal-reviewed before production data collection (see beta launch issue 02). Retention periods and lawful-basis wording are drafts pending review. Policy version 2026-06-13-draft.

Who we are

NishLabs is a science-led skincare brand running a UK-only beta program. We are the data controller for the personal data described here.

Draft — legal review required: Controller legal entity, company registration, and registered address to be inserted before launch.

Data we collect

Beta application: first name, email, eligibility confirmations (UK resident, 18+), skin concerns, skin type, products you use, and an optional social handle.
Consent records: the consents you give, with timestamps and the policy version you accepted.
Selected testers: shipping and participation details, collected only after selection.
Feedback: consumer-perception survey responses during the 4-week program.
Future-availability list: email and, for non-UK signups, country.
Technical: limited request metadata used for spam protection (hashed IP/email attempt records).

Why we use it and our lawful basis

To review applications and run the beta program (consent and our legitimate interests in operating the program).
To send you required program emails while you are active in the beta (consent / performance of the program).
To send optional marketing or newsletter emails, only if you opt in (consent).
To protect our forms from spam and abuse (legitimate interests).

Draft — legal review required: Final lawful-basis mapping to be confirmed in legal review.

Processors we use

Supabase — secure database hosting for applications and consent records.
Resend — transactional and program email delivery.
Vercel — website hosting and Vercel Web Analytics.

We use Vercel Web Analytics, a privacy-friendly analytics tool that measures aggregate site usage and does not build advertising profiles of you.

How long we keep it

Application and survey data: retained for 24 months.
Shipping addresses: deleted 6 months after beta completion.
Spam-protection attempt records: retained for 7 days.

Draft — legal review required: Retention periods are drafts and subject to legal review.

Your rights

Under UK GDPR you have rights to access, correct, delete, restrict, and port your personal data, and to object to certain processing. You can withdraw consent at any time. To make a request — including manual deletion or export — email hello@nishlabs.com.

Email and your choices

Beta program emails (application confirmation, selection, shipping, and required survey links) are necessary while you are active in the beta. Marketing and newsletter emails are separate and only sent if you opt in. Every non-transactional email includes a one-click unsubscribe / manage-preferences link.

Contact

Questions about this policy or your data: hello@nishlabs.com.