Last updated 18 September 2026
Privacy policy
This policy explains what Obsidian Trail Ltd., trading as Yurae, collects about you when you use yurae.beauty, why, who it is shared with, and what you can ask us. Obsidian Trail Ltd. is the controller of this data. You can reach us at contact@yurae.beauty.
Who we are
Obsidian Trail Ltd. is registered in Seychelles under number 250296, at Statehouse Avenue, Victoria House, Room 306, Victoria, Seychelles. We sell Korean cosmetics to businesses in the European Union. Our systems are hosted in the EU, and the EU General Data Protection Regulation (GDPR) applies to how we handle your data.
What we collect and why
Contact details. When you ask for access or we invite you, we record your name, work email, phone number, company name, VAT number, country and notes from our conversations. We use them to open your account and manage our business relationship. Legal basis: the contract with you, or our legitimate interest in developing business relationships while you are a prospect.
Your account. Your email, your password (stored hashed by Supabase, we never see it) and your login times. Legal basis: the contract with you.
Orders. Products, quantities, prices, delivery address, tracking numbers, notes you add and your order history. Legal basis: the contract with you. We keep order records for as long as accounting and tax law require.
Payments. Our payment provider, Inflow, handles the payment itself. We never receive your full card number. We receive the payment status, the amount, the payment method type and a link to the invoice. Inflow is a separate controller for the payment data it collects. See the Inflow privacy policy for details.
Emails we send you. Account invitations, order confirmations, status updates and password resets. We log which email was sent to whom and whether it was delivered. Legal basis: the contract with you.
Emails you send us. We keep them in our mailbox to answer you and for as long as our relationship lasts.
How you use the site. We use PostHog to understand how the site and shop are used. Without your consent, PostHog runs in cookieless mode: nothing is stored on your device, and PostHog computes a privacy-preserving daily identifier from your IP address, browser and our domain, so we see page views without recognising you from one day to the next. With your consent, PostHog stores a cookie and local storage entries so we can see returning visits, and records sessions: pages, clicks and scrolling, with anything you type into forms masked. When you are logged in, this activity is linked to your account so we can see how buyers use the shop and fix what gets in the way. Legal basis: our legitimate interest in understanding site usage for the cookieless statistics, and your consent for the rest. You can change your choice at any time with the link in the footer.
Technical logs. Our hosting provider and our error tracking record your IP address, browser, the pages requested and any errors, so we can keep the site secure and working. Legal basis: our legitimate interest in security. These logs are kept for a short period.
Who we share it with
These providers process data on our behalf, under contracts that bind them to our instructions:
- Supabase: database, authentication and file storage. Servers in Paris, France.
- Vercel: hosting of the website. Vercel is a US company and uses Standard Contractual Clauses.
- Resend: sending of transactional emails. Resend is a US company and uses Standard Contractual Clauses.
- PostHog: site analytics and session recordings. EU cloud, servers in Frankfurt, Germany.
- Google: our email mailbox.
Inflow receives what it needs to take your payment and acts as its own controller for that. Carriers receive your name, delivery address and phone number to deliver your order. We share data with authorities when the law requires it. We do not sell your data.
Where your data is kept
Your data is stored on servers in the European Union. Obsidian Trail Ltd. is established in Seychelles, which the European Commission has not recognised as providing an adequate level of data protection. When we access data from outside the EU, or use a provider outside the EU, we do so under the safeguards the GDPR requires, such as Standard Contractual Clauses.
How long we keep it
- Prospect contact details: 2 years after our last exchange.
- Account and contact data: while your account is open, then 3 years.
- Order and payment records: as long as accounting and tax law require.
- Email delivery logs: 12 months.
- Session recordings: deleted by PostHog after 30 days.
- Other analytics data: kept while we need it to follow how the site is used over time.
Your rights
You can ask us for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, receive it in a portable format, and withdraw any consent you gave. Write to contact@yurae.beauty. We reply within one month. You can also complain to the data protection authority of the EU country where you live or work.
Cookies and similar storage
The site stores the following on your device:
| Name | Purpose | Type | Duration |
|---|---|---|---|
sb-*-auth-token | Keeps you logged in (Supabase) | Necessary | While you are logged in |
yurae-cart-v2, yurae-known-products-v1 | Remembers your cart between visits (local storage) | Necessary | Until you clear your browser data |
__ph_opt_in_out_* | Remembers your cookie choice (local storage) | Necessary | Until you clear your browser data |
ph_*_posthog | Analytics and session recording (PostHog), cookie and local storage | Consent | 1 year |
Necessary storage does not need your consent. The PostHog cookie is set only after you accept, and you can withdraw at any time with the link in the footer. If you decline, PostHog keeps working in cookieless mode as described above.
Children
The site is for businesses. We do not knowingly collect data about anyone under 18.
Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use data you already gave us, we tell account holders by email.