Privacy policy
GetGlow Pty Limited (ABN 42 636 185 316) trading as CEAN
Suite 11 (Floor 2), 402 New South Head Rd, Double Bay NSW 2028, Australia
privacy@cean.com
Effective 25 August 2026
This explains what we collect, why, who we share it with, and how to tell us to stop. Sections 1–12 apply to everyone. Section 13 adds a few rights depending on where you live.
1. Who handles your information
CEAN looks after our website, your account, your marketing preferences, your reviews and our customer service.
Global-e, our international commerce partner, is the seller of record for every CEAN order. They handle checkout, payment, fraud screening, customs and delivery, and they decide how they use the information they collect for that. Their own privacy notice covers it, and it's shown to you at checkout. If you're not sure which of us holds something, email privacy@cean.com and we'll tell you.
2. What we collect
From you: your name, email, delivery and billing address, phone number, order history, account login, size and fit details you give us, anything you write to our support team, and any review or photo you share.
Automatically when you visit: your IP address, device and browser, roughly where you are, which pages and products you looked at, what you searched, what you put in your cart, and whether you opened or clicked our emails. We use cookies and similar tools for this — see Section 6.
From others: order and delivery information from Global-e and our carriers, payment confirmations from our payment providers, engagement data from Klaviyo, campaign data from advertising platforms, and — if a friend refers you — your name and email from them. If you'd rather we didn't hold a referral, email privacy@cean.com and we'll delete it.
We don't collect payment card numbers. Those go straight to the payment providers.
3. Why we use it, and how long we keep it
| What for | Why we're allowed to | How long we keep it |
|---|---|---|
| Taking, fulfilling and delivering your order; returns and refunds | To perform our contract with you | 7 years (tax and accounting) |
| Running your account | To perform our contract with you | While your account is open, then 24 months |
| Customer service | To perform our contract, and our interest in helping you | 36 months |
| Preventing fraud and abuse of discounts, referrals and returns | Our interest in protecting the business and our customers | 24 months, or 7 years if tied to an order |
| Email and SMS marketing | Your consent | Until you opt out, or 24 months of no engagement |
| Keeping you off our lists once you opt out | Our legal obligation to honour your opt-out | Indefinitely — the minimum needed to make sure we don't contact you again |
| Advertising and measuring it on Meta, TikTok and Google | Your consent where the law requires it; otherwise our interest in marketing, and you can opt out | See our cookie settings; advertising audiences refresh on a rolling 180-day basis |
| Understanding how the site is used | Your consent where the law requires it; otherwise our interest in improving the site | 14 months |
| Publishing your reviews and photos | Your consent | While published |
| Product safety and dealing with any complaint about a garment | Our legal obligations, and our interest in product safety | 10 years |
| Dealing with a legal claim | Our interest in defending our position | As long as the claim is live, plus the limitation period |
When a period ends we delete the information or strip out anything that identifies you. Backups are cleared on the next backup cycle.
4. Who we share it with
We do not sell your information. We share it with these companies so they can do a job for us or, where marked, because they are the ones providing the service:
| Who | What they do | Where |
|---|---|---|
| Shopify | Runs our online store, checkout and accounts | Canada, United States |
| Global-e (seller of record — see Section 1) | Checkout, payment, fraud screening, customs, delivery | United States, Israel, EU, United Kingdom |
| Klaviyo | Sends our emails and texts, and stores our customer list | United States |
| Gorgias | Runs our customer service inbox | United States |
| Meta, TikTok, Google | Advertising and measurement | United States |
| Our Los Angeles fulfilment centre and carriers | Picking, packing and delivering your order | United States, and your destination country |
| Our payment providers | Taking payment | Various |
| Our reviews platform | Collecting and publishing reviews | United States |
We also share information with our professional advisers, with a regulator or court where we're legally required to, and with a buyer of the business if we're ever sold — in which case we'd require them to keep honouring this policy.
Anything you post publicly, like a review, is visible to anyone.
5. Where your information goes
We're an Australian company, we ship from Los Angeles, and our providers are spread across the United States, Canada, Israel, Ireland, the United Kingdom and the EU, plus wherever your order is delivered.
Privacy laws in those countries differ from your own, and local authorities may in some cases be able to access information under their own laws. We only use providers who agree in writing to protect your information properly, and where the law requires a specific safeguard for sending information abroad — such as the European Commission's standard contractual clauses — we use it. Email privacy@cean.com if you'd like a copy.
6. Cookies, pixels and advertising
Our site uses cookies and similar tools. Some are needed to make the site work — your cart, your login, security. Others help us understand how the site is used, or show you CEAN advertising on Meta, TikTok and Google.
What we share with advertising platforms. When those tools are switched on, Meta, TikTok and Google receive your device and cookie identifiers, a scrambled version of your email address, the pages and products you viewed, and what you bought. They use that for their own purposes as well as ours, including showing you ads elsewhere. Under some US state laws this counts as "selling" or "sharing" your information.
How to turn it off. Use the Cookie preferences link in our footer, or the Your Privacy Choices link if you're in the US. If your browser sends a Global Privacy Control signal, we treat that as an opt-out and you don't need to do anything else. In the EU, EEA and UK we ask before switching anything non-essential on, and you can change your mind at any time.
7. Health-related information
We don't ask you for health information and we'd rather you didn't send us any. We don't run health quizzes and we don't ask about medical conditions.
We're aware that what you buy from us could suggest something about your body or your health. If you tell us about a health condition in a message to our support team, we use it only to answer you — we don't add it to your marketing profile and we don't send it to advertising platforms.
If you live in Washington or Nevada, you have additional rights over health-related information, including the right to withdraw consent and to have it deleted. Email privacy@cean.com with "Health data request" in the subject and we'll action it within 45 days.
8. Marketing
We only send marketing you've signed up for, and it's never a condition of buying anything, creating an account, or joining our rewards programme.
Unsubscribe any time — the link in any email, reply STOP to any text, your account settings, or privacy@cean.com. We action opt-outs within 5 business days at the latest, usually straight away.
Rewards and referrals. If you join our rewards programme or refer a friend, we use your name, email, order history and rewards activity to run it. Joining is voluntary, you can leave any time by emailing privacy@cean.com, and leaving doesn't affect anything you've already redeemed.
9. Your choices and rights
Depending on where you live, you can ask us to:
- give you a copy of what we hold about you, and tell you how we use it
- correct anything that's wrong
- delete it
- send it to you or someone else in a portable format
- stop using it for marketing, or for anything based on our own business interests
- stop selling or sharing it for advertising
- withdraw your consent, at any time
- have a person review an automated decision — see below
- appeal if we say no
How: email privacy@cean.com. No particular form of words needed. We may ask you to confirm your identity, usually with your email address and a recent order number — but never to action a marketing or advertising opt-out. We reply within 30 days, or 45 days in the US. It's free.
We will never charge you more, give you a worse service, or treat you differently because you exercised any of these rights.
Automated decisions. Our systems automatically screen orders for fraud, which can occasionally mean an order is held or cancelled and refunded. They also group customers by purchase history to decide which marketing to send. If an order of yours is stopped, email hello@cean.com and a person will review it and explain why. We don't use your information to charge you a different price from anyone else.
10. Security
We protect your information with encryption, restricted access, multi-factor authentication on our admin accounts, and contracts requiring our providers to do the same. No system is perfect, so please use a strong password and tell us straight away if you think your account has been compromised.
If a breach happens that's likely to cause you serious harm, we'll tell you and the relevant regulator within the time the law requires, and explain what to do.
11. Children
Our site isn't for children and we don't knowingly collect their information. If you think a child has given us something, email privacy@cean.com and we'll delete it. We don't have actual knowledge that we sell or share the information of anyone under 16.
12. Complaints
Email privacy@cean.com with "Privacy complaint" in the subject. We'll acknowledge within 30 days, look into it, and tell you the outcome and why.
If you're not happy with our answer you can go to your regulator — Section 13 lists them. You can go to them at any time; you don't have to come to us first.
13. Where you live
Australia. We handle personal information under the Privacy Act 1988 and the Australian Privacy Principles. The countries your information is likely to go to are in Section 5. You can ask us where we got your information from, and we'll tell you unless it's unreasonable to. Complaints: the Office of the Australian Information Commissioner, oaic.gov.au, 1300 363 992.
New Zealand. We handle personal information under the Privacy Act 2020, including where we've collected it from someone other than you (Section 2). Complaints: privacy.org.nz, 0800 803 909.
EU, EEA, United Kingdom and Switzerland. Section 3 sets out our legal basis for each thing we do and how long we keep it. You can object to anything we do on the basis of our own business interests, and you can always object to direct marketing. Australia isn't covered by an adequacy decision, so transfers to us rely on standard contractual clauses — email us for a copy. Complaints: your national data protection authority, the ICO in the UK (ico.org.uk), or the list at edpb.europa.eu.
United States. The categories we collect, why, who gets them and how long we keep them are in Sections 2–4. We share identifiers, browsing activity and purchase information with Meta, TikTok and Google for advertising, which counts as "selling" or "sharing" under some state laws — Section 6 explains how to stop it, and we honour the Global Privacy Control. We don't sell or share sensitive information and we don't knowingly sell or share the information of anyone under 16. You can access, delete, correct, opt out and appeal as set out in Section 9, and we won't discriminate against you for it.
California: you also have the right to limit how we use sensitive personal information, and to know what we've disclosed for third parties' own direct marketing — we don't do the latter. Contact the California Privacy Protection Agency at cppa.ca.gov or the Attorney General at oag.ca.gov.
Washington and Nevada: see Section 7.
Canada. Your information is processed outside Canada, including in Australia and the United States, where local courts and authorities may be able to access it under their own laws. We send commercial emails and texts only with your consent, and every one has an unsubscribe that we honour within 10 business days. Complaints: the Privacy Commissioner of Canada, priv.gc.ca, or in Quebec the Commission d'accès à l'information, cai.gouv.qc.ca.
Singapore. Our data protection contact is privacy@cean.com. Before we text you marketing we either check the Do Not Call Registry or rely on consent you've given us specifically for marketing messages. Complaints: pdpc.gov.sg.
Anywhere else. Sections 1–12 apply and you have whatever rights your local law gives you. Email privacy@cean.com and we'll help.
Changes
We may update this policy. The current version, with its effective date, is always on this page.
Contact: privacy@cean.com · GetGlow Pty Limited trading as CEAN, Suite 11 (Floor 2), 402 New South Head Rd, Double Bay NSW 2028, Australia