Privacy policy

Last updated: October 14, 2026
This Privacy Policy is reviewed at least once every 12 months.

1. Who We Are and What This Policy Covers

Tandum Studio Inc., a Delaware corporation doing business as NOMADIA, operates nomadiaskin.com and any related storefronts, pages, and customer communications (collectively, the “Services”). This Privacy Policy describes the personal information we collect, why we collect it, who we disclose it to, how long we keep it, and the choices and rights you have.

In this policy, “NOMADIA,” “we,” “us” and “our” mean Tandum Studio Inc. Tandum Studio Inc. operates the Services, is the seller of record for every order placed through them, and is the sole business and data controller responsible for the personal information described in this Privacy Policy. Any other company that helps us run the Services does so only on our behalf and on our instructions, as our service provider.

Our store is powered by Shopify, which hosts the Services and processes personal information on our behalf and, in some cases, for its own purposes. Section 11 explains that relationship.

If this Privacy Policy conflicts with our Terms of Service, this Privacy Policy governs the collection, processing, and disclosure of personal information.

By using the Services, you acknowledge that you have read this Privacy Policy. Where applicable law requires your consent for a specific activity — for example, non-essential cookies or marketing text messages — we collect that consent separately, and reading this policy is not a substitute for it.

2. Notice at Collection — Summary

The table below is our notice at collection. It summarizes every category of personal information we collect, why, who receives it, how long we keep it, and whether it is “sold” or “shared” for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws. The sections that follow give the detail.

Categories collected in the preceding 12 months
Category Examples Why we collect it Disclosed to Retention Sold / Shared
Identifiers & contact details Name, email address, phone number, shipping and billing address, account username, order number, IP address, device and cookie identifiers Fulfill orders, service your account, respond to you, prevent fraud, marketing you have opted into Shopify; payment processors; carriers and 3PL; email and SMS platforms; support desk; advertising partners (identifiers only) See Section 12 Yes — shared for targeted advertising
Commercial & transaction information Items viewed, added to cart, purchased, returned, exchanged, or cancelled; order history; subscription status; loyalty balance; reviews written Process and fulfill transactions, returns and exchanges; run our loyalty and subscription programs; product recommendations Shopify; payment processors; carriers and 3PL; reviews, loyalty and subscription apps; advertising partners (event data) See Section 12 Yes — shared for targeted advertising
Payment information Payment card type, last four digits, billing address, transaction authorization result Take payment, process refunds, detect fraud and chargebacks Payment processors only See Section 12 No
Internet and network activity Pages viewed, referring URL, search terms on our store, clicks, session duration, email and SMS opens and clicks Operate and improve the store, measure marketing, security and abuse prevention Shopify; analytics providers; email, SMS and advertising partners See Section 12 Yes — shared for targeted advertising
Device information Browser type and version, operating system, device type, language, approximate location derived from IP address (city or region level) Render the store correctly, currency and language routing, fraud prevention Shopify; analytics and advertising partners See Section 12 Yes — shared for targeted advertising
Communications and user content Messages you send us, support tickets, survey answers, product reviews, photos or videos you submit with a review, social media interactions with our accounts Provide support, publish reviews you choose to submit, improve products Support desk; reviews platform; where you publish it, the public See Section 12 No
Product preferences you volunteer Skin type, texture preference, scent preference, shade or format preference, replenishment interval Recommend products and time replenishment reminders Email and SMS platforms; reviews and loyalty apps See Section 12 No
Inferences Predicted preferences and likely interest in a product category, drawn from the categories above Personalize the store and our marketing Email, SMS and advertising partners See Section 12 Yes — shared for targeted advertising

Categories we do not collect. We do not collect government identifiers such as Social Security, driver’s license or passport numbers; biometric information; precise geolocation; genetic or health-record information; financial account numbers; professional, employment or education records; or protected classification characteristics such as race, religion, sexual orientation, or medical condition. We do not ask for and do not want this information, and we do not use it. If you send it to us anyway — for example, in a support message — we remove it from our records where we are able to do so.

Sensitive personal information. We do not collect, use, or disclose sensitive personal information for any purpose that would trigger a right to limit its use under U.S. state privacy law. Information you volunteer about your skin, such as skin type or a texture preference, is used only to recommend products and to set replenishment timing. We do not treat it as, and do not ask you for, medical or diagnostic information.

3. What “Personal Information” Means Here

“Personal information” means information that identifies, relates to, describes, or can reasonably be linked to you. It does not include information that is aggregated or de-identified so that it can no longer reasonably be linked to you.

The categories we collect, and what each one contains, are listed in the table in Section 2. Three of them work in a way worth stating plainly:

  • Payment details. We receive your payment method, card type, the last four digits of your card, your billing address, and the authorization result. Full card numbers are collected and stored by our payment processors, never by us.
  • Account credentials. Passwords are stored by Shopify in hashed form. We cannot read them and cannot tell you what yours is.
  • Reviews and user content. Ratings, written reviews, any photo or video you attach, and the display name you choose are published publicly. See Section 9.

4. Where We Get It

  • From you directly — when you place an order, create an account, subscribe to email or text messages, write a review, enter a promotion, or contact us.
  • Automatically — from your device and browser when you visit the store, through cookies and similar technologies described in Section 6.
  • From our service providers — Shopify, payment processors, carriers, and the apps that run our email, text messaging, reviews, loyalty and subscription programs, when they process information on our behalf.
  • From advertising and analytics partners — aggregate campaign performance, and confirmation that a visit or purchase followed one of our advertisements.
  • From social and retail platforms — information you make available when you interact with our accounts, tag us, or buy through a platform storefront, subject to that platform’s own policies.

5. How We Use Personal Information

  • To run the store and fulfill your order. Take payment, verify and ship your order, arrange delivery, handle returns, exchanges, refunds and subscriptions, maintain your account, and send you transactional messages such as order confirmations, shipping updates and receipts.
  • To support you. Answer your questions, resolve problems, and keep a record of what we told you so the next person who helps you has the context.
  • To personalize the store. Remember your preferences, show recently viewed items, and recommend products.
  • To market to you. Send email and, where you have separately opted in, text messages about products, launches, restocks and offers; show you advertisements on other websites and apps; and measure whether any of it worked. Section 8 sets out how to stop this.
  • To operate our loyalty, referral and subscription programs and to award and redeem points, credits and rewards. See Section 10.
  • To keep the store secure. Authenticate accounts, screen orders for fraud and abuse, investigate chargebacks, enforce order and quantity limits, and protect our customers and our business.
  • To improve what we make and sell. Analyze aggregate sales, browsing and review data to decide what to stock, reformulate, or discontinue.
  • To meet legal obligations. Keep tax, accounting, customs, product safety and cosmetic regulatory records; respond to lawful requests; and establish, exercise or defend legal claims.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects about you, and we do not profile you for that purpose.

6. Cookies, Pixels and Similar Technologies

We and our partners use cookies, pixels, tags, SDKs and local storage to operate the store, remember your cart and preferences, measure traffic, and deliver and measure advertising. We group them as follows.

Cookie categories
Category What it does Can you switch it off?
Strictly necessary Keeps you logged in, holds your cart, applies your currency and language, protects checkout against fraud No — the store will not work without these
Analytics and performance Tells us which pages and products people look at, and where the store is slow or broken Yes
Marketing and advertising Measures our ads, builds audiences, and shows you our products on other sites and apps Yes

Your controls. You can manage non-essential cookies at any time through the cookie preferences link in our website footer. You can also block or delete cookies in your browser settings; parts of the store may then stop working. For advertising specifically, the industry opt-out tools at optout.aboutads.info and optout.networkadvertising.org, and each platform’s own ad settings, give you further control. Google Analytics offers a browser add-on at tools.google.com/dlpage/gaoptout.

Global Privacy Control. If you visit the store with the Global Privacy Control signal enabled, we treat it as a request to opt out of the sale and sharing of your personal information for that browser and device, and, where we can link the browser to your account, for your account as well. We do not respond to other “Do Not Track” signals, which have no agreed meaning. See globalprivacycontrol.org.

Opting out of sale and sharing. The cookie preferences link and the Global Privacy Control signal are each a valid way to opt out of the sale and sharing of your personal information for targeted advertising, and we treat them as such. If you would rather ask us directly, email help@tandumstudio.com with “Do Not Sell or Share” in the subject line and we will apply it to your account as well as your browser.

Because cookie-preference and Global Privacy Control opt-outs are stored per browser and per device, you will need to set them again on each browser and device you use, and they are cleared if you clear your cookies.

7. How We Disclose Personal Information

We do not sell your personal information for money. We disclose it in the following circumstances.

Recipients
Who Why What they get
Shopify Hosts the store, checkout, customer accounts and order records Everything you submit through the Services
Payment processors (Shopify Payments and any other payment method offered at checkout) Take payment, process refunds, screen for fraud Payment and billing details, order amount
Carriers, customs brokers and fulfillment partners Ship your order and handle returns and customs clearance Name, shipping address, phone, email, order contents
Email and text message platforms Send transactional and marketing messages you have opted into Contact details, order and browsing history, engagement data
Reviews, loyalty, referral and subscription platforms Collect and publish reviews; run loyalty, referral and subscription programs Contact details, order history, review content, loyalty balance
Customer support platform Receive and answer your messages Contact details, order history, message content
Analytics providers (including Shopify’s own store analytics) Measure and improve the store Device and usage information, order events
Advertising platforms (such as Meta, TikTok and Google) Deliver and measure advertising, build and match audiences Online identifiers, hashed email, page-view and purchase events
Operations and support providers Help us run customer support, order and store operations, and marketing, on our behalf and on our instructions Only the information needed for the task
Professional advisers, insurers, auditors and, where required, regulators, courts and law enforcement Legal, tax, accounting, product safety and dispute purposes Only what is necessary and lawfully required
An acquirer or successor In connection with a merger, financing, reorganization, sale of assets or insolvency Customer records, under confidentiality obligations

We identify these recipients by category because the specific providers we use change as we add or replace tools. If you want the names of the specific third parties we have disclosed your personal information to, email us and we will provide the current list.

Our service providers are contractually restricted to using your personal information to perform services for us. Advertising platforms use the information they receive under their own privacy policies and for their own purposes as well as ours — which is why, as set out in Section 2, we treat those disclosures as a “share” and in some states a “sale,” even though we receive no money for them. You can stop these disclosures at any time, in any of three ways: decline marketing cookies in our cookie preferences (the link in our website footer), browse with the Global Privacy Control signal enabled, or email us at help@tandumstudio.com with “Do Not Sell or Share” in the subject line. We honor all three the same way.

Tandum Studio Inc. alone is responsible for answering the requests described in Section 15 — you never need to contact another company to exercise a right.

We also disclose personal information when you ask or direct us to, and we may disclose aggregated or de-identified information, which cannot reasonably be linked to you, for any lawful purpose.

8. Email and Text Message Marketing

Email. We send marketing email only to people who have subscribed. Every marketing email has an unsubscribe link, and we process unsubscribe requests within the period required by law. We will still send you transactional messages about your orders, your account, your subscription, and product safety, because those are not marketing.

Text messages. If you opt in to our text message program, we send you marketing texts about products, launches and offers. Consent to receive marketing texts is not a condition of any purchase. Message frequency varies. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. To stop, reply STOP to any message from us; for help, reply HELP or contact us at help@tandumstudio.com. The full terms of the program are presented to you at the point you sign up.

Advertising. To stop seeing our personalized advertising, use the controls in Section 6 or any of the opt-out methods described in Section 7. You may still see our advertisements; they will not be tailored to you.

9. Reviews and Content You Submit

Reviews, ratings, photos, videos and the display name you choose are published on the Services and may be republished by us in marketing, on social media, and on retail partner listings. Anything you submit for publication is public and can be read, copied and indexed by anyone, including search engines. Do not include information in a review that you would not want to be public.

You keep ownership of what you submit. By submitting it, you grant us a non-exclusive, worldwide, royalty-free license to use, reproduce, adapt, publish and display it in connection with NOMADIA and our products, to the extent permitted by law.

We publish reviews regardless of whether they are positive or negative. We decline or remove a review only where it is unlawful, infringes someone else’s rights, contains another person’s personal information, is spam or a fake, is unrelated to the product, or contains threats or harassment. We do not remove or reorder reviews because of the rating or opinion they express, and we do not edit the substance of a review. If you want your own review taken down, contact us and we will remove it.

10. Notice of Financial Incentive

We offer benefits that involve the collection of personal information, and which may be a “financial incentive” under California law or a “bona fide loyalty program” under Colorado, Connecticut and other state laws:

  • Sign-up discount — for example, a first-order discount — in exchange for your email address or phone number.
  • Subscribe-and-save discount on recurring product subscriptions.
  • Loyalty and referral program awarding points, credits, early access or gifts based on purchases, referrals and reviews.
  • Promotions, giveaways and surveys that offer a reward for entering.

To take part, we need your contact details and a record of your purchases and activity. You join by opting in and can withdraw at any time by unsubscribing, contacting us at help@tandumstudio.com, or asking us to close your loyalty account; unredeemed points, credits and subscription discounts are then treated as our program terms provide. We do not otherwise treat you differently for exercising a privacy right.

We have estimated the value of the personal information involved to be no greater than the value of the benefit offered. Our good-faith estimate is based on the cost to us of the discounts, rewards and program fees, which we consider a reasonable approximation of the value of the personal information used to deliver them. We do not otherwise assign a monetary value to your personal information.

11. Our Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Information you submit is transmitted to Shopify and to third parties that may be located in countries other than where you live.

We also use certain Shopify enhanced features that draw on data from your interactions with our store, other merchants’ stores, and Shopify itself. For those features Shopify is responsible for the processing of your personal information, including for handling requests to exercise your rights over it. To understand how Shopify uses your personal information and what rights you have, see the Shopify Consumer Privacy Policy, and the Shopify Privacy Portal.

12. How Long We Keep It

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires. In practice:

Retention schedule
What How long Why
Order, invoice and tax records 7 years from the transaction Tax, accounting, customs and warranty obligations
Payment authorization records Duration of the chargeback and dispute window, then as our processor requires Dispute and fraud defense
Customer account While the account is open. We review inactive accounts periodically and close those with no order or login for an extended period. You can ask us to delete yours at any time So your history and addresses are there when you come back
Marketing lists (email and SMS) Until you opt out, then a suppression record indefinitely A suppression record is how we make sure we do not contact you again
Support conversations 3 years from the last message Continuity of support, product safety and dispute history
Reviews and user content Until you or we remove it Reviews stay useful to other customers over time
Analytics and advertising identifiers Per the cookie lifetime, and no more than 26 months Beyond that the data is no longer useful for measurement
Privacy request records 24 months from the request Required recordkeeping for privacy requests

When we no longer have a legitimate need for personal information, we delete or de-identify it. Where deletion is not immediately possible — for example, because it sits in a backup — we isolate it from further use until deletion is possible.

13. Security

We use organizational, procedural and technical safeguards appropriate to the sensitivity of the data we hold, including encrypted connections, access and authentication controls that limit administrative access to the people who need it, and payment card data handled by PCI-compliant processors rather than by us.

No system is perfectly secure, and information you send over the internet may not be secure in transit. Please do not send us sensitive or confidential information through unsecured channels. Keep your account password private and do not reuse it elsewhere; if you use a shared computer, log out when you finish.

14. Where Your Information Is Processed

We operate from the United States, and personal information we collect is stored and processed in the United States. Some of the people and service providers who help us run the Services, including customer support, are located outside the United States, including in the Republic of Korea, and may access personal information from there on our behalf. We require them to protect it to the standard described in this Privacy Policy.

Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on a recognized transfer mechanism — the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, including the European Commission’s adequacy decision covering the Republic of Korea — and we assess whether additional safeguards are needed.

15. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights. These rights are not absolute; in some cases we may decline a request as the law permits, and we will tell you why.

  • Know and access — ask what personal information we hold about you, where we got it, why we process it, and who we disclose it to, and get a copy.
  • Correct — ask us to fix personal information that is inaccurate.
  • Delete — ask us to delete personal information we hold about you, subject to records we must keep by law.
  • Portability — get a copy in a structured, commonly used, machine-readable format, or have it sent to another organization where that is technically feasible.
  • Get a list of specific third parties. Depending on where you live, you may ask us for a list of the specific third parties — not just the categories — to which we have disclosed your personal information. We will provide it on request wherever you live.
  • Opt out of sale, sharing and targeted advertising — decline marketing cookies in our cookie preferences, browse with the Global Privacy Control signal enabled, or email us at help@tandumstudio.com with “Do Not Sell or Share” in the subject line. Section 6 explains each route.
  • Opt out of profiling in furtherance of decisions with legal or similarly significant effects. As stated in Section 5, we do not do this.
  • Limit the use of sensitive personal information — we do not use sensitive personal information for any purpose that gives rise to this right.
  • Withdraw consent — where we rely on your consent, you can withdraw it at any time, with effect going forward.
  • Non-discrimination and non-retaliation — we will not deny you products or service, charge you a different price, or give you a lesser experience because you exercised a privacy right. The loyalty and subscription benefits in Section 10 are the one exception the law expressly allows, and only because they depend on the information involved.
  • Manage marketing — unsubscribe from email, reply STOP to text messages, or use the cookie controls in Section 6.

How to make a request. Email help@tandumstudio.com with what you want and the email address or phone number you used with us. Putting “Privacy Request” in the subject line helps us route it quickly, but it is not required — we treat any request we recognize as a privacy request as one, whichever of our addresses it arrives at. We operate exclusively online and deal with you directly, so email is the method we provide. You do not need an account to make a request.

Verification. We will ask you to confirm control of the email address or phone number on your order or account, and for enough detail to locate your records. We use what you give us for verification only. If we cannot verify you, we will tell you and explain why.

Timing. We acknowledge requests promptly and respond within 45 days. If we need more time we will tell you within that window and take no more than a further 45 days. You may make access or portability requests twice in any 12-month period.

Authorized agents. An agent may act for you if they give us written authorization signed by you, or a lawful power of attorney. We may still contact you to confirm the authorization and verify your identity.

Appeals. If we deny your request, you may appeal by emailing admin@tandumstudio.com with “Privacy Appeal” in the subject line. Appeals are reviewed separately from the team that handled the original request. We will respond within the period your state’s law allows, and if we deny the appeal we will tell you how to complain to your state attorney general.

16. U.S. State Privacy Notices

The rights in Section 15 are available to residents of every U.S. state with a comprehensive privacy law, including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, as those laws take effect and apply to us. We act as a “business” and “controller” with respect to that information.

California

Section 2 sets out the categories of personal information we have collected, disclosed for a business purpose and shared in the preceding 12 months, with the sources, purposes, recipients and retention periods California law requires. We have not sold personal information for monetary consideration.

We have no actual knowledge that we sell or share the personal information of consumers under 16 years of age.

Shine the Light. California residents may request information about personal information we disclosed to third parties for their own direct marketing purposes in the prior calendar year. Email help@tandumstudio.com with “Shine the Light” in the subject line.

Consumer health data — Washington and Nevada

We do not collect, use, sell or share “consumer health data” as defined by the Washington My Health My Data Act or Nevada SB 370. We do not infer health status from your purchases, we do not build health-related advertising audiences, and we do not operate a geofence around any healthcare facility. The product preferences described in Section 2 are used for product recommendation and replenishment only. If this ever changes, we will publish a separate consumer health data privacy notice and obtain the consent and authorizations those laws require before doing so.

Nevada

We do not sell personal information as Nevada’s SB 220 defines it. Nevada residents may still email help@tandumstudio.com with “Nevada Do Not Sell” in the subject line.

17. If You Are in the EEA, the UK or Switzerland

We are based in the United States and do not target the European Economic Area, the United Kingdom or Switzerland. If you are located there and choose to use the Services, the following applies to the extent European or UK data protection law applies to us.

Our legal bases
What we do Legal basis
Take your order, ship it, handle returns, run your account and subscription Performance of our contract with you
Fraud prevention, security, product improvement, aggregate analytics Our legitimate interests in running a secure and viable business
Marketing email and text messages, non-essential cookies, personalized advertising Your consent
Tax, accounting, customs and product safety records; responding to lawful requests Compliance with a legal obligation

In addition to the rights in Section 15, you may object to processing based on our legitimate interests, ask us to restrict processing in certain circumstances, and withdraw consent at any time without affecting the lawfulness of processing before you withdrew it. You may lodge a complaint with your local supervisory authority — a list for the EEA is available from the European Data Protection Board, and in the UK with the Information Commissioner’s Office.

18. Other Jurisdictions

We are established in the United States and the Services are directed to customers there. If you are located elsewhere, we handle your personal information as described in this Privacy Policy, and we will honor the access, correction, deletion and withdrawal-of-consent requests described in Section 15 to the extent the law of your country applies to us. Contact help@tandumstudio.com and tell us where you are located.

19. Children

The Services are for adults. We do not knowingly collect personal information from children under 13, or under 16 where local law sets that age. We do not market to children and our products are sold for purchase by adults. If you are a parent or guardian and believe your child has given us personal information, email help@tandumstudio.com and we will delete it.

The Services link to sites and platforms we do not control, including social media, retail partners and payment providers. This Privacy Policy does not apply to them, and we are not responsible for their practices or content. Read their privacy policies before giving them your information. Anything you post in a public or semi-public place, including a social platform, may be visible to others and used by them.

21. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or the law. We will post the revised version here and update the “Last updated” date. If the changes are material we will give you more prominent notice — a notice on the store, an email, or, where the law requires it, a fresh request for your consent — before they take effect for information we already hold.

22. Contact Us

For any question about this Privacy Policy or our privacy practices, or to exercise a right, contact us below. NOMADIA is operated by Tandum Studio Inc., so our email addresses use the tandumstudio.com domain even though you shop at nomadiaskin.com — email from those addresses is genuinely from us.

Tandum Studio Inc. d/b/a NOMADIA
Attn: Privacy
1111B S Governors Ave, STE 34273, Dover, DE 19904, United States
help@tandumstudio.com — questions and requests
admin@tandumstudio.com — appeals

For the purposes of applicable data protection law, Tandum Studio Inc., a Delaware corporation, is the business and data controller responsible for the personal information described in this Privacy Policy.