Privacy policy

Privacy Policy

Last updated: 22 August 2026

This Privacy Policy explains how Pensieve LLC, trading as Millimili ("Millimili", "we", "us", "our"), collects, uses, shares and protects personal information when you visit www.millimili.com (the "Site"), place an order, contact us, or otherwise interact with our services (together, the "Services").

We are the data controller responsible for your personal information.

1. Who we are and how to contact us

Please use the email address above for any request relating to your personal information, including access, deletion, correction and objection requests. Marking your email "Privacy Request" helps us route it quickly.

2. What personal information we collect

2.1 Information you give us directly

  • Contact details: name, email address, telephone number, billing address, delivery address.
  • Order information: items ordered, order number, order value, payment confirmation, delivery and billing addresses, order history, returns and refunds.
  • Account information: where you create an account, your name, email address and password (stored in encrypted form by our platform provider).
  • Customer service information: the content of emails and messages you send us, including any photographs you provide in support of a return or damage claim.
  • Marketing preferences: whether you have subscribed to our emails and your consent records.
  • Content you submit: reviews, comments, photographs or other material you choose to share with us.

2.2 Information collected automatically

  • Device and connection data: IP address, browser type and version, operating system, device type, screen size, language and country settings.
  • Usage data: pages viewed, products viewed, items added to cart or wishlist, referring page, search terms used on the Site, time and duration of visits, and interactions with the Site.
  • Cookie and similar identifiers: see Section 5.

2.3 Information we receive from third parties

  • Payment data from our payment providers — we receive confirmation of payment, the payment method type and the last four digits of the card. We never receive or store your full card number, expiry date or security code.
  • Delivery status from carriers.
  • Fraud and risk signals from our e-commerce platform and payment providers.
  • Aggregated advertising and analytics reporting where we run advertising campaigns.

2.4 What we do not collect. We do not knowingly collect special categories of personal data (such as health, religious or biometric data), and we do not ask you for them. Please do not include such information in messages to us.

3. Why we use your personal information, and our legal basis

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

  • Processing and delivering your order — taking payment, arranging shipping, handling returns and refunds.
    Data: contact, order, payment confirmation and delivery data. Legal basis: performance of a contract with you.
  • Creating and managing your account
    Data: account and contact data. Legal basis: performance of a contract with you.
  • Providing customer support and responding to your messages
    Data: contact, order and customer service data. Legal basis: performance of a contract; our legitimate interest in supporting our customers.
  • Sending marketing emails about our products and offers
    Data: contact data, marketing preferences, purchase and browsing history. Legal basis: your consent, which you may withdraw at any time; or our legitimate interest in marketing to existing customers where permitted.
  • Advertising, and measuring how well it works
    Data: usage data, cookie identifiers, order data. Legal basis: your consent where required for cookies and similar technologies; otherwise our legitimate interest in promoting our business.
  • Operating, securing and improving the Site; analytics
    Data: device, connection and usage data. Legal basis: our legitimate interest in running a secure and effective website; your consent for non-essential cookies.
  • Preventing and investigating fraud, payment abuse, chargeback abuse and misuse of the Services
    Data: order, payment, device and account data. Legal basis: our legitimate interest in protecting our business; compliance with legal obligations.
  • Meeting accounting, tax, customs and other legal obligations
    Data: order, payment and contact data. Legal basis: compliance with a legal obligation.
  • Establishing, exercising or defending legal claims, including payment disputes
    Data: any relevant data. Legal basis: our legitimate interest in protecting our legal rights.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object at any time — see Section 9.

4. Who we share your personal information with

We do not sell your personal information for money. We share it only with the following categories of recipient, and only as necessary:

  • Shopify Inc. — our e-commerce platform provider.
    Hosting the Site, processing orders and accounts, storing customer and order data, site analytics, fraud screening, email delivery. Canada / United States / EU.
  • Payment providers — including Shopify Payments, PayPal, Apple Pay, Google Pay and the card networks, as applicable to your chosen method.
    Taking payment, verifying transactions, preventing fraud, processing refunds and chargebacks. United States / EU.
  • Shipping carriers and fulfilment partners
    Delivering your order, providing tracking, handling returns and customs clearance. Varies by destination.
  • Email and marketing platforms — Shopify Email and Klaviyo (email and SMS).
    Sending order notifications and, where you have subscribed, marketing emails and messages, and measuring whether they are opened and clicked. United States / EU.
  • Advertising and analytics partners — currently Google (Google Ads, Google Analytics and YouTube) and Pinterest. Our Meta (Facebook and Instagram) and TikTok channels are connected but are not currently collecting data; if we activate them they will process data on the same basis.
    Measuring and optimising advertising, attributing sales to campaigns, building and reporting on audiences. United States / EU.
  • Professional advisers — accountants, lawyers and auditors — and public authorities.
    Legal, tax and accounting compliance; responding to lawful requests. United States.

We may also disclose personal information in connection with a merger, acquisition, financing or sale of all or part of our business, to enforce our Terms of Service, or where we believe disclosure is necessary to protect our rights, your safety or the safety of others, or to prevent fraud or illegal activity.

All service providers are bound by contract to process personal information only on our instructions and to protect it appropriately.

5. Cookies and similar technologies

We use cookies, pixels and similar technologies on the Site. They fall into these categories:

  • Strictly necessary — required for the Site to work: keeping your shopping cart, signing you in, security, load balancing, fraud prevention, and remembering your cookie choices. These cannot be switched off.
  • Functional — remembering your preferences, such as language, country and currency.
  • Analytics — helping us understand how visitors use the Site so we can improve it. This includes our e-commerce platform's built-in analytics.
  • Marketing and advertising — set by our advertising partners (currently Google and Pinterest) and by Klaviyo, to measure campaign performance and to show you relevant advertising on other platforms. In regions where consent is required, these are set only after you consent.

Where required by law, we set non-essential cookies only with your consent, collected through the cookie banner when you first visit. You can change or withdraw your choices at any time through the cookie settings on the Site, and you can block or delete cookies through your browser settings. Blocking cookies may affect how parts of the Site work.

Our platform provider Shopify also sets cookies necessary to operate the store; these are described in Shopify's Cookie Policy.

If you visit the Site with a Global Privacy Control signal enabled, we will treat it as an opt-out of the sale or sharing of personal information for that browser where applicable law requires.

6. International transfers

We are established in the United States, and our service providers operate in the United States, Canada, the European Economic Area and elsewhere. This means your personal information may be transferred to, stored in and processed in countries outside your own, including countries that may not provide the same level of data protection as your home country.

Where we transfer personal information out of the EEA, the United Kingdom or Switzerland, we rely on an appropriate safeguard, in particular the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant), or on a finding of adequacy where one applies. You may request a copy of the relevant safeguard by emailing support@millimili.com.

7. How long we keep your personal information

We keep personal information only as long as necessary for the purposes described above:

  • Order, invoice and payment records — 10 years from the end of the relevant financial year, to meet accounting and tax obligations.
  • Customer account data — for as long as your account is active, then up to 3 years of inactivity, after which it is deleted or anonymised.
  • Customer service correspondence — 3 years from the last contact.
  • Marketing contact data and consent records — until you unsubscribe or withdraw consent, then consent records kept for up to 3 years as proof of compliance.
  • Cookie and analytics data — up to 24 months, depending on the cookie; see the cookie settings for details.
  • Fraud, chargeback and dispute records — up to 7 years, to establish, exercise or defend legal claims.
  • Reviews and content you have made public — until you ask us to remove them.

Where we no longer need personal information, we delete it or irreversibly anonymise it. Some data may persist for a short period in backups before being overwritten.

8. Security

We take appropriate technical and organisational measures to protect personal information, including encryption of the Site in transit (TLS), access controls limiting who can see customer data, use of PCI-DSS compliant payment providers so that we never handle full card details, and regular review of the access rights of our staff and providers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please do not send us sensitive information such as full card numbers or identity documents by email. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, you, without undue delay.

9. Your rights

Depending on where you live, you may have the following rights in relation to your personal information:

  • Access — to be told whether we hold personal information about you and to receive a copy of it.
  • Rectification — to have inaccurate or incomplete information corrected.
  • Erasure — to ask us to delete your personal information, where there is no ongoing lawful reason for us to keep it.
  • Restriction — to ask us to limit how we use your information in certain circumstances.
  • Objection — to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing.
  • Portability — to receive certain information in a structured, commonly used, machine-readable format and to have it transmitted to another controller.
  • Withdraw consent — where we rely on consent, to withdraw it at any time. This does not affect processing carried out before the withdrawal.
  • Opt out of sale, sharing or targeted advertising — where applicable law provides this right.
  • Non-discrimination — we will not treat you differently for exercising your rights.
  • Appeal — where we decline a request, to appeal our decision by replying to our response.

How to exercise your rights. Email support@millimili.com. We may need to verify your identity — usually by confirming the email address associated with your orders — before we act on a request, in order to protect your information from unauthorised disclosure. We will respond within 30 days, or within any shorter period required by applicable law. If a request is complex we may extend this period and will tell you if we do. Some rights are not absolute and we may decline a request where the law allows, in which case we will explain why.

You can unsubscribe from marketing emails at any time using the unsubscribe link in any marketing email. We will still send you transactional messages about your orders.

10. Complaints

If you are unhappy with how we have handled your personal information, please contact us first at support@millimili.com so we can try to resolve it. You also have the right to lodge a complaint with the data protection authority in your country of residence, place of work or where the issue occurred. In the EU you can find your national authority through the European Data Protection Board; in the UK, the Information Commissioner's Office (ico.org.uk).

11. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Our payment providers and e-commerce platform apply automated fraud screening to transactions; if an order is declined on this basis you may contact us and a person will review it.

12. Children

The Services are not directed at children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, please contact support@millimili.com and we will delete it. We do not knowingly sell or share the personal information of individuals under 16.

13. Third-party sites and content

The Site may link to third-party websites, social media platforms and services that we do not control. This Privacy Policy does not apply to them. We encourage you to read the privacy policy of any site you visit. Information you post publicly — including reviews and social media content — may be seen and used by others, and we cannot control that use.

14. Additional information for specific regions

14.1 European Economic Area and United Kingdom. The legal bases on which we rely are set out in Section 3, retention periods in Section 7, transfer safeguards in Section 6 and your rights in Section 9. As we are established outside the EEA and the UK, you may contact us for all data protection matters at support@millimili.com; where we are required to designate a representative under Article 27 GDPR, their details will be published in this Policy.

14.2 United States. Residents of California, Colorado, Connecticut, Virginia and other states with comprehensive privacy laws may have rights to know, access, delete, correct and port personal information, and to opt out of the sale or sharing of personal information and of targeted advertising. The categories of personal information we collect, the purposes for which we use them and the categories of recipients are described in Sections 2, 3 and 4. We have not sold personal information for monetary consideration in the preceding 12 months. To exercise your rights, or to have an authorised agent do so on your behalf, email support@millimili.com.

14.3 Türkiye. Where the Turkish Personal Data Protection Law No. 6698 (KVKK) applies to our processing, this Policy serves as our disclosure notice under Article 10, and data subjects may exercise their rights under Article 11 — including learning whether their data is processed, requesting information, correction, deletion and objection — by writing to support@millimili.com.

15. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or for legal, operational or regulatory reasons. We will post the updated version on the Site and change the "Last updated" date above. Where changes are significant, we will take additional steps to notify you as required by law.

16. Contact

For any question about this Privacy Policy or about how we handle your personal information, email support@millimili.com.