Privacy policy

Last updated: 6 September 2026

1. Organisation responsible for personal information

APC Commerce LLC, trading through AURA Monaco and Korean Lash Lift, is responsible for personal information handled through koreanlashlift.ca.

Corporate address: 3833 Powerline Road, Suite 301-M, Fort Lauderdale, Florida 33309, United States. This is not a returns address. Canadian orders are fulfilled from Brampton, Ontario.

The person accountable for privacy compliance is the Privacy Officer. Contact: hello@beamlight-lashes.com. WhatsApp messaging: +33 (0) 7 56 92 34 30. We do not offer telephone support.

This policy explains our practices under the Personal Information Protection and Electronic Documents Act, provincial private-sector privacy laws where applicable, and Canada's Anti-Spam Legislation. More than one law may apply to an interprovincial or international transaction.

2. Information we collect

Depending on how you use the store, we may collect:

identity and contact details such as name, email address, telephone number, billing and delivery address;
order and transaction details such as products, prices, taxes, discounts, shipping selection, payment status, returns and refunds;
limited payment information such as payment method, provider token, transaction reference and fraud-screening result; full card details are normally entered directly into and processed by the selected payment provider;
account and course information such as login identifiers, enrolment, progress, assessment results, certificate status and access events;
professional and business details supplied for salon, tax, affiliate, reseller or support purposes;
support, form and claim content, including photographs, video, batch data, treatment information and correspondence that you choose to provide;
marketing preferences, consent records, unsubscribe status and campaign interactions;
device and usage information such as IP address, browser, device, approximate location, referring page, viewed pages, cart events, timestamps, cookies and similar identifiers; and
fraud, abuse and security information needed to protect accounts, payments, content and the website.

Please do not send health or other sensitive information unless it is reasonably necessary for a support or safety request. Where you provide another person's information, including a client photograph or treatment record, you confirm that you are authorised to do so and have limited the disclosure to what is necessary.

3. How we collect information

We collect information directly when you place an order, create an account, enrol in a course, submit a contact or return form, communicate with us, join marketing, post a review or otherwise provide it.

We collect technical and interaction data automatically through the website, server logs, cookies, tags and similar technologies. We may receive information from payment providers, fraud-prevention services, carriers, fulfilment partners, course systems, advertising platforms, analytics providers, affiliates and social networks consistent with your settings and applicable law.

4. Purposes and consent

We collect, use and disclose personal information only for purposes that a reasonable person would consider appropriate, including:

processing payments, accepting and fulfilling orders, arranging Purolator or Canada Post delivery, and issuing transaction records;
creating and securing accounts, delivering courses, recording progress and issuing certificates;
answering enquiries, troubleshooting, administering returns and claims, and investigating product or safety concerns;
verifying identity, professional status, address and payment information where necessary;
detecting fraud, credential sharing, malicious activity, chargeback abuse and legal or policy violations;
keeping tax, accounting, product, consent, complaint, safety and legal records;
maintaining, measuring and improving the store, checkout, content, advertising and customer service;
managing affiliates and measuring referrals or campaigns; and
sending marketing where we have express consent or another lawful basis and maintaining suppression records after an unsubscribe.

Consent may be express or implied depending on sensitivity, reasonable expectations and legal requirements. We seek express consent for marketing and other non-essential processing where required. You may withdraw consent for future processing, subject to legal or contractual restrictions and reasonable notice. Withdrawal may prevent us from providing a requested optional service but does not affect processing already lawfully completed.

We may process information without consent where the law permits or requires, including specified fraud, investigation, debt, emergency, legal-process and business-transaction circumstances.

5. Service providers and disclosures

We disclose only the information reasonably required for the service, legal duty or protection involved. Recipients may include:

WordPress, WooCommerce, CheckoutWC and hosting, caching, content-delivery, backup, security and technical support providers;
Stripe, PayPal and any other payment option selected at checkout, together with their fraud and identity providers;
our Ontario fulfilment operation, Purolator and Canada Post;
Zoho ZeptoMail and other transactional email infrastructure;
Klaviyo and other consent-based email or SMS marketing providers;
Contact Form 7 and connected form delivery or record systems;
LearnPress and connected course, certificate and account tools;
Meta, Google, Microsoft and related analytics or advertising services where enabled and permitted by your consent settings;
affiliate, review, back-in-stock, invoice and customer-support providers used by the store;
accountants, insurers, banks, payment dispute systems, auditors and legal advisers; and
regulators, courts, law enforcement, tax authorities, acquirers or other persons where required or permitted by law.

Service providers act under their own legal obligations and, where applicable, contractual privacy and security terms. We do not sell personal information for money. Some advertising disclosures may be regulated as targeted advertising or another type of sharing in certain jurisdictions; available consent controls apply.

6. Processing outside Canada

APC Commerce LLC and some providers are located outside Canada, including in the United States and Europe. Personal information may therefore be stored or processed in Ontario, elsewhere in Canada, the United States, the European Economic Area or another country where a provider operates.

We remain accountable for information transferred to a processor and use contractual, organisational and technical measures appropriate to the information and service. Information in another country may be accessible to courts, law enforcement, national-security or regulatory authorities under that country's law.

Where Québec law applies, we assess relevant privacy factors before communicating personal information outside Québec and use a written agreement and safeguards as required. Contact the Privacy Officer for information about processing locations relevant to your transaction.

7. Cookies analytics and advertising

Essential cookies support the cart, checkout, login, security, fraud prevention, language or country selection and other requested functions. Disabling them may prevent the store from working.

Analytics, advertising and personalisation technologies are used only as permitted by applicable law and the consent controls presented on the site. They may record page views, product interactions, purchases, campaign attribution, approximate location and device identifiers. Providers may combine data with information they already hold under their own notices.

You can use the cookie controls, browser settings and provider controls to withdraw optional consent. A browser do-not-track signal is handled only where supported by the relevant technology or legally required. Cookie withdrawal does not delete transaction records we must retain.

8. Email SMS and service communications

Order confirmations, security notices, password messages, delivery updates, support replies and course-access communications are service messages. They may be sent as necessary to perform a transaction or respond to you.

Commercial email and SMS are sent only with express consent or another basis permitted by CASL. Each message identifies the sender and includes a readily performed unsubscribe method where required. Express consent remains effective until withdrawn. Implied consent may expire. We keep records needed to demonstrate consent and honour any clear unsubscribe request within 10 business days.

Unsubscribing from marketing does not prevent non-marketing messages necessary for an existing order, account, legal notice or course service.

9. Retention

We retain personal information only as long as reasonably necessary for the identified purpose, legal duties, security, disputes and enforcement. Criteria include the order and tax record period, course access period, warranty or limitation period, consent status, unresolved claim, fraud risk and provider backup cycle.

Typical operational targets are:

order, tax, invoice and payment-status records for the period required by tax, accounting and limitation laws;
account and course records for the access period and a reasonable period afterwards for certificates, support, disputes and security;
support and return files for the time needed to resolve the request and defend or enforce claims;
marketing records until consent is withdrawn or no longer relied on, with a minimal suppression record retained to respect the unsubscribe; and
technical and security logs for a shorter period proportionate to security and fraud needs unless an incident requires longer retention.

When information is no longer required, we delete, anonymise or securely isolate it, subject to lawful backups and records that must be retained. We keep a record of each security breach for at least 24 months where PIPEDA requires.

10. Security and incidents

We use safeguards proportionate to the sensitivity and volume of the information, including access restriction, authentication, encryption in transit, provider controls, updates, monitoring, backup, staff confidentiality and incident procedures. No internet system is completely secure, and we do not make an absolute security guarantee.

If a breach creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada, notify affected individuals and inform other organisations where required. Provincial notification rules may also apply.

11. Access correction and complaints

You may make a written request to learn whether we hold personal information about you, obtain access and request correction, subject to identity verification, legal exceptions and lawful fees. Under PIPEDA we normally respond within 30 days, subject to a permitted extension. We explain a refusal and available recourse where required.

You may also ask about consent, complain about our handling, or request deletion. Deletion is not absolute where information remains necessary for a transaction, tax, fraud, safety, legal or dispute purpose. We will explain a lawful refusal or alternative.

Send requests to the Privacy Officer at hello@beamlight-lashes.com with enough detail to locate the information. Do not email passwords or full payment-card numbers.

If the issue is not resolved, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. Depending on the facts and province, the privacy regulator in Alberta, British Columbia or Québec may instead or additionally have jurisdiction.

12. Québec privacy rights

Where Québec's private-sector privacy law applies, Québec residents may have rights to access and rectify information, withdraw consent, request cessation of dissemination or de-indexing in applicable circumstances, and receive information about automated decisions and portability when the relevant statutory conditions are in force. Requests are subject to identity verification, exceptions and the applicable timetable.

The Privacy Officer is the person responsible for the protection of personal information for purposes of this policy. Québec complaints may be directed to the Commission d'accès à l'information du Québec after contacting us.

13. Children

The store and professional courses are not directed to children. We do not knowingly collect personal information from a child who cannot provide meaningful consent. A parent or guardian should contact us if a child supplied information without appropriate authorisation.

14. Automated processing fraud and personalisation

Payment, security, advertising and fraud providers may use automated signals to assess a transaction or personalise content. We do not intend to make a legally significant decision solely by automated means without the notice, explanation and review opportunity required by applicable law. A blocked or held order may be submitted to support for human review.

15. Third-party links and accounts

Links to another website, social network or payment service lead to a service controlled by that organisation. Its privacy notice applies to its own collection and use. Connecting or communicating through a third-party account may provide us with the information described when you use that connection.

16. Changes to this policy

We may update this policy when services, providers or legal duties change. The current version and effective date appear on this page. We will provide additional notice or obtain fresh consent where a material change requires it. A new policy does not retroactively authorise an unrelated use of existing information.

17. Contact

Privacy Officer
APC Commerce LLC
3833 Powerline Road, Suite 301-M
Fort Lauderdale, Florida 33309
United States
Email: hello@beamlight-lashes.com
WhatsApp messaging: +33 (0) 7 56 92 34 30
No telephone support is offered.

The corporate address is not a returns address. Use koreanlashlift.ca/returns for return instructions.

Privacy Policy