Privacy Notice

Last updated October 31, 2026.

This notice explains what personal information Love & Carat collects, why we collect it, who we share it with and what you can do about it. We have tried to write it in plain English rather than legal boilerplate.

Who We Are

Love & Carat sells certified loose diamonds and gemstones online at loveandcaratnewyork.com. We are based in New York, and our orders ship from our partners in the US, the UK and elsewhere.

For orders delivered to the United States, Love & Carat is a trading name of Love and Carat, LLC, a Delaware limited liability company with its office at 45 Rockefeller Plaza, 20th Floor, New York, NY 10111. The company you buy from is the data controller for the information described here.

Questions, requests or complaints: concierge@loveandcarat.com.

The Short Version

• We collect what we need to sell you a stone and support you afterwards: your name, contact details, delivery address and order history.
• We never see or store your card number. Payments are handled on Stripe's own checkout.
• Telephone calls to us are recorded, and you are told so at the start of every call. See "Calls to Us" below.
• The assistant in our chat is an AI, and it tells you so when a chat starts. Chats are kept to answer you and to improve the assistant. See "Our Chat Concierge" below.
• We only send marketing email if you asked for it, and every message has an unsubscribe link.
• We use the Meta Pixel to measure our Facebook and Instagram ads. In the UK, the EEA and Switzerland it only loads if you agree. See "Cookies" below.
• Our systems run on Amazon Web Services in the United States, under the safeguards described below.
• You can export or delete your data yourself from your account page, or ask us to do it.

What We Collect, and Why

When you browse the site. A cookie remembers your currency, and another remembers your cookie choices. If you are in the UK or the EEA we only measure how the site is used after you agree to it. Our own analytics records pages and events against a random session identifier and, where a record of consent is needed, a one-way hash of your IP address rather than the address itself. Like any website, our servers also keep a log of each request (your IP address, the page and your browser) to keep the site secure and to see how search engines read it. Where your cookie choices allow advertising, the Meta Pixel also tells Meta about your visit (see "Cookies" below). Our legitimate interest in running and improving the shop, and your consent where the law requires it.

When you create an account. Your name, email address, password (stored only as a cryptographic hash) or your Google sign-in, your currency preference, and two-factor authentication settings if you turn them on. To perform our contract with you and keep your account secure.

When you order. Your name, delivery address, phone number, email address, what you bought, and the order's history. To perform our contract with you. We keep invoice records because tax law requires it.

Rewards. If you have an account, the points your orders earn and every time they move (earned, unlocked, used, taken back after a return, or expired), and a note of when we email you that points are about to expire. To perform our contract with you, under the Rewards Terms.

When you pay. Stripe collects and processes your card or Klarna details on its own hosted checkout. We receive only a payment reference, the result, the type of payment method and the billing country. Contract, and our legal obligations around payments and fraud.

When we ship. Your name, address, phone number and email go to Royal Mail so the parcel can be delivered and tracked. For orders outside the UK a customs declaration describing the contents and value goes with the parcel. Contract and legal obligation.

When you email us. Messages to concierge@loveandcarat.com, and anything attached, become a support case with its history so whoever picks it up can help you properly. Contract and our legitimate interest in answering you.

When you call us. See the next section.

When you chat with our concierge. The conversation itself and, if you choose to give them in the chat, your name, email address and phone number. See "Our Chat Concierge" below.

When you subscribe to offers. Your email address, the offer you were shown, the country you were in and a record of your consent. In the UK and the EEA you also confirm by clicking a link in an email before we send anything else. Consent.

Review invitations. After your order is delivered we ask you for a review, and Trustpilot sends you its own invitation: for that we give Trustpilot your name, your email address and the order number, and nothing else. We invite every customer, whatever they might say. Legitimate interests (hearing how we did). If you write a review, Trustpilot publishes it under its own terms. Consent.

Calls to Us

Calls to our phone line are answered by an automated assistant called Emma, and calls are recorded. You are told this in the first sentence of every call, before you say anything, so you can hang up if you would rather not be recorded.

• What we keep: the audio recording, a written transcript, a short summary of what the call was about, your phone number, and anything you asked us to act on, such as a case.
• Why: to have an accurate record of what was agreed, to answer your question properly afterwards, and to check and improve the quality of the service. Our legitimate interests.
• What we never take by phone: card numbers, passwords and one-time codes. If you start to read a card number, Emma will stop you and we will send a secure payment link instead. Card-like numbers are automatically removed from transcripts.
• How long: recordings for 12 months, and the transcript, summary and any case for 3 years.
• Your choices: you can ask for a copy of a recording, ask us to delete it, or object to being recorded, by emailing concierge@loveandcarat.com. If you would rather not be recorded at all, please email us instead of calling.

The call is handled for us by Vapi, which uses speech recognition and language-model providers to run the assistant. They act on our instructions and may not use your conversation for their own purposes.

Our Chat Concierge

The concierge in the corner of the site is an AI assistant. It has a name and a portrait so it's easy to talk to, but it is not a person and the portraits are of people who don't exist. It tells you it is an AI assistant in its first message, and again whenever you ask.

• How it answers: its replies are written by us in advance and filled in with facts from our catalog, your order and our policies. AI models help it understand your message and choose which of our own sentences answer a question, but they don't write what you read.
• What we keep: the conversation, what the concierge showed you (such as stones, comparisons or an order's progress), your thumbs up or down, and anything you asked it to do for you: a case for our team, an email of your shortlist, an alert when new stock arrives, or a return. You can start chatting without giving any details. The concierge asks for your name and email, and a phone number if you'd like, so we can reach you if the chat is interrupted; you don't have to give them, and if you do we keep them with the conversation and as a contact of ours.
• Why: to answer you and carry out what you ask (our contract with you, or steps you asked us to take before one), to follow up by email when a person needs to help (our legitimate interests), and to check and improve the concierge, for example by writing better answers to common questions (our legitimate interests). To improve it we may also use copies of conversations with names, email addresses, phone numbers and card numbers removed.
• Orders: the concierge only shows an order when you give the order number and the email address on it, or type a one-time code we email to that address. It shows the order's progress, items and tracking, never the delivery address or payment details.
• Photos: if you send a photo to find similar stones, we remove its location and camera details before storing it, keep it privately for 30 days, and never publish it.
• What it never asks for: card numbers, passwords or other one-time codes. Card-like numbers are automatically removed from what we keep.
• Who runs it: OpenRouter routes each message to an AI model provider, and we only allow providers that neither keep nor train on your conversation. TypeSafe checks each message first so that abusive or unrelated messages are stopped. Neither may use your conversation for its own purposes, and no one trains AI models on your chats: we only use them to improve our own concierge. When you send your first message, Cloudflare Turnstile checks invisibly that you're a person (see its privacy addendum).
• Marketing: giving your email in the chat doesn't sign you up for anything. After you give it, the concierge asks once whether you'd like our new stones and offers by email, and we only send them if you say yes. In the UK and the EEA you also confirm by email first, and every email has an unsubscribe link.
• How long: conversations for 12 months, photos for 30 days, and the copies with personal details removed for 12 months.
• Your choices: you don't have to use the chat; you can always email concierge@loveandcarat.com instead. You can ask for a copy of a conversation or for it to be deleted by emailing us.

Cookies

We keep cookies to a minimum and we do not sell advertising space.

• Essential. A cookie that remembers your currency, a cookie that remembers your cookie choices, and sign-in cookies if you have an account. These do not need consent because the site does not work properly without them.
• Analytics. Our own measurement of how the site is used, and Google Analytics, which sets cookies called ga and _ga followed by an id (kept for up to two years) and tells Google the pages you view, how you arrived and details of your browser and device. Orders, sign-ups and checkouts are sent to Google Analytics from our own systems, without your name or contact details. In the UK and the EEA none of this is set or sent until you agree, and you can change your mind at any time from the cookie banner.
• Advertising. The Meta Pixel, from Meta Platforms (Facebook and Instagram). It tells us whether our ads lead to visits and orders, and lets us show our ads on Facebook and Instagram to people who have visited the site. It sets a cookie called _fbp, and one called _fbc if you arrived from one of our ads, each kept for up to 90 days, and sends Meta the pages you view, the buttons you press, the products you look at, add to your bag and buy (with their prices and your order's total), details of your browser and device, and your IP address. If you type your email address, name, phone number, address, gender or date of birth into a form on the site, the pixel also sends Meta a scrambled (hashed) copy, which Meta uses to match your visit to a Facebook or Instagram account. Meta also uses this information for its own purposes, under the Meta Privacy Policy. In the UK, the EEA and Switzerland the pixel only loads after you agree. Elsewhere it loads unless you opt out: we treat your browser's Global Privacy Control signal as an opt-out, and you can also choose how Meta uses this information in your Facebook or Instagram ad settings. Your consent where the law requires it; otherwise our legitimate interest in advertising the shop.

Videos in Our Journal

Some articles in our Journal include videos hosted on YouTube. Before you press play, the page shows the video's still image, which your browser fetches from YouTube's image servers; like any request, that gives YouTube (part of Google) your IP address and details of your browser. The player itself loads only when you press play, from YouTube's privacy-enhanced service, and YouTube may then store cookies or similar information on your device. Both are covered by the Google Privacy Policy. We use the YouTube API Services to find and check the videos we show, which involves none of your information.

Who We Share It With

We do not sell your personal information. We share it with the suppliers who make the shop work, and each of them is only allowed to use it to provide their service to us:

• Amazon Web Services: hosting and databases
• Stripe: payments, including Klarna
• Mailtrap: sending our email
• Namecheap Private Email: our concierge mailbox
• Vapi, and the speech and language providers it uses: the phone assistant
• OpenRouter, and the AI model providers it routes to (only ones that neither keep nor train on your conversation): the chat concierge
• TypeSafe: checking each chat message before the concierge answers
• Cloudflare: Turnstile, an invisible check that the chat and our sign-up forms are used by a person rather than a bot. It looks at signals from your browser and connection, under Cloudflare's Turnstile Privacy Addendum
• Google: Google Analytics (see Cookies), sign-in if you choose it, the search behind the phone assistant's knowledge base, and YouTube for the videos in our Journal
• Nivoda: our diamond and gemstone supplier, which receives the order reference needed to source and send us your stone
• Royal Mail: delivery
• Trustpilot: your name, email address and order number, to send you a review invitation after delivery

Meta Platforms is not one of these suppliers. Where your cookie choices allow advertising, the Meta Pixel sends Meta information about your visit (see "Cookies"). In the UK and the EEA, Meta and we are jointly responsible for collecting that information and sending it to Meta; what Meta does with it afterwards is Meta's own responsibility, under the Meta Privacy Policy.

We also share information when the law requires it, to prevent fraud, or if the business is sold.

Where Your Information Is Held

Our systems run on Amazon Web Services in the United States (Northern Virginia), and several of the suppliers above are also based in the United States. Where information leaves the UK we rely on the UK's International Data Transfer Addendum to the European Commission's standard contractual clauses, or on an adequacy decision where one applies. You can ask us for details of the safeguards for any particular supplier.

How Long We Keep It

• Orders and invoices: 7 years after the order, because UK tax law requires it
• Account details: while your account is open, and 2 years after you last use it
• Rewards points and their history: while your account is open. They're deleted with your account, and they're in the copy of your information you can download from it
• Call recordings: 12 months. Call transcripts, summaries and support cases: 3 years
• Chat conversations: 12 months. Photos sent in the chat: 30 days. Codes for checking an order in the chat: 1 day
• Returns: kept with the order they belong to, including any photos you sent of a fault. Those photos are deleted if you delete your account; the 30 days above is only for photos sent in the chat
• Marketing subscriptions: until you unsubscribe. We then keep your email address on a short suppression list so we do not email you again by accident
• Analytics events: 26 months
• Server logs of each request: 180 days
• Records of consent: 6 years, because we may need to show that you gave it

Your Rights

You can ask us to give you a copy of your information, correct it, delete it, restrict or object to what we do with it, or send it to someone else. Where we rely on consent you can withdraw it at any time, and withdrawing it does not affect what we did beforehand.

The quickest route for account holders is the account page, where you can export your data or delete your account yourself. Otherwise email concierge@loveandcarat.com and we will reply within one month.

Some information we cannot delete on request: invoices we must keep for tax, and records of an unsubscribe request.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA. We would rather you told us first so we can put it right.

Children

Our shop is for adults. We do not knowingly collect information about anyone under 16, and we will delete it if we find we have.

Changes

If we change this notice we will update the date at the top. If a change matters to you, for example a new use of your information, we will tell you.