Privacy Policy

Who we are

Crestonne is a gemstone business based in Ratnapura, Sri Lanka. We sell natural Ceylon sapphires and spinels as loose stones.

Personal data is any information that identifies you, or could identify you. We decide how and why your personal data is used, so we are responsible for it. Privacy law calls this the "controller".

For any question about privacy, or to use your rights, contact us:

• Email: hello@crestonne.com
• WhatsApp: +94 70 150 3302
• Address: Crestonne, Ratnapura, Sri Lanka

Sri Lanka's Personal Data Protection Act (Act Number 9 of 2022) applies to us. Its main duties for businesses start on 1 January 2027.

If you live in the European Union or the United Kingdom, European data protection law may also apply to us. In the European Union this is the General Data Protection Regulation. The United Kingdom has its own version of it. Where it applies, it gives you the rights set out in this policy.

This policy covers our website, our emails and our WhatsApp conversations. Our Terms and Conditions and Return Policy explain how we sell stones.

Information you give us

The contact form

On our contact page you give us your name, email address, phone or WhatsApp number, and your message. We save them in our customer records and reply to you personally. No automatic email is sent.

Reserving a stone

When you use "Reserve This Stone" on a stone page, you give us your name and email address. You may also add your WhatsApp number and a message. We record which stone you asked about as a draft order in our records.

Your browser also saves your name, email address and WhatsApp number on your own device, so the form is filled in for you next time. This copy stays on your device until you clear your browser's data for our site.

Custom order briefs

When you send a custom order brief, you give us your name, email address and WhatsApp number. You also describe the stone you want: type, colour, carat weight, shape, budget, treatment, timeline and any notes. We save the brief in our customer records. We email you a confirmation that repeats your answers, with a copy to our founder.

We also add your name and email address to our mailing list, so that we can tell you about new stones. You can ask us to remove you at any time.

The newsletter

The sign-up form near the end of many pages asks for your name and email address. We add you to our mailing list and to our customer records, with new-stone alerts switched on. Then we send you a welcome email. We write rarely: usually no more than once or twice a month.

Certificate requests

Some stone pages let you ask to see the stone's laboratory report. You give us your email address, and we email you a personal link that unlocks the report. We send a copy of this email to our founder. Your browser also saves your email address on your device, to fill in our forms next time.

When the link is opened, we record the approximate city and country it was opened from. We also record the internet protocol (IP) address. This is the number that identifies an internet connection.

Your email address also goes into our customer records. We may send you emails about new stones, each with an unsubscribe link.

WhatsApp and email

If you message our WhatsApp business number, your messages reach our customer records through Zernio, a WhatsApp Business messaging service. We receive your message text, your name as it appears on WhatsApp, and your phone number.

If you email us, we keep the emails we exchange with you.

Records we create

As we deal with you, we add to your records:

• a customer record with your contact details
• the history of your enquiries and of our replies
• notes written by our staff
• the stones you are looking for (your stone preferences)
• deals and orders: the stone, and the price we quoted and agreed
• payment records: the amount, the payment method and the date

When you buy a stone, we also collect your delivery address. We need it, with your name, for the export and shipping paperwork.

Before we dispatch a stone, we may ask you to confirm your identity and delivery address, to prevent fraud. We keep this with our sales records.

Information collected automatically

When you visit our site, the tools below collect some data automatically. Google Analytics and PostHog use cookies. They run when you visit, unless you turn them off: press "Cookie settings" at the bottom of any page, then "Decline". The section on cookies explains more.

• Hosting: Vercel hosts our site. It processes every request your browser makes, including your IP address. It records each request in its server logs (records of every visit to the site). Some log entries can also contain an email address, for example when we send a welcome email.
• Google Analytics: this Google service uses cookies to count visits. It records the pages you view, your device and browser, and your approximate location. Google Analytics 4 does not store your IP address; Google uses it only to work out your approximate location.
• PostHog: a service that shows us how visitors use our site. It uses a cookie and browser storage (small pieces of information kept in your browser) to recognise your browser. It records the pages you view and where you click. It makes heatmaps (maps of where visitors click and scroll) and session recordings (a replay of a visit). It also collects console and performance data (technical messages and loading times from your browser). It keeps your IP address and the approximate location that address shows. Session recordings hide the text you type into forms, and are kept for 30 days. When you subscribe to the newsletter or send a custom order brief, PostHog links your activity to your name and email address.
• Vercel Web Analytics and Vercel Speed Insights: these count visits and measure how fast our pages load. They use no cookies and give us totals only, not profiles of individual visitors.

How we use your data

For each purpose below we name the legal basis: the reason the law allows that use. A "legitimate interest" is a genuine business reason that we have weighed against your rights and interests. Where we rely on one, you have the right to object.

• To reply to enquiries, handle reservation requests, find stones for a custom order brief, sell and deliver a stone, and handle returns. Legal basis: steps you ask for before a contract, and carrying out our contract with you.
• To prepare export, shipping, insurance and return paperwork, and to keep sales, tax and accounting records. Legal basis: our legal obligations, and our contract with you.
• To keep your customer record and enquiry history, so that we can answer later questions about a stone. Legal basis: our legitimate interest in running our business.
• To email you the personal link to a laboratory report, and to know when it was opened. Legal basis: steps you ask for before a contract, and our legitimate interest in knowing the link was used.
• To send the welcome email and new-stone alerts. Legal basis: your consent, when you join the newsletter. If you sent a custom order brief or asked for a laboratory report: our legitimate interest in telling you about similar stones. You can say no at any time.
• To understand how visitors use our site, find faults and improve it. With Google Analytics and PostHog, the legal basis is our legitimate interest in understanding how our site is used. You can object at any time with "Cookie settings" at the bottom of any page, and they stop. Vercel Web Analytics and Speed Insights use no cookies and show us totals only; for them the legal basis is our legitimate interest in running a site that works well.
• To link your visits to your name and email address, so that we can see which stones interest you and answer you better. This happens in PostHog, unless you pressed "Decline" in "Cookie settings". Legal basis: our legitimate interest in answering your enquiries well. You can object at any time with "Cookie settings" at the bottom of any page.
• To remember your cookie choice (crestonne_consent) and, after you send a reservation or certificate request, the contact details you typed (crestonne_contact). Both stay on your own device and are never sent to us by themselves. Legal basis: our legitimate interest in not asking you again and in filling in our forms for you. You can delete them in your browser settings.
• To read WhatsApp conversations into our records with the artificial intelligence tool described below. Legal basis: our legitimate interest in keeping accurate records of enquiries.
• To keep our site and records secure, prevent fraud and abuse of our forms, and make or defend legal claims. Legal basis: our legitimate interests, and our legal obligations.

Giving us your data is your choice. But we cannot reply to you without an email address or phone number. Sri Lanka's official export process requires your name and delivery address on the export paperwork, so we cannot ship a stone without them.

Marketing emails

We send two kinds of marketing email: a welcome email when you join the newsletter, and new-stone alerts. You may receive them if you joined the newsletter, sent a custom order brief, or asked for a laboratory report.

Every marketing email has an unsubscribe link, and it works at once. You can also reply to any of our emails, or message us on WhatsApp, and ask us to stop. We act on such a request within 10 business days at the latest. Once you unsubscribe, we send you no more marketing emails.

Emails about an enquiry or order you started are not marketing, so they continue.

The artificial intelligence tool

Inside our private staff system, staff can paste a WhatsApp conversation, or screenshots of one, into a tool that helps them log enquiries. The tool sends it to Claude, an artificial intelligence service run by Anthropic. Claude reads the conversation and suggests an enquiry record: your name, your contact details, the messages written out as text, and a short summary. We do not save the screenshots themselves.

A member of staff checks the suggested record, and corrects it if needed, before it is saved. The tool decides nothing about you. We make no decisions about you by automated means alone that have legal or similarly significant effects on you.

Who we share data with

We never sell your personal data. We do not share it with other companies for their own advertising.

We share data with the service providers that help us run our business:

• Vercel: hosts our website, its server logs and our visitor statistics, on servers in the United States
• Neon: our database of customer records, on Amazon Web Services servers in the United States
• Resend: sends our emails and holds our mailing list
• Google Workspace: our email inbox
• Google: provides Google Analytics
• PostHog: shows us how visitors use our site, on servers in the United States
• Zernio: brings messages sent to our WhatsApp number into our records
• WhatsApp, run by Meta: when you message us on WhatsApp, under WhatsApp's own terms
• Anthropic: the artificial intelligence tool described above

We also share data when a sale needs it, or when the law requires it:

• couriers and insurers, to deliver and insure your stone
• the National Gem and Jewellery Authority and Sri Lanka Customs, for the official export and return paperwork
• banks, to receive payments and send refunds
• professional advisers, such as lawyers and accountants
• courts, the police and other authorities, where the law requires it

International transfers

We are based in Sri Lanka, and most of our service providers store your data in the United States. Privacy laws in both countries may differ from those where you live.

For these transfers we rely on the safeguards our providers offer. One is the standard contractual clauses approved by the European Commission. These are contract terms that protect data sent outside the European Union. Another is the Data Privacy Framework between the European Union and the United States. United States companies that join it promise to protect data from Europe. We rely on it only where a provider has joined. For data from the United Kingdom, we rely on the United Kingdom's versions of these safeguards.

Ask us which safeguard applies to a particular provider.

How long we keep data

We keep personal data only as long as we need it:

• Enquiry and customer records: while we are in touch, and for a reasonable time afterwards, to answer follow-up questions about a stone.
• Records of when a certificate link was opened: as long as we keep your request for that report.
• Sales records: as long as tax, accounting and export law requires.
• Mailing list: our email service keeps your name and email address on our list until you ask us to remove them. When you unsubscribe, we switch off new-stone emails for you at once. We keep that note so that we do not write to you again.
• PostHog session recordings: 30 days.
• Analytics data and server logs: according to each provider's retention settings.

You can ask us to delete your data sooner. We then delete it, or remove the details that identify you, from our records, our mailing list and our analytics tools. We keep only what the law requires, such as sales records, or what we need to make or defend a legal claim. If we keep anything, we tell you what and why.

Cookies and similar technologies

A cookie is a small file that a website stores in your browser. Browser storage works in a similar way: it keeps small pieces of information on your device. Our site uses the following:

Google explains its use of this data in How Google uses information from sites or apps that use our services.

Your choices about cookies

You can change your mind at any time:

• Press "Cookie settings" at the bottom of any page, then "Accept" or "Decline". If you decline, Google Analytics and PostHog stop at once, and we delete their cookies and PostHog's stored data. (PostHog keeps a small note that you declined; see the table.) Data they collected before you declined stays with them until its retention period ends, unless you ask us to delete it.
• Use your browser settings to block cookies, or to delete cookies and site data for crestonne.com.
• Install the Google Analytics opt-out browser add-on to stop Google Analytics on every website you visit.
• Ask us to delete the PostHog data linked to your email address.

Do Not Track signals

Our site does not currently respond to the "Do Not Track" signal that some browsers send. Third parties, such as Google, may collect information about your online activities across different websites over time.

Your rights

Depending on the law where you live, you have these rights over your personal data:

• Access: ask for a copy of the data we hold about you.
• Correction: ask us to correct data that is wrong or incomplete.
• Deletion: ask us to delete your data.
• Restriction: ask us to limit how we use your data, for example while we check a complaint.
• Objection: object to any use of your data that is based on our legitimate interests. You can object to marketing at any time, and we will stop.
• Portability: ask for the data you gave us in a common electronic format, or for us to send it to another organisation where possible.
• Withdrawing consent: where we rely on your consent, withdraw it at any time. This does not affect what we did before.

How to use your rights

Email hello@crestonne.com, or message us on WhatsApp at +94 70 150 3302. Tell us which right you want to use. There is no charge.

We reply within one month. If your request is complex, or one of several, we may need up to two more months. If so, we tell you within the first month and explain why.

To protect your data, we may ask you to confirm who you are before we act. For example, we may ask you to write from the email address we hold for you. If we cannot do what you ask, we tell you why.

Making a complaint

If you are unhappy with how we handle your data, tell us and we will try to put it right. You can also complain to a data protection authority at any time:

• in Sri Lanka, the Data Protection Authority of Sri Lanka
• in the European Union, the data protection authority of your country (see the list of European Union data protection authorities)
• in the United Kingdom, the Information Commissioner's Office
• anywhere else, the data protection authority in the country where you live or work

Data about children

Our site and our stones are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Keeping data safe

How we protect your data:

• Our site uses encrypted connections, so data you send is protected on its way to us.
• Only our staff, each with their own account, can open our customer records.
• We never take card details on our site, and we hold no card numbers.

No system is completely secure, so we cannot promise that data will never be lost or misused. If a security breach puts your rights at risk, we will tell you and the authorities where the law requires.

Changes to this policy

We may update this policy when our business, our tools or the law changes. When we do, we change the "last updated" date at the top of this page. This version is in force from 14 October 2026.