VividCarat Authority
in Gems
US Office +1(602)610-1709
Sri Lanka +94 74 078 8548
Messengers
WhatsApp @russellsrare
E-mail [email protected]
Phoenix Office 2415 E Camelback Rd, Suite 700, Phoenix, AZ 85016
Vivid Weekly 5 →
0 Vivid Weekly 5 →
Main Journal Customer service Privacy Policy

Customer Service

Privacy Policy

Last updated: 2026 6 min read Applies to all VividCarat orders worldwide
Minimal Data
Only what's needed to source your stone
Never Sold
Your data is not shared with marketers
One-Email Opt-Out
Delete your data by sending a single request
Transparent Retention
24 months for leads, 7 years for buyers

VividCarat Privacy Policy

Last updated: April 2026

At VividCarat, we source loose colored gemstones directly from the cutting floors of China Fort Market in Beruwala, Sri Lanka. Because we operate a concierge sourcing model — not a mass-market e-commerce shop — every person who contacts us is a real buyer with specific requirements. We treat your personal information with the same care we apply to the stones we photograph for you: carefully, transparently, and with a clear understanding that trust is the only currency that matters in this business.

This policy explains exactly what we collect, why we collect it, and the hard limits we place on ourselves regarding how it's used.

1. What We Collect

We collect only the minimum information required to respond to your inquiry and complete a sourcing request:

  • Contact details: your name, email address, and phone number (including WhatsApp or Telegram handle if you choose to share it).
  • Stone preferences: the gemstone type, carat range, color target, budget ceiling, certification requirements, and any other sourcing parameters you submit through our contact forms, WhatsApp, or email.
  • Order information: shipping address, billing details, and identification documents required by international couriers (FedEx, DHL) for customs clearance on high-value shipments.
  • Technical data: basic analytics such as page views and referral source, collected through standard tools (Google Analytics) to understand which content our buyers find useful. This data is aggregated and not tied to your name.

We do not collect sensitive categories of personal data — no government ID numbers beyond what customs legally requires, no financial account data (payments are processed by licensed providers, see below), and no health or biometric information.

2. How We Use Your Data

Your information is used strictly for purposes directly connected to the service you requested:

  • Responding to sourcing requests. When you describe the stone you're looking for, we use your contact details to send you photographs, videos, lab certificates, and pricing for matching stones we locate at the market.
  • Order fulfillment. Processing your deposit, arranging lab certification (GIA, AIGS, GRS), preparing export documentation with the Sri Lankan National Gem & Jewellery Authority (NGJA), and coordinating international shipping.
  • Relevant follow-up. If you asked about a specific stone type — say, unheated Ceylon blue sapphires — we may contact you when a particularly strong example comes through the market. You can stop these messages at any time with a single reply.
  • Legal and tax compliance. Sri Lanka requires gem exporters to maintain transaction records. Your purchase data is preserved for the statutory retention period for this reason only.

We do not use your data for automated profiling, behavioral advertising retargeting outside of standard Google Ads conversion tracking, or any form of algorithmic decision-making that affects pricing.

3. What We Will Never Do

This section is deliberately short, because the list of things we refuse to do is short and absolute:

  • We do not sell your data. Not to marketing lists, not to data brokers, not to "gemstone industry partners," not to anyone. This is a permanent commitment, not a current policy subject to change at our convenience.
  • We do not share your data with third parties, with two narrow and unavoidable exceptions:
    • Shipping carriers (FedEx, DHL, EMS) receive your name, address, and phone number — they cannot deliver a package otherwise.
    • Payment processors (wire transfer banks, Wise, Stripe for card payments) receive the information required to process your payment. These providers operate under their own regulated privacy frameworks.
  • We do not use your photos or videos publicly without explicit written permission. If you send us a reference image of a stone you like, it stays between us.

4. How Long We Keep Your Data

  • Inquiry / lead data (where no purchase was made): retained for 24 months from your last contact, after which it is permanently deleted. This window exists because gemstone buyers often take 6–18 months between first inquiry and final purchase — a stone worth several thousand dollars is not an impulse decision.
  • Customer / buyer data (completed transactions): retained for 7 years, as required by Sri Lankan tax law and international export record-keeping regulations. After this period, personally identifiable information is anonymized or deleted.
  • Email marketing subscribers: retained until you unsubscribe. Every email includes a one-click unsubscribe link.

5. Your Rights and How to Exercise Them

You have the right to:

  • Access a copy of the personal data we hold about you.
  • Correct any information that is inaccurate or outdated.
  • Delete your data at any time (subject to the tax-law retention requirement for completed purchases).
  • Object to specific uses of your data, including any future marketing contact.
  • Withdraw consent at any time without needing to explain why.

To delete your data: send an email to [email protected] with the subject line "DELETE MY DATA". We will confirm the deletion within 7 business days. No follow-up questions, no retention tactics, no forms to fill out.

6. Security

Your data is stored on encrypted servers with access restricted to the single person who runs VividCarat's sourcing operation. We do not operate a large customer service team, which means your information is not exposed to contractors, outsourced support agents, or third-party CRMs processing data at scale. Payment information is never stored on our servers — it is handled entirely by licensed payment providers.

7. International Data Transfers

VividCarat operates from Sri Lanka and serves buyers primarily in the United States, United Kingdom, Australia, and Canada. By submitting your information, you understand that it will be processed in Sri Lanka and transmitted to relevant service providers in your country for the purpose of shipping and payment. All transfers are made under standard contractual safeguards.

8. Changes to This Policy

If we update this policy, the "Last updated" date at the top will change, and material changes will be communicated by email to customers on file. We will never apply weakened privacy terms retroactively to data collected under a stronger prior version of this policy.

9. Contact

For any privacy-related question, request, or complaint:

Email: [email protected] Phone: +1 (602) 610-1709 WhatsApp: +94 74 078 8548 Address: 2415 E Camelback Rd, Suite 700, Phoenix, AZ 85016 (US correspondence) Sourcing location: China Fort Market, Beruwala, Sri Lanka

10. Additional Rights for EU, UK, and EEA Residents (GDPR / UK GDPR)

If you are located in the European Union, the United Kingdom, the European Economic Area, or Switzerland, you are entitled to a specific set of rights under the General Data Protection Regulation (GDPR) and the UK GDPR. VividCarat respects these rights in full, regardless of the fact that we operate from Sri Lanka.

10.1 Legal Basis for Processing

We only process your personal data when we have a clear lawful basis to do so. Depending on the situation, we rely on one of the following:

  • Consent — when you voluntarily submit your details through our contact form, subscribe to our email list, or initiate a WhatsApp/Telegram conversation. You may withdraw this consent at any time.
  • Performance of a contract — when you place a sourcing deposit or purchase a stone, processing your data is necessary to fulfill the agreement between us (photographing stones, arranging certification, shipping, invoicing).
  • Legal obligation — retaining transaction records for 7 years is required by Sri Lankan tax law and international gem export regulations.
  • Legitimate interests — sending occasional follow-up about stones matching your stated preferences, or preventing fraud. These interests are carefully balanced against your privacy rights, and you may object at any time.

10.2 Your Rights Under GDPR / UK GDPR

In addition to the rights listed in Section 5, EU and UK residents specifically have the right to:

  • Right of access (Article 15): request a copy of all personal data we hold about you, in a readable format, free of charge.
  • Right to rectification (Article 16): have inaccurate or incomplete data corrected without undue delay.
  • Right to erasure / "right to be forgotten" (Article 17): request complete deletion of your data, subject only to the statutory tax-retention requirement for completed purchases.
  • Right to restriction of processing (Article 18): require us to pause processing your data while a dispute or correction request is being resolved.
  • Right to data portability (Article 20): receive your data in a structured, machine-readable format (CSV or JSON) and have it transmitted to another provider if technically feasible.
  • Right to object (Article 21): object to processing based on legitimate interests, including any form of direct marketing. Marketing-related objections are honored immediately and unconditionally.
  • Right not to be subject to automated decision-making (Article 22): we do not make pricing, sourcing, or eligibility decisions using automated algorithms. Every quote you receive is prepared manually.
  • Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Response time: we will respond to any rights request within 30 calendar days of receipt, as required by GDPR Article 12(3). Requests are handled directly by Russell — not by an outsourced ticket queue.

10.3 International Data Transfers Outside the EEA / UK

Because VividCarat operates from Sri Lanka, your personal data will be transferred outside the EEA and the UK when you contact us. Sri Lanka has not received an adequacy decision from the European Commission or the UK Information Commissioner's Office. We rely on the following safeguards to ensure your data remains protected to an equivalent standard:

  • Standard Contractual Clauses (SCCs) with our key service providers (email hosting, payment processors, shipping carriers) that process EU/UK personal data on our behalf.
  • Encryption in transit and at rest for all communications and stored records.
  • Data minimization — we collect only what is strictly required, reducing exposure regardless of jurisdiction.
  • Access control — your data is accessible only to Russell personally, not to employees, contractors, or third-party platforms.

You may request a copy of the specific safeguards applied to your data by emailing [email protected].

10.4 Right to Lodge a Complaint with a Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority in your country of residence. We would strongly prefer you contact us first so we can resolve the issue directly — but this is your right, and we will never discourage you from exercising it.

  • United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
  • Ireland: Data Protection Commission (DPC) — dataprotection.ie
  • Germany: Bundesbeauftragte für den Datenschutz (BfDI) — bfdi.bund.de
  • France: Commission Nationale de l'Informatique et des Libertés (CNIL) — cnil.fr
  • Other EU member states: a full list of national supervisory authorities is available at edpb.europa.eu

10.5 Cookies and Tracking (ePrivacy / PECR)

For EU and UK visitors, we comply with the ePrivacy Directive and the UK Privacy and Electronic Communications Regulations (PECR). Non-essential cookies (analytics, advertising pixels) are only set after you provide explicit consent through our cookie banner. You can withdraw or modify your cookie preferences at any time by clicking the "Cookie Settings" link in the site footer. Strictly necessary cookies (session, security, language preference) are exempt from consent requirements because the site cannot function without them.

10.6 Data Protection Contact

As a small business, VividCarat is not legally required to appoint a Data Protection Officer. However, all data protection matters are handled personally by the business owner, which in practice means your request goes directly to the person responsible — not to a generic inbox.

Data protection contact: Russell, VividCarat Email: [email protected] Subject line for GDPR requests: "GDPR REQUEST" (helps us prioritize and respond within the 30-day window)

— Russell, VividCarat