Trust & privacy

• Customer accounts are authenticated through a managed identity provider, with signed sessions and automatic expiry.
• Passwords are never stored in plain text — they're handled by the auth provider with standard hashing.
• Each customer can only view and modify their own orders, addresses and personal data.

• Payments are processed by Stripe within their PCI-DSS environment. Tanto Beauty never stores your full card number or CVC.
• Checkout is served over HTTPS/TLS and embedded directly from Stripe.
• Refunds and disputes are handled through the same payment provider.

• Order: name, shipping and billing address, email and phone — needed to prepare and deliver your order.
• Account: email and, optionally, skin preferences so we can recommend better.
• Communications: transactional emails (confirmation, shipping) and, if you subscribe, news. Every email has an unsubscribe link.

We use a small number of providers to run the shop:

• Hosting & database: managed infrastructure in the EU with encryption in transit and at rest.
• Payments: Stripe.
• Transactional email: managed sending provider on the domain notify.tantobeauty.com.
• Logistics: the carrier needed to deliver each order.

We use strictly necessary cookies for the cart and session. Any analytics or measurement cookies are described in the site's cookie notice and can be rejected.

• We keep order data for as long as required by applicable tax and accounting law.
• You can request access, rectification, erasure, portability or objection by emailing hola@tantobeauty.com.
• If you subscribed to marketing communications you can unsubscribe at any time via the link in every email.

If you think you've found a vulnerability or a security incident affecting Tanto Beauty, email seguridad@tantobeauty.com with the details. We'll reply as soon as possible and ask that you don't disclose the finding until we've had a chance to review it.

Questions about privacy or your data? Email hola@tantobeauty.com.