Privacy Policy
How Carat & Clay collects, uses, and protects your personal information when you shop with us.
Last Updated: 4 September 2026
This privacy policy ("Privacy Policy") explains how Carat & Clay ("Carat & Clay", "we", "our" or "us") collects, uses, shares and stores information about you ("User", "you"), including in the following situations:
When you browse or visit our website (the "Website")
When you search our diamond, ring setting and jewelry catalogs, or save items to a wishlist or cart
When you create an account and place an order
When you request a custom setting, a CAD or 3D design, or ask us to source a specific diamond
When we invite you to review a product or your experience with us
When you contact our concierge team for support, by form, email, phone or chat
When you sign up for our emails or text messages
When we handle the personal data of our suppliers and service providers
When you interact with us on our social media profiles
We respect your privacy and work to keep our practices at a high standard. Please read this Privacy Policy carefully so you understand how we handle personal data. "Personal Data" or "Personal Information" means any information that can be used, alone or with other data, to identify a living person.
Important note: nothing in this Privacy Policy is meant to limit any statutory right you have, including your rights to a remedy or a means of enforcement.
We may update this Privacy Policy from time to time, so please check back for the latest version. If we make a significant change to how we use your Personal Data, we will post a notice on the Website or tell you by other means.
1. What We Collect, Why We Collect It, And How Long We Keep It
The table below sets out what we collect in each situation, why we collect it, our legal basis under the GDPR where it applies, how long we keep it, and what happens if you choose not to give it to us.
Situation | Personal Data we collect | Why we collect it | Legal basis (GDPR only) | How long we keep it | If you do not provide it |
|---|---|---|---|---|---|
When you browse or interact with our Website | Data from cookies, pixels and log files, such as IP address, device and browser type, referring pages, and the pages and diamonds you view | To run and secure the Website, measure how it is used, analyze trends, and show you relevant content and advertising on our site and on third-party sites | Consent; legitimate interest for essential cookies | Depends on the cookie. Essential cookies cannot be switched off. You can control or delete cookies in your browser settings and opt out of Google Analytics. | Parts of the Website may not work, and we cannot tailor content or offers to your interests |
When you create an account and place an order | Full name, email address, password, phone number, shipping and billing address, order and invoice details, ring size and engraving text, and payment details processed by our payment provider | To create your account, take and fulfill your order, arrange insured delivery, issue invoices and grading paperwork, handle returns and warranty claims, and ask you for a review afterwards | Performance of a contract to which you are a party, or steps taken at your request before entering a contract; legitimate interest | Until we no longer need it and delete it, or you send a valid deletion request. Order, tax and accounting records are kept for the period the law requires. | We cannot open your account, take your order, ship your item, or support it afterwards |
When you request a custom setting, a CAD or 3D design, or ask us to source a diamond | Full name, email address, phone number, your design brief and budget, reference images or links you upload, and anything else you choose to send us | To answer your request, prepare a quote, and produce your CAD, 3D render or sourcing options | Performance of a contract, or steps taken at your request before entering a contract; legitimate interest | Until we no longer need it and delete it, or you send a valid deletion request | We cannot answer the request or prepare a design for you |
When you save items to a cart or wishlist | The items you saved, your email address or phone number if you gave one, and the time and device used | To keep your cart and wishlist available across visits and devices, and to send you a reminder if you leave an order unfinished | Consent for reminder messages; legitimate interest for keeping your cart | Until the cart or wishlist is cleared, your account is deleted, or you unsubscribe from reminders | Your saved items may not follow you between visits, and we cannot send you a reminder |
When we ask you for a review | Email address, your name or initials, your photos, and what you tell us about your experience | To publish and analyze your review, and to share your photo on our website and social channels. Leaving a review is voluntary. | Consent; legitimate interest | Until we no longer need it and delete it, or you send a valid deletion request | We cannot publish your review or share your photo |
When you contact us for support | Full name, email address, phone number, order number, and anything else you choose to send us | To answer your question, provide support, and review your experience with us | Performance of a contract, or steps taken at your request before entering a contract; legitimate interest | Until we no longer need it and delete it, or you send a valid deletion request | We cannot answer you or provide support |
When you sign up for emails or text messages | Email address, phone number, contact preferences, and your engagement with our messages | To send you offers, new arrivals and product news you asked for | Consent | Until you unsubscribe. We keep a record of your opt-in for as long as we need it to show we followed the law. | We cannot send you offers or news |
When you interact with us on social media | Your profile name, email address, and anything else you choose to send us | To reply to your message, question or comment | Consent, legitimate interest, or pre-contract discussions, depending on the context | Until you ask us to delete it, or we decide to delete it | We cannot reply to you |
Some of the data above is also used to detect and prevent fraud and other illegal activity, to find and fix errors, to run audits, and to keep our systems secure. We may also use Personal Data to comply with the law, to co-operate with investigations by the relevant authorities, and to bring or defend legal claims. In some cases we anonymise or de-identify data and continue to use it in that form.
We, including our Website, collect information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device. In particular, we and our agents have collected the categories of Personal Information listed in the table above from consumers within the last twelve (12) months.
2. Where We Collect Information From
We collect Personal Data from three kinds of source:
Directly from you — for example, from forms you fill in, an account you open, or an order you place
Indirectly from you — for example, from observing how you use the Website through cookies and log files
From third parties — for example, our payment, delivery, fraud-prevention and advertising partners, and data available in the public domain
3. How We Protect And Store Your Information
3.1. Security. We use appropriate technical, organisational and physical measures designed to protect your Personal Data, including encryption of payment information in transit. Even so, we cannot guarantee that information will never be compromised by unauthorised access to our systems. Security also depends on the device, network and passwords you use, so please take care to protect them.
3.2. Retention. Beyond the periods in the table above, we may keep Personal Data for longer where (i) tax, accounting, legal or regulatory rules require it, (ii) we need an accurate record of our dealings with you in case of a complaint or dispute, or (iii) we reasonably believe litigation is likely. We follow an internal retention policy so that data is not kept indefinitely.
3.3. International transfers. We and our service providers may store and process your Personal Data in countries other than your own. Where we transfer Personal Data out of the European Economic Area or the United Kingdom, we rely on an adequacy decision or on standard contractual clauses. You may ask us for details of the basis used, though transfer agreements may be partly redacted for commercial confidentiality.
4. How We Share Your Personal Data
We share your information in the following ways:
Affiliates: with our affiliates and subsidiaries, for business, operational, promotional and marketing purposes
Service providers: with third parties that provide business, technical or professional support to us, including fulfilling and shipping your order, taking payment, providing customer support, hosting the Website, and running our marketing
Legal matters and safety: with regulators, law enforcement and other authorities, where the law requires it or a court orders it, and to protect the security of our site, systems and databases, including for fraud prevention, or where we believe our terms or a third party's rights have been breached
Sale or transfer of business: with an actual or potential buyer if we sell or transfer all or part of our business or assets, and in a merger, acquisition, bankruptcy or comparable event
With your consent: where you have agreed to the sharing, such as marketing consents or optional services
Aggregated or anonymous data: we may share aggregated, anonymous or de-identified data with third parties for their own analytics or marketing use
Categories Of Recipients
We share Personal Information with the following categories of recipients, for the purposes described:
Recipient category | Examples | Data shared | Purpose |
|---|---|---|---|
Payment processors | Stripe and other card processors, and financing providers offered at checkout | Payment and billing information, order total | To take payment and process refunds. We do not store full card numbers on our own systems. |
Delivery and fulfillment partners | Shipping carriers such as FedEx and UPS, logistics providers, shipment insurers | Name, shipping address, phone number, order details | To deliver and insure your order |
Diamond suppliers and grading laboratories | Sourcing partners, setters, engravers, and grading labs such as GIA and IGI | Order and item details, ring size, engraving text, certificate numbers | To source, make, certify and finish your piece |
Email and messaging platforms | Our email delivery and SMS providers | Name, email address, phone number, order and cart activity, engagement data | To send order updates and, where you opted in, marketing and cart reminders |
Advertising and analytics partners | Google, Google Analytics, Meta (Facebook) | Device and browser data, hashed contact details, browsing and purchase activity | To measure and deliver advertising, including retargeting. This may count as a sale or share under some state laws. |
Fraud prevention and security vendors | Fraud detection and identity verification services | Order, device and contact data | To detect and prevent fraudulent transactions |
Hosting and IT providers | Cloud hosting, storage, error monitoring and support tooling | Account, order and technical data | To run, host and maintain the Website and our systems |
Professional advisors | Accountants, auditors, legal counsel | As necessary | Legal, tax and compliance purposes |
Government and legal authorities | Regulators, law enforcement, courts | As required | To comply with the law or legal process, or to protect rights and safety |
Business transferees | A buyer or successor in a merger, sale or bankruptcy | All categories we hold | To complete a corporate transaction |
We require our service providers to use your Personal Information only to provide services on our behalf, and not for their own independent marketing, except as described above for advertising partners.
5. Cookies, Tracking Options, And Do Not Track
Cookies. Our Website uses cookies, anonymous identifiers and similar technologies to keep you signed in, remember your cart and wishlist, and show you content suited to you. A cookie is a small text file that records activity on the Website. Most browsers let you decide whether to accept cookies and how to remove them. You can block or delete cookies, but if you do, some features of the Website may not work.
Log files. We use log files. These record IP addresses, browser type, internet service provider, date and time stamps, referring and exit pages, and clicked pages. We use this to analyze trends, administer the Website, track movement around it, and gather demographic information.
Google Analytics. We use Google Analytics to understand how often people visit the Website, which pages they view, and where they came from. We use this to maintain and improve the Website and our products. Google's use of this data is governed by the Google Analytics Terms of Service and the Google Privacy Policy. You can stop Google Analytics from using your data with the Google Analytics Opt-out Browser Add-on.
Meta Pixel. We use the Meta (Facebook) Pixel to measure and target advertising. Meta and other third parties use cookies, web beacons and similar technologies to collect information from our Website and elsewhere online, and use it for measurement and ad targeting. You can exercise choice through the Digital Advertising Alliance or Your Online Choices.
Do Not Track. We do not currently respond to browser "do not track" signals. We do honor a recognized Global Privacy Control signal as an opt-out of sale or sharing, as described below. We may allow third parties, such as analytics providers, to collect information about your online activity over time and across different websites.
Other tools. We may add further analytics and advertising tools, and will update this Privacy Policy when we do.
6. Your Privacy Rights And Choices
6.1. Rights under the GDPR. If you are protected by the GDPR, the following rights apply, subject to exemptions in law:
The right to access the information we hold about you. Access is normally free, though we may charge a reasonable administrative fee where the law allows
The right to have inaccurate or misleading Personal Data corrected
The right to ask us to erase your Personal Data, though we may have to keep some of it, for example to bring or defend legal claims
The right to object to processing, or to ask us to restrict it
The right to data portability, meaning you can receive your Personal Data in a structured, commonly used, machine-readable format and send it to another controller
The right to object to profiling
The right to withdraw consent at any time. Withdrawing consent does not affect processing carried out before you withdrew it, and we may be entitled to keep processing where we have a legal obligation
The right to ask for details of the basis on which your Personal Data is transferred outside the European Economic Area
The right to complain to your local data protection authority at any time. We ask that you try to settle the matter with us first
6.2. Rights for California and other U.S. state residents. If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana or another state with a comprehensive consumer privacy law, you may have some or all of these rights, subject to exemptions:
Right to know or access what Personal Information we have collected about you, where it came from, and who we disclosed, sold or shared it with
Right to delete your Personal Information, subject to exceptions such as completing a transaction, meeting a legal duty, or preventing fraud
Right to correct inaccurate Personal Information
Right to opt out of the sale or sharing of your Personal Information, including for cross-context behavioural or targeted advertising
Right to opt out of profiling and automated decision-making, where it applies
Right to portability — to receive a copy of your Personal Information in a portable format
Right to non-discrimination — we will not deny you goods or services, charge you a different price, or give you a different level of service because you exercised a privacy right
6.3. How to make a request. To exercise any right above, email us at support@caratandclay.com. We will confirm we received your request within 10 business days and respond within 45 days. If we need more time, we may take up to another 45 days, for a maximum of 90 days in total, and will tell you why within the first 45 days. We may ask for more information to verify your identity before we act. We may charge a fee where the law allows, for example if a request is clearly unfounded or excessive. If a request would affect the rights of others, or if the law lets us handle it differently, we will meet it as far as we can.
6.4. Right to appeal. If we refuse your request, you may appeal by emailing support@caratandclay.com with the subject line "Privacy Rights Appeal". Please include your original request and why you think we should reconsider. We will respond to your appeal within 45 days.
6.5. Deleting your account. You can ask us to delete your account by emailing support@caratandclay.com. Once your account is deleted, the Personal Data linked to it is no longer reachable through the account. Anything you made public before deletion, such as a published review, may remain on our servers and visible to others.
6.6. Your other choices. Where you have consented to us processing your Personal Information, you may withdraw that consent at any time and stop further processing by contacting us as described in this Privacy Policy. Even if you opt out, we may still collect and use non-personal information about your activity on our Website, and use Personal Data for the legal purposes described above, such as fraud prevention and meeting our legal duties. We handle every request in line with applicable law, and we take steps to verify your identity first to protect your privacy.
6.7. Non-discrimination. If you exercise your privacy rights, we will not treat you differently for doing so. Some features of our Website, products and services will not work without your Personal Information, but unless the law permits it, we will not:
Deny you goods or services
Charge you a different price or rate for goods or services, including by withholding a discount or other benefit, or by imposing a penalty
Give you a different level or quality of goods or services
Suggest that you may receive a different price or rate, or a different level or quality of goods or services
7. Do Not Sell Or Share My Personal Information
We do not sell Personal Information for money. Like many businesses, we use third-party advertising and analytics tools, including the Meta Pixel, Google Ads and Google Analytics, that collect information about your activity on the Website so we can deliver and measure advertising, including retargeting. Some state privacy laws, including the California Consumer Privacy Act, may treat this as a "sale" or "sharing" of Personal Information, even though no money changes hands.
In the past twelve months we have shared these categories of Personal Information with advertising partners for that purpose: identifiers such as email address and device or browser identifiers, commercial information such as browsing and purchase activity, and internet or other electronic network activity information. We have not sold or shared any other category, and we do not sell or share the Personal Information of anyone we know to be under 16.
You can opt out at any time. To do so, you may:
Email support@caratandclay.com with "Opt-Out of Sale/Sharing" in the subject line; or
Turn on a recognized Global Privacy Control signal in your browser. We treat a detected signal as a valid opt-out for that browser and device.
Opt-out settings stored in browser cookies may not survive if you clear cookies, change browser, or use another device. You can also opt out of interest-based advertising generally through the Digital Advertising Alliance or the Network Advertising Initiative.
8. Email And SMS Marketing
We use third-party email and SMS platforms to send marketing messages, cart reminders, promotional offers and product news.
How you join. You can opt in by entering your email address or phone number in a sign-up form, a pop-up, or a checkout field. SMS sign-up needs an unchecked, affirmative opt-in. We do not pre-tick email or SMS marketing consent boxes.
What you are agreeing to. By opting in to SMS marketing, you authorize Carat & Clay and its messaging providers to send you recurring automated marketing texts, including cart reminders, at the number you gave us, using an automatic telephone dialling system or similar technology. Consent to marketing texts is not a condition of any purchase. Message and data rates may apply, and message frequency varies.
Cart reminders. If you leave items in your cart and have given us your email address or phone number, we may send you a reminder. You can opt out of these the same way as any other marketing message.
How to opt out. Reply STOP to any text to unsubscribe. You will get one confirmation message, and you can opt in again later. For email, click "unsubscribe" at the bottom of any marketing message. Opting out of marketing does not stop transactional messages about an order you placed.
Sharing with our providers. Your email address, phone number and related engagement and purchase data are shared with our email and SMS platforms only so they can run the program for us. We do not allow them to sell your information or market their own products to you, and we do not share your phone number with unrelated third parties for their own marketing.
Records of consent. We keep a record of your marketing opt-in, including the date, time and method, for as long as we need it to show we followed the law, even after you unsubscribe.
State-specific notice. Some states, including Florida and Oklahoma, have consumer text-messaging laws in addition to the federal Telephone Consumer Protection Act. We take steps designed to obtain consent in line with those laws where they apply.
9. Notice Of Financial Incentives
From time to time we may offer promotions, discounts or reward programs that could count as a "financial incentive" under privacy laws such as the California Consumer Privacy Act. Taking part is entirely voluntary, and you may withdraw at any time without affecting your ability to buy from us. The value of any incentive we offer is reasonably related to the value of the data you choose to share with us, based on your participation, your engagement with our messages, the purchases you make, and the overall benefit we get from running the program.
10. State-Specific Notices
Nevada Residents
Nevada law gives you the right to opt out of the sale of certain "covered information" for money. We do not currently sell covered information for money. If you would like to register a request in case our practices change, email support@caratandclay.com.
California "Shine The Light" Law
Under California Civil Code Section 1798.83, California residents may ask us once per calendar year for information about any Personal Information we disclosed to third parties for their own direct marketing purposes in the previous calendar year, and the categories disclosed. To make a request, email support@caratandclay.com with "Shine the Light Request" in the subject line, and include your full name, mailing address, and a statement that you are a California resident. We may ask for more information to verify your identity and residency.
11. Use By Children
We do not offer our products or services to children, and we do not knowingly collect Personal Data from anyone under the age of eighteen (18). If you are under eighteen, please do not give us Personal Data without a parent or guardian involved. For GDPR purposes, we do not intend to offer information society services directly to children. If we learn that we hold data provided in breach of privacy law, we will delete it. If you believe we hold such information, contact us at support@caratandclay.com.
12. Links To And Interaction With Third-Party Services
The Website lets you interact with third-party websites, applications and services that we do not own or control, such as payment providers, financing partners, review platforms and social networks (each a "Third Party Service"). We are not responsible for their privacy practices or their content. Third Party Services may collect Personal Information from you, so we encourage you to read the terms and privacy policy of each one you choose to use.
13. Changes To This Privacy Policy
We may update this Privacy Policy to reflect changes in our practices or for legal reasons. We will post the updated version on this page and change the "Last Updated" date at the top. Where the change is significant, we will give you notice on the Website or by other means.
14. How To Contact Us
If you have a question, concern or complaint about this Privacy Policy or how we handle your data, or if you want to exercise a right, please email us first at support@caratandclay.com.