Privacy Policy

Who are we?

At Home Glow ("we", "us") is an editorial website at athomeglow.co.uk operated from the United Kingdom. We are the data controller for any personal data you provide while using the site.

For questions about this policy, use the contact form or email hello@athomeglow.co.uk.

What data do we collect?

Visiting the site does not require an account, email signup or any personal details. The information we do collect is limited to:

• Anonymous traffic measurement (page views, referrer, country, device class) via Google Analytics 4, only after you accept analytics in the cookie banner.
• Tag-management state via Google Tag Manager - the loader runs on every page, but downstream tags (analytics, advertising) fire only with the matching consent.
• Server logs retained by Cloudflare for security and abuse prevention (IP, request URL, timestamp, user agent) under Cloudflare's own privacy policy.

If you use our contact form or email us, we receive your name, email address and message, and use them only in connection with your message. We do not run a mailing list, e-commerce store or user-account system, so we collect no payment data and no profile information.

How do we use cookies?

The site operates under Google Consent Mode v2. On your first visit you'll see a cookie banner where you can:

• Accept all (essential + analytics)
• Reject non-essential (essential only)
• Customize (toggle analytics on/off)

Denied is the default for analytics, advertising, ad personalisation and personalisation storage until you give consent. Functionality and security cookies are always granted (they are strictly necessary for the site to work).

You can change your choice at any time via the "Cookie preferences" link in the footer.

If your browser sends Do Not Track (DNT), we respect it and do not load analytics regardless of the banner state.

Which cookies and storage items does the site use?

Each item below names what it is, why it is there, who sets it and how long it lasts.

Strictly necessary (always on):

• csg_consent_v1 (browser local storage) - remembers your cookie banner choice so we do not ask again on every page. Set by At Home Glow. Kept until you change your choice or clear your browser data.
• Cloudflare security cookies, such as __cf_bm - may be set by Cloudflare, our host, to tell people from bots and block abusive traffic. Third party: Cloudflare. __cf_bm lasts 30 minutes.
• Cloudflare Turnstile - runs in a frame served from challenges.cloudflare.com, on the contact form only, to stop spam submissions. Third party: Cloudflare. Cloudflare states Turnstile sets no tracking cookies; any data it keeps in your browser is used only to complete the check, for that visit.

Functional (no personal data, kept in your own browser):

• r2-theme (local storage) - remembers light or dark mode if you switch it. Set by At Home Glow. Kept until you clear your browser data.
• r2-geo (session storage) - holds your two-letter country code, read from Cloudflare, so product pages show the right Amazon store's live price. Set by At Home Glow. Deleted when you close the tab.
• csg_compare_cta_v1 (local storage) - remembers that you closed the buy bar on a comparison page. Set by At Home Glow. Kept until you clear your browser data.

Analytics (only with your consent):

• _ga - a random ID that lets Google Analytics 4 count you as one visitor across pages and visits. Third party: Google. Lasts 2 years.
• _ga_<property ID> - keeps your session state for our Google Analytics 4 property. Third party: Google. Lasts 2 years.

Google Tag Manager itself sets no cookies; it only loads the tags above once you allow them. We set no advertising cookies. Amazon and other retailers set their own cookies on their own sites after you click through, not on athomeglow.co.uk.

How do affiliate links work?

Some outbound links to retailers are affiliate links - we may earn a commission when you click through and buy. The destination retailer may set cookies on their domain; we have no control over those. As an Amazon Associate we earn from qualifying purchases. See the affiliate disclosure for our editorial position on affiliate revenue.

We do not currently run programmatic display advertising on the site. If this changes, this policy will be updated and you'll be re-prompted for advertising consent.

How do we use your information?

Aggregate, anonymous traffic data is used solely to:

• Understand which guides are useful (and which need rewriting)
• Detect technical errors and broken pages
• Inform editorial priorities (which devices and skin/hair concerns are under-served)

We do not sell personal data, share it with brokers, or use it for any kind of advertising profile.

What is our lawful basis for each use?

UK GDPR requires us to name the legal ground for each way we use personal data:

• Analytics (Google Analytics 4) - consent (Article 6(1)(a)). Analytics runs only after you accept it in the cookie banner, and you can withdraw that consent at any time via the "Cookie preferences" link in the footer.
• Server and security logs (Cloudflare, Cloudflare Turnstile) - legitimate interests (Article 6(1)(f)). Our interest is keeping the site available and secure: blocking abusive traffic, DDoS attacks and spam submissions to the contact form.
• Replying to your message (contact form and email, delivered via Amazon SES) - legitimate interests (Article 6(1)(f)). Our interest is answering the enquiry you chose to send us and keeping a record of that correspondence; we use your details for nothing else.

Where we rely on legitimate interests, you have the right to object to that processing - contact us using the details below.

How long do we keep your data?

We keep each kind of data only as long as the purpose it was collected for needs:

• Analytics data (Google Analytics 4) (only collected with your consent) - Google keeps user-level and event-level analytics data for no more than 14 months, the longest a standard Google Analytics property allows, and then deletes it automatically. After that only aggregated reports remain, which do not identify you.
• Server logs (Cloudflare) - we do not store or export request logs ourselves. Cloudflare processes request details (IP address, request URL, timestamp, user agent) to deliver the site and protect it, including through Turnstile on the contact form. Any security data Cloudflare keeps on its own systems is kept only for as long as that security purpose and its legal obligations require, and then deleted or aggregated so that no individual can be identified, as its privacy policy sets out.
• Contact messages - the site itself stores no copy of what you send through the contact form. Amazon SES delivers your message to our email inbox, where we keep your name, email address and message only for as long as we need to reply to you and handle any follow-up correspondence, and then delete them, unless we need to keep them to establish or defend a legal claim. You can ask us to delete them sooner using the contact details at the end of this policy.
• Your cookie choice - stored in your own browser until you change it or clear your cookies.

Your rights under UK GDPR

You have the right to:

• Be informed about how your data is used (this page)
• Access any personal data we hold about you
• Have inaccurate data corrected
• Have data erased ("right to be forgotten")
• Restrict how we process your data
• Receive the data you gave us in a portable format, where processing is based on consent
• Withdraw consent at any time

Your right to object

You have the right to object, at any time, to our processing of your personal data where we rely on legitimate interests (Article 6(1)(f)): that is our server and security logs, and how we handle a message you send us. Tell us using the contact form or by emailing hello@athomeglow.co.uk, and we will stop that processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend a legal claim. We do not use your data for direct marketing.

Given we collect no directly identifying personal data, in practice most of these rights are satisfied by withdrawing analytics consent in the cookie banner.

How to complain about how we use your data

If you are unhappy with how we have handled your personal data, please complain to us first. Send your complaint through the contact form or by email to hello@athomeglow.co.uk, with "Data protection complaint" in the subject or message, and tell us what happened and what you would like us to do.

We will acknowledge your complaint within 30 days of receiving it, look into it without undue delay, and tell you the outcome without undue delay. If we need more information from you to investigate, we will ask, and we will keep you updated on our progress.

If you are not satisfied with our response, you can complain to the Information Commission, the UK data protection regulator (formerly the Information Commissioner's Office), at ico.org.uk.

Which third parties do we work with?

The site uses:

• Cloudflare - hosting, DNS and DDoS protection
• Google Analytics 4 - anonymous traffic measurement (with consent)
• Google Tag Manager - tag orchestration
• Google Search Console - indexability monitoring (server-side only, no user-side cookies)
• Amazon Associates - affiliate links to Amazon UK product listings; live price display uses Amazon's product data service
• Amazon Web Services (Amazon SES) - delivers messages sent through the contact form (AWS Europe (Ireland) region)
• Cloudflare Turnstile - bot protection on the contact form

Each third party has its own privacy policy linked from its respective site.

Is your data transferred outside the UK?

Some of the services listed above are run by companies based in the United States, so personal data they process for us may be transferred to, or accessed from, the US:

• Google (Google LLC) - Google Analytics 4 and Google Tag Manager, when you consent to analytics
• Cloudflare (Cloudflare, Inc.) - hosting, security logs and Cloudflare Turnstile on the contact form
• Amazon (Amazon.com, Inc. and its affiliates) - Amazon Associates affiliate links and product data, and Amazon Web Services for contact-form email (Amazon SES runs in the AWS Europe (Ireland) region, which is covered by UK adequacy regulations, but Amazon may access it from the US)

These transfers are protected by one of the following safeguards:

• The UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework), for recipients certified under it, which the UK government recognises as providing adequate protection.
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, built into each provider's data processing terms, for any transfer the data bridge does not cover.

You can ask us for more detail on these safeguards using the contact details at the end of this policy.

How will we notify you about changes?

We may update this policy from time to time. Material changes will be flagged in the footer with the updated date. Continuing to use the site after an update constitutes acceptance of the revised terms.

How can you contact us?

For privacy questions, use the contact form or email hello@athomeglow.co.uk.