Privacy and account information

What Google sign-in shares

If you choose Continue with Google, Myzosen requests only the openid, email and profile permissions. Google verifies your identity and supplies a Google account identifier, email address, email-verification status and available name information. We use these details to identify your Google account, create or sign you in to your Myzosen customer account, and show your account information. We do not request access to your Gmail messages, contacts, Drive files or calendar.

Account information we store

Our Medusa account service stores your Google account identifier, sign-in email, verification status and available name information. Your customer profile also stores the name, contact email, phone number and WhatsApp number you choose to provide. Your address book stores recipient names, delivery addresses, countries, international phone numbers and your default delivery address. These details support account contact and delivery preparation. A Google sign-in does not automatically merge with an existing Myzosen account that has the same email address. If an account already uses that email, you are asked to sign in with its email and password.

Google may include a profile picture or other identity claims in its response. Myzosen does not save or display your Google profile picture. Provider tokens are handled during server-side authentication and are not saved to your customer profile or exposed to browser scripts.

Services used for your account

Cloudflare runs the website and account gateway; the Myzosen Medusa service stores account and authentication records. Google handles the Google sign-in step. We use these systems to operate the account feature and protect sign-in attempts. We do not use Google identity data for advertising.

Cookies security and cart selections

Sign-in uses a secure, HttpOnly session cookie. Google sign-in also uses a short-lived secure cookie to bind the callback to the browser that started it. Our security controls store hashed sign-in identifiers, attempt counts, expiry times and hashed callback transaction identifiers. Cart selections, colours, sizes and quantities stay in this browser's local storage and are not synchronised to your account.

Your account choices

You can edit your personal details and contact email, and add, edit or remove delivery addresses in your account. Contact email changes do not change your sign-in email. Removing or changing an address in your address book does not change the address recorded on an existing order. Your account displays only orders linked to your customer account, including their items, totals, delivery address, shipment updates and tracking links when available. Opening a carrier tracking link takes you to that carrier’s website.

Sign out to end the current session. Signing out does not delete your stored account or Google identity record. Self-service account deletion is not available. The formal retention and deletion process is still being finalised; no automatic deletion period is promised here. For account or data enquiries, contact us.

Checkout and PayPal

Checkout sends the selected products, recipient name, delivery address and phone number to our Medusa service to prepare and fulfil your order. The cart loads PayPal’s official browser SDK to display its payment button. Selecting the PayPal button opens PayPal’s secure payment window or redirects to PayPal where required by your browser. PayPal receives the order amount, currency, payment reference and recipient name and address to process the payment. Payment credentials are entered with PayPal; Myzosen does not collect your card number or PayPal password.

Medusa retains checkout and order information, payment references and payment status for fulfilment, transaction review and support. Your browser’s session storage keeps checkout and payment references and selected products so the same checkout can be recovered after a PayPal return or interrupted connection. PayPal’s own privacy notice applies when you use its payment service.

Our separate sandbox site is clearly labelled for testing. Use test details only there: sandbox payments do not charge real money and test orders do not authorise dispatch.

Product enquiries

When you submit the contact form, we store your name, email, country or region, international phone / WhatsApp number, chosen product category and message in our Medusa service. We also record the submitting IP address and the approximate country, region, city, time zone and network provider supplied by Cloudflare, when available. Our team compares this network location with the country you provide to help review suspicious enquiries; IP location can be affected by VPNs, proxies or travel. We send these enquiry and source details to our team’s Gmail inbox for response and follow-up. The form does not subscribe you to marketing or place an order.

Cloudflare Turnstile checks submissions to limit automated abuse. Cloudflare D1 stores temporary hashed rate-limit identifiers and an email delivery queue. The queue removes contact details, source details and message content after the email service accepts a notification, or after seven days if it remains unsent; delivery identifiers and status remain for duplicate prevention. Medusa and the team’s mailbox retain the enquiry for follow-up. Our map uses Leaflet and OpenStreetMap imagery, showing city and county locations. For access or deletion requests, email [email protected].

Google sign-in support

For Google sign-in support, use the support contact shown on Google’s consent screen.