Privacy Policy

Who we are

KIRSCH MSO LLC operates this store and is the contact for privacy questions.

Postal address: 1012 Goodlette-Frank Rd N, Suite 100, Naples, FL 34102. Email: illuminaterx@kirschderm.com.

Checkout and order information

Checkout is processed by Stripe. You enter your payment details directly into Stripe's hosted checkout. We do not receive or store your full payment-card number.

Stripe collects your email address at checkout so the purchase can be receipted and supported, and for subscription purchases Stripe also collects your phone number.

If you request the TRYILLUMINATE or SHOP15 first-order offer, you enter your email on our checkout page before Stripe checkout begins. We normalize that email and use it with one shared private first-order claim record to determine whether either code is already reserved or redeemed and whether our order records show an earlier purchase. For that claim, our server creates or recovers one dedicated Stripe customer record using the claim's immutable identifier, verifies its normalized email, and binds the exact Stripe customer identifier back to the private claim before a discounted checkout can begin. The private claim record stores the normalized email, selected offer and environment identifiers, reservation, checkout-attempt and expiration state, and the Stripe customer, checkout session, payment, refund and event identifiers needed to prevent concurrent or repeat redemption across both codes.

To enforce first-time, one-per-customer eligibility, we create private keyed hashes of the normalized email, Stripe customer identifier, card fingerprint, and named shipping address. We treat an exact email or Stripe customer match, or the combined card-fingerprint and named-shipping-address match, as the same customer. A shared card alone or address alone is not enough.

The paid-purchase eligibility ledger stores the resulting keyed hashes, their key-version identifier, Stripe session, payment and refund identifiers, paid time, amount, currency and eligibility or refund state. It does not store the raw card fingerprint or raw shipping address. We retain older HMAC keys in the server keyring so a key rotation cannot make an earlier customer appear new; changing or dropping a required key fails checkout processing closed.

From a completed order we keep the fulfillment and order facts our systems record, such as the Stripe identifiers for the session, payment, invoice, subscription and customer, the purchased plan and cadence, the amounts and tax we reconcile, the shipping recipient and United States shipping address, and the order state we use to ship and support your purchase.

For subscriptions, Stripe stores the shipping details on your Stripe customer record so later deliveries can ship to the same address.

To get your order to you, we share the recipient name, shipping address, and the items to be shipped with the people and providers who pack and ship the order and with the shipping carrier that delivers it.

Support and email

When you email illuminaterx@kirschderm.com about an order, a refund, or a replacement, we read and keep that correspondence to answer you and to verify the order and shipping address.

Reviews and review photos

Reviews are collected by email today, and the on-site review submission path is disabled.

When a review is approved and published, the page can show the review title, the review text, the star rating, the publishable display name you provide, how long you reported using the product, whether the purchase was verified, a short material-connection disclosure such as whether the product was received free or the reviewer is connected to us, and the date the review was recorded.

If before and after photos are submitted and accepted for publication, those images are shown together with the dates you give for them, delivered through temporary links to a private storage bucket.

When a review photo is accepted, our image handling re-encodes the image and does not retain the file's embedded metadata, such as camera EXIF and location tags.

Information you send with a review that is not published, such as your email address, order number, and where you bought the product, is kept only to verify and answer the review.

Hosting, security, and cookies

This site runs on Lovable hosting with its managed cloud database, which is built on Supabase, and it is served through Cloudflare's network. These providers process ordinary technical request and security data, such as request URLs, timestamps, IP address, and user agent, to deliver, secure, and protect the site.

Those providers may set strictly necessary cookies used to route requests and to detect and block abusive traffic. This site also uses Google Analytics and Google Ads measurement cookies. Ad personalization is not enabled. You can control or block cookies through your browser settings.

This site currently requests its web fonts from Google Fonts. When your browser loads a page, it makes a request to Google's font servers, and that request includes your IP address, user agent, and the address of the page requesting the font. We do not send Google any order, account, or review information for fonts.

Service providers

We use Stripe for payments, subscriptions, tax calculation, and billing, and we use Lovable hosting together with its managed cloud database to run this site and store the order and review records described above.

Stripe promotion-code eligibility is one part of TRYILLUMINATE and SHOP15 verification. Our shared private first-order claim and paid-purchase eligibility ledger provide separate, server-side one-per-customer controls across both codes.

Advertising measurement

This site loads the Google tag for Google Analytics and Google Ads measurement. We send sanitized public page locations, page titles, campaign parameters, and an eligible Google Ads click identifier from the landing URL. We do not send checkout session identifiers, URL fragments, names, email addresses, phone numbers, postal addresses, payment details, review information, or health information in browser pageview events.

After our server verifies a paid Stripe purchase, the browser purchase event can include an opaque transaction identifier, currency, merchandise value, shipping, tax, offer code, product identifier, product name, purchase plan, quantity, and discount. TRYILLUMINATE has a merchandise value of $0 and a separate $15 shipping amount. The same opaque transaction identifier and $0 merchandise value are used for its Google Ads website conversion so refreshes can be deduplicated and shipping is not reported as revenue.

We disable Google signals, advertising personalization, and user-data consent in the browser tag. We do not use this measurement for remarketing or personalized advertising, and we do not send customer contact, payment, review, or health information to Google through these events.

Separately, this application contains a server click-attribution and Google Ads conversion path that remains off unless its independent server and database controls are enabled. When those controls are enabled, an eligible gclid, gbraid or wbraid is stored privately on our server. An opaque random key, which carries no personal information, is placed in a first-party server-set cookie that is not readable by page scripts and expires after 30 days, so a verified purchase can be matched to that click.

That server conversion path sends the eligible click identifier, an opaque transaction identifier, the verified conversion time, currency, and merchandise value. It does not substitute shipping or a synthetic amount when merchandise value is $0. Your name, email address, phone number, postal address, payment details, product details, review information, skin condition details, and other health information are not sent through that server conversion path.

How we do not use your information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Retention

We keep information for as long as it serves the purpose it was collected for, which includes fulfilling your order, honoring the refund and replacement promises, supporting subscriptions, maintaining accurate financial and tax records, and resolving disputes, and for as long as the law requires. We do not promise an automatic deletion interval that our systems do not yet enforce.

Your choices

You can control or block Google Analytics and Google Ads measurement cookies through your browser settings.

To request access to, correction of, or deletion of your information, or to ask any privacy question, email illuminaterx@kirschderm.com. We may need to verify the order before acting on a request.

Children

This store and product are not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Not a medical service

This store sells a cosmetic skincare product. It is not a medical service, and no clinician-patient relationship is created by buying, reviewing, or contacting us. Please do not send medical history, diagnoses, or other health details through review or support channels.

Changes

We may update this policy. The effective and last updated date is August 26, 2026.