Popular pieces

No pieces match “”.

Back to the shop

Privacy policy

Last updated 11 October 2026

This explains what Grain & Form collects when you shop with us, why we need it, who it's shared with and how long we keep it. Questions about it are welcome: visit our showroom in Colombo 07, Sri Lanka. For buying from us, see our terms of sale.

What we collect

When you order, we keep your name, phone number, delivery address and any note you add, your email if you give one, what you ordered, the price you paid and how you chose to pay.

When you make an account, we keep your name, email and phone number, and any addresses you save. Your password is stored only in a scrambled (hashed) form that can't be turned back into the password, so we never see it.

When you pay by card, you enter your card details in PayHere's payment window, and they never reach our site. PayHere tells us whether the payment went through, the type of card and its last four digits.

When you track an order without signing in, we keep a scrambled form of your internet (IP) address for 24 hours, so we can limit how many guesses can be made at other people's orders.

How we use it

  • To make, deliver and support your order, and to call you about it.
  • To email you about your order and your account: confirmations, payment and delivery updates, cancellations and refunds, and links to confirm your email or reset your password.
  • To fill in checkout for you when you're signed in.
  • To keep the store secure and stop misuse.

We don't send newsletters or advertising, we don't sell your information, and we don't use it to show you ads anywhere else.

Who we share it with

Only the services that run the store, and only what each needs:

  • PayHere takes card payments. When you pay by card, they receive your name, email, phone and address, a short description of what you're buying, and the amount.
  • Resend sends our emails, so they receive your email address and the message.
  • Vercel hosts the site, and our database provider stores its data. Cloudflare stores and serves its images.
  • Our delivery team gets your name, phone number and address to bring your order.

We'd also share information if the law required it, for example to answer a court order.

Cookies

We use only the cookies the store needs to work: one that keeps you signed in, and one that remembers a guest's cart. There are no analytics or advertising cookies, so there's nothing to opt out of.

PayHere's payment window may set its own cookies while you pay; see PayHere's privacy policy for those.

How long we keep it

  • Orders are kept for our sales and tax records, and so we can help with your furniture later.
  • Accounts and saved addresses are kept until you ask us to delete them.
  • Order-tracking records are deleted after 24 hours.

As this is a demo store, test orders and accounts may be deleted at any time.

Your choices

You can see your orders, and change your name, phone number and saved addresses, on your account page. To get a copy of what we hold about you, to correct something you can't change yourself, or to have your account deleted, visit our showroom in Colombo 07, Sri Lanka.

We may need to keep an order's details after deleting your account, for our sales records, but they'll no longer be linked to an account.

Changes to this policy

If we change this policy, we'll update the date at the top. Each order records which version was in place when it was placed.