Privacy Policy

• We collect only what we need to fulfill your order, prevent fraud, and meet legal obligations.
• We do not sell or rent your personal information to third parties.
• Card data is handled directly by Stripe (PCI DSS Level 1) and never reaches our servers.
• You can request access, correction, or deletion of your data at any time.

When you place an order, we collect:

• Identity & contact data: full name, email address, phone number.
• Shipping data: street address, apartment / unit, city, state, ZIP / postal code, country.
• Order data: the products you bought, the amount, the date, the order identifier.
• Technical data: IP address, browser user-agent, country / region (from your IP), and a privacy-preserving device fingerprint hash, captured to detect fraud and for marketing attribution.
• Marketing attribution: UTM parameters and ad-platform click identifiers (e.g. fbclid, gclid, ttclid) when present in the URL we redirected from.

Payment card data is processed directly by Stripe (PAN, CVC, expiration). It is encrypted in transit, tokenized by Stripe, and never reaches our servers or storage.

• To process your order and ship the products you purchased.
• To send you order confirmation, shipping updates, and customer service responses.
• To detect and prevent fraud, chargebacks, and abuse.
• To comply with our tax, accounting, and legal obligations.
• To measure the effectiveness of our advertising via aggregate, server-side conversion events.

We use a small number of cookies, all strictly necessary for the checkout to function or for our own analytics:

• Authentication cookies from Supabase, used by our admin only.
• Attribution cookie (_cp_attr): stores marketing source identifiers for up to 90 days so a returning visitor is correctly credited to the originating ad campaign. No third-party tracking.
• Stripe cookies: required by Stripe to render the payment field and prevent fraud (see stripe.com/cookies).

We share the minimum necessary data with:

• Stripe — to process your payment.
• Shipping carriers — to deliver your order (name + address only).
• Email provider (Resend) — to send order confirmations and shipping updates.
• Ad platforms (Meta, Google, TikTok) — server-side, hashed, conversion-only events for attribution. We never share raw email addresses, phone numbers, or addresses; data is SHA-256 hashed before transmission per each platform's spec.

We do not sell or rent your personal information.

We retain order records for as long as required by tax and accounting law in our jurisdiction (typically 5 to 7 years). Marketing attribution and technical data are retained for up to 24 months. You may request earlier deletion subject to overriding legal obligations.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (subject to legal retention requirements).
• Object to or restrict certain processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent where processing is based on consent.

To exercise any right, reply to your order confirmation email. We will respond within 30 days.

We protect your data with standard industry safeguards:

• TLS 1.3 (256-bit) encryption for all traffic between your browser and our servers.
• Card data handled exclusively by Stripe, certified PCI DSS Level 1.
• Sensitive integration tokens encrypted at rest using AES-256-GCM.
• Strict Content Security Policy, HSTS, and other defensive HTTP headers.
• Row-level security on our database — sellers can only access their own orders.

We may revise this Privacy Policy. The effective date at the top reflects the most recent revision. Material changes will be communicated to active customers by email when reasonably practicable.