Store Privacy & Data
The short version. To sell you a t-shirt we need an email, a phone number and an address, and our payment provider needs your card. We never see or store your card number. We keep your order for our books, we strip your personal details off it after two years, and you can ask us to delete them sooner. We do not run advertising or analytics trackers on the store, and we do not sell anything about you to anybody.
Who we are
The Kaayko store is operated by Kaayko. For anything on this page, write to rohanramekar17@gmail.com and a human will answer. Under UK/EU data protection law we are the controller of the information described here.
What we collect, and only when
Browsing the store collects nothing about you. Information is collected at exactly two moments:
- When you add something to your bag. Your basket is written to your own browser and never sent to us until you check out.
- When you check out. We collect your email address (order confirmation and any problem with the order), your phone number (the courier), and your delivery address. We record which items, sizes and fits you bought, the amount charged, and any sales tax.
We do not ask for, and have no way to store, a date of birth, a government ID or an account password — the store has no accounts.
Your card details never reach us
Payments are processed by Stripe. Your card number, expiry and security code are entered into fields hosted by Stripe and are sent straight to Stripe. They do not pass through our servers and we never store them. What we receive back is a payment reference, the amount, the result, and the card's brand and last four digits.
Stripe is an independent controller of the payment data it holds. Its notice is at stripe.com/privacy.
Why we are allowed to hold it
- To perform our contract with you — taking payment, printing and shipping the order, handling a return. This covers your address, phone and email.
- To meet a legal obligation — tax and accounting law requires us to keep a record of every sale, which is why an order is never deleted outright.
- Our legitimate interests — preventing fraudulent orders and keeping the store working. We have balanced this against your rights and use the minimum data that works.
We do not rely on consent for marketing, because we do not send marketing email. The only email you get from the store is about an order you placed.
Who else sees it
- Stripe — payment processing and sales-tax calculation.
- Google Firebase (Google Cloud) — hosting, the database your order is stored in, and the functions that process it. Data is held in the United States.
- The postal carrier — receives your name and address on the parcel. We print and pack every order ourselves today; if that ever moves to a print partner, this list will name them first.
- Our email provider — carries the receipt, the shipping notice and any order email to your address, and nothing else.
That is the complete list. We do not sell, rent or share your information with anyone else, and we have never received a request from law enforcement. Transfers outside the UK/EU rely on the providers' standard contractual clauses.
How long we keep it
An automated job runs monthly and enforces this without anyone having to remember:
- Your name, email, phone and address: erased after 2 years. The order itself survives with the money, tax, item and status fields intact, so our books stay complete — it simply stops saying who bought it.
- Sent emails: deleted after 90 days. Each one repeats your name and address.
- Payment-event and error records: deleted after 400 days.
- Your basket and size preference: kept in your browser only, until you clear them.
What is stored in your browser
The store sets no advertising cookies and runs no analytics or tracking scripts — there is nothing here to consent to. It uses your browser's local storage for three things, all of which stay on your device:
kaayko_cart— what is in your bag.kaayko.lastFit— the size and fit you chose last time, so you do not re-pick it.darkTheme— your display preference.
Clearing your browser's site data removes all of them. Stripe sets its own cookies on its payment fields for fraud prevention; those are strictly necessary to take a payment.
Your rights
You can ask us to show you what we hold, correct it, delete it, export it, or object to how we use it.
Email rohanramekar17@gmail.com with the order number from
your receipt (it looks like KAAY-1042). We reply within 30 days, free of charge.
One honest limit: we cannot delete the financial record of a sale before the law lets us, so a deletion request removes your name, email, phone and address from the order and leaves the anonymised transaction. That is the same thing the 2-year job does, just sooner.
If you are in the EEA or UK you may complain to your national data protection authority. If you are in California, we do not sell or share personal information as the CCPA defines it, and we will not discriminate against you for exercising any right above.
Children
The store is not intended for children under 16 and we do not knowingly collect their information. If a child has placed an order, write to us and we will erase their details and refund it.
Security
The store is served only over HTTPS. Payment pages run under a restricted content-security policy that blocks third-party scripts. Order data is held in Firestore, which no public request can read — every order is reachable only through an authenticated admin route, or through the order-status link in your receipt, which carries a secret token that only you hold. Card data is out of scope entirely because we never hold it.
If a breach affects your personal information we will tell you and the relevant regulator within 72 hours of becoming aware of it.
Changes
If this policy changes materially we will update the date at the top and, where the change affects an order you have placed, email you. Previous versions are available on request.
Contact
Questions, requests, or a correction to anything on this page: rohanramekar17@gmail.com.