Store Privacy & Data
The short version. To sell you a t-shirt we need an email, a phone number and an address, and our payment provider needs your card. We never see or store your card number. We keep your order for our books, we strip your personal details off it after two years, and you can ask us to delete them sooner. We do not run advertising or analytics trackers on the store, and we do not sell anything about you to anybody.
Who we are
The Kaayko store is operated by Kaayko. For anything on this page, write to help@kaayko.com and a human will answer. Under UK/EU data protection law we are the controller of the information described here.
What we collect, and only when
Browsing the store collects nothing about you. Information is collected at exactly three moments:
- When you add something to your bag. Your basket is written to your own browser and never sent to us until you check out.
- When you check out. We collect your email address (order confirmation and any problem with the order), your phone number (the courier), and your delivery address. We record which items, sizes and fits you bought, the amount charged, and any sales tax.
- When you claim a free Kaayko Scouts piece. A Kaayko Scouts pick is claimed from your Scout page at kaay.link/m, through Stripe's checkout at $0. It asks for your name and delivery address and shows your email; it never asks for a card or a phone number. The claim becomes an ordinary order, kept and erased the way this page describes. The claim keeps your name, address and email on the pick as well, erased with the order after two years. A one-way code made from the address checks that one address receives at most one piece a month (a person at Kaayko may allow a second); the record used for that check is deleted after about 13 months. The rest of Kaayko Scouts is covered by the Kaayko privacy policy.
We do not ask for, and have no way to store, a date of birth, a government ID or an account password — the store has no accounts.
Your card details never reach us
Payments are processed by Stripe. Your card number, expiry and security code are entered into fields hosted by Stripe and are sent straight to Stripe. They do not pass through our servers and we never store them. What we receive back is a payment reference, the amount, the result, and the card's brand and last four digits.
Stripe is an independent controller of the payment data it holds. Its notice is at stripe.com/privacy.
Why we are allowed to hold it
- To perform our contract with you — taking payment, printing and shipping the order, handling a return. This covers your address, phone and email.
- To meet a legal obligation — tax and accounting law requires us to keep a record of every sale, which is why an order is never deleted outright.
- Our legitimate interests — preventing fraudulent orders and keeping the store working. We have balanced this against your rights and use the minimum data that works.
We do not rely on consent for marketing, because we do not send marketing email. The only email you get from the store is about an order you placed.
Who else sees it
- Stripe — payment processing and sales-tax calculation.
- Google Firebase (Google Cloud) — hosting, the database your order is stored in, and the functions that process it. Data is held in the United States.
- The postal carrier — receives your name and address on the parcel.
- Independent makers and teachers (Kreators) — when you buy a maker's piece, that maker ships it, so they see your name and delivery address until it has shipped, and use them only to ship that order. When you book a lesson, the teacher sees your first name and the session you booked. Kaayko prints and packs its own pieces itself.
- Our email provider — carries the receipt, the shipping notice, a reminder before a booked lesson, one request to rate a maker or teacher (and one reminder), and any order email to your address, and nothing else.
Ratings. If you rate a maker or teacher, your answers stay with Kaayko. They see only averages, once at least five different buyers have rated, never your answers or your note; shoppers see the average and the count. To count each person once we keep a one-way code made from your email, not the email itself.
That is the complete list. We do not sell, rent or share your information with anyone else, and we have never received a request from law enforcement. Transfers outside the UK/EU rely on the providers' standard contractual clauses.
How long we keep it
An automated job runs on the 1st of each month and enforces this without anyone having to remember, so a record goes at the first run after its period ends (up to about a month later):
- Your name, email, phone and address: erased after 2 years. The order itself survives with the money, tax, item and status fields intact, so our books stay complete — it simply stops saying who bought it.
- Sent emails: deleted after 90 days. Each one repeats your name and address.
- Payment-event and error records: deleted after 400 days.
- Your basket and size preference: kept in your browser only, until you clear them.
What is stored in your browser
The store sets no advertising cookies and runs no analytics or tracking scripts — there is nothing here to consent to. It uses your browser's local storage for these, all of which stay on your device:
kaayko_cart— what is in your bag.kaayko.lastFit— the size and fit you chose last time, so you do not re-pick it.darkTheme— your display preference.kaayko.loved— the pieces you have hearted, so the heart stays filled.kaayko.visitor— a random ID sent with a heart so each person counts once. We store only a keyed one-way hash of it (and of your network address) per heart, never the ID or the address; un-hearting deletes the record.kaayko.promo— a discount code you applied or followed a link with, for up to 24 hours.kaayko_checkout_session— a random ID for this bag's checkout, so a retry does not charge twice.kaayko:currencyandkaayko:fx:usdinr:v1— the currency you chose and the last exchange rate we showed.kaayko.patron— only if you followed a patron's own link: a signed code that gives that link's price at checkout. It is made from the patron's email but is not the email.
If your browser blocks local storage, every item above except the hearts (kaayko.loved and
kaayko.visitor, which are then not kept at all), and store access if you were given it, is kept in
first-party cookies on this site instead, for up to a year. They hold only those things and are never used to
track you.
Clearing your browser's site data removes all of them. Stripe sets its own cookies on its payment fields for fraud prevention; those are strictly necessary to take a payment. The email field at checkout is Stripe's Link field: if you already use Link, Stripe may offer to fill your saved address and card after sending you a code, and saving your details with Link is an account between you and Stripe.
Your rights
You can ask us to show you what we hold, correct it, delete it, export it, or object to how we use it.
Email help@kaayko.com with the order number from
your receipt (it looks like KAAY-1042). We reply within 30 days, free of charge.
One honest limit: we cannot delete the financial record of a sale before the law lets us, so a deletion request removes your name, email, phone and address from the order and leaves the anonymised transaction. That is the same thing the 2-year job does, just sooner.
If you are in the EEA or UK you may complain to your national data protection authority. If you are in California, we do not sell or share personal information as the CCPA defines it, and we will not discriminate against you for exercising any right above.
Children
The store is not intended for children under 16 and we do not knowingly collect their information. If a child has placed an order, write to us and we will erase their details and refund it.
Security
The store is served only over HTTPS. Payment pages run under a restricted content-security policy that blocks third-party scripts. Order data is held in Firestore, which no public request can read — every order is reachable only through an authenticated admin route, or through the order-status link in your receipt, which carries a secret token that only you hold. Card data is out of scope entirely because we never hold it.
If a breach affects your personal information we will tell you and the relevant regulator within 72 hours of becoming aware of it.
Changes
If this policy changes materially we will update the date at the top and, where the change affects an order you have placed, email you. Previous versions are available on request.
Contact
Questions, requests, or a correction to anything on this page: help@kaayko.com.