Last Updated: July 25, 2026

Contact: support@zillykick.com | ZillyKick Store, 2850 SW Cedar Hills Blvd, Beaverton, OR 97005, United States

1. Information We Collect

Personal Information (directly from you)

• Account: name, email, phone, password (hashed), shipping/billing addresses
• Orders: payment token (via PCI-compliant processors), order history, preferences
• Communications: support tickets, reviews, survey responses, SMS/email opt-ins
  

Automatically Collected (via cookies & similar tech)

• Device: IP, browser, OS, device ID, screen resolution
• Usage: pages viewed, clicks, scroll depth, session duration, referrer
• Location: approximate (city/region) from IP
• Cookies: essential, analytics (GA4), marketing (Meta Pixel, TikTok Pixel, Klaviyo), affiliate

Third-Party Sources

• Shop Pay / Apple Pay / Google Pay: shipping/payment tokens
• Klarna: credit decision data (if you choose BNPL)
• Social login (Google, Apple): name, email, profile pic
• Marketing partners: hashed email for match rates (opt-in only)

2. How We Use Your Information

Purpose	Legal Basis	Data Categories
Fulfill orders, process payments, shipping	Contract	Account, order, payment, address
Customer support	Legitimate interest	Account, order, communications
Fraud prevention, security	Legitimate interest / Legal obligation	Device, IP, order, behavior
Marketing emails/SMS (with consent)	Consent	Email, phone, preferences, purchase history
Personalization, recommendations	Legitimate interest / Consent	Browsing, purchase, quiz answers
Analytics & site improvement	Legitimate interest	Device, usage, aggregated
Targeted advertising (Meta, Google, TikTok)	Consent (opt-in)	Hashed email, pixel events
Legal compliance (tax, subpoenas)	Legal obligation	As required

3. Sharing & Disclosure

We DO NOT sell your personal information.

We share with:

• Service Providers: Shopify (hosting, checkout), Klaviyo (email/SMS), Yotpo (reviews/loyalty), Google Analytics, Meta/TikTok (ads — with consent), payment processors
• Legal Requirements: Courts, regulators, law enforcement (valid request)
• Business Transfers: Merger/sale — you'll be notified; new entity bound by this policy
• Affiliates/Partners: Only with your explicit consent (e.g., co-branded giveaway)

4. Your Rights (US State Laws — CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, TDPSA, MCDPA, ICDPA, NDPA, NHPA)

• Know/Access: Request copy of personal data we hold
• Delete: Request deletion (exceptions: legal hold, fraud prevention, completed transactions)
• Correct: Fix inaccurate data
• Opt-Out of Sale/Sharing/Targeted Ads: Via Your Privacy Choices page or Global Privacy Control (GPC) signal
• Limit Sensitive Data Use: Where applicable
• Non-Discrimination: No penalty for exercising rights
• Appeal: If request denied, email support@zillykick.com

Submit requests: support@zillykick.com — verified within 10 days, fulfilled within 45 days (extendable 45 days).

5. Data Retention

• Account data: While account active + 3 years after closure
• Order/transaction data: 7 years (tax/legal)
• Marketing logs: 2 years after last engagement
• Support tickets: 3 years
• Analytics/cookie data: 26 months (GA4 default)

6. Cookies & Tracking

• Essential: Session, cart, checkout, fraud prevention — always on
• Analytics: GA4 (anonymized IP) — opt-out via GA Opt-out
• Marketing: Meta Pixel, TikTok Pixel, Klaviyo — require consent (banner)
• Preference: Currency, language, loyalty tier

Manage via cookie banner (bottom-left) or browser settings.

7. Children's Privacy

Site not directed to children under 13 (or 16 per state law). We don't knowingly collect kids' data. If you believe we have, contact support@zillykick.com — we'll delete.

8. International Transfers

Data processed in USA. If you're in EEA/UK: we rely on Standard Contractual Clauses (SCCs) and adequacy decisions for transfers to subprocessors. Contact us for SCC copies.

9. Security

• TLS 1.2+ encryption in transit; AES-256 at rest
• PCI DSS Level 1 via Shopify Payments / Stripe — we never see full card numbers
• Regular pen tests, vulnerability scans, SOC 2 Type II (Shopify)
• Employee access: least privilege, MFA, background checks

10. Changes to This Policy

Material changes: posted on Site + emailed 30 days prior. Continued use = acceptance.

11. Contact

Data Protection Officer: support@zillykick.com

Address: ZillyKick Store, 2850 SW Cedar Hills Blvd, Beaverton, OR 97005, United States