Privacy Policy

ZillyKick Privacy Policy

Effective Date: July 25, 2026

Last Updated: July 25, 2026

Contact: privacy@zillykick.com | ZillyKick LLC, 123 Sneaker Ave, Wilmington, DE 19801, USA

1. Information We Collect

Personal Information (directly from you)

  • Account: name, email, phone, password (hashed), shipping/billing addresses
  • Orders: payment token (via PCI-compliant processors), order history, preferences
  • Communications: support tickets, reviews, survey responses, SMS/email opt-ins
  • Loyalty Program: birthday, tier, points, referral activity

Automatically Collected (via cookies & similar tech)

  • Device: IP, browser, OS, device ID, screen resolution
  • Usage: pages viewed, clicks, scroll depth, session duration, referrer
  • Location: approximate (city/region) from IP
  • Cookies: essential, analytics (GA4), marketing (Meta Pixel, TikTok Pixel, Klaviyo), affiliate

Third-Party Sources

  • Shop Pay / Apple Pay / Google Pay: shipping/payment tokens
  • Klarna: credit decision data (if you choose BNPL)
  • Social login (Google, Apple): name, email, profile pic
  • Marketing partners: hashed email for match rates (opt-in only)

2. How We Use Your Information

Purpose Legal Basis Data Categories
Fulfill orders, process payments, shipping Contract Account, order, payment, address
Customer support Legitimate interest Account, order, communications
Fraud prevention, security Legitimate interest / Legal obligation Device, IP, order, behavior
Marketing emails/SMS (with consent) Consent Email, phone, preferences, purchase history
Personalization, recommendations Legitimate interest / Consent Browsing, purchase, quiz answers
Analytics & site improvement Legitimate interest Device, usage, aggregated
Targeted advertising (Meta, Google, TikTok) Consent (opt-in) Hashed email, pixel events
Loyalty program administration Contract Account, points, tier, referrals
Legal compliance (tax, subpoenas) Legal obligation As required

3. Sharing & Disclosure

We DO NOT sell your personal information.

We share with:

  • Service Providers: Shopify (hosting, checkout), UPS/USPS (shipping), Klaviyo (email/SMS), Yotpo (reviews/loyalty), Gorgias (support), Google Analytics, Meta/TikTok (ads — with consent), payment processors
  • Legal Requirements: Courts, regulators, law enforcement (valid request)
  • Business Transfers: Merger/sale — you'll be notified; new entity bound by this policy
  • Affiliates/Partners: Only with your explicit consent (e.g., co-branded giveaway)

4. Your Rights (US State Laws — CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, TDPSA, MCDPA, ICDPA, NDPA, NHPA)

  • Know/Access: Request copy of personal data we hold
  • Delete: Request deletion (exceptions: legal hold, fraud prevention, completed transactions)
  • Correct: Fix inaccurate data
  • Opt-Out of Sale/Sharing/Targeted Ads: Via Your Privacy Choices page or Global Privacy Control (GPC) signal
  • Limit Sensitive Data Use: Where applicable
  • Non-Discrimination: No penalty for exercising rights
  • Appeal: If request denied, email privacy@zillykick.com

Submit requests: privacy@zillykick.com — verified within 10 days, fulfilled within 45 days (extendable 45 days).

5. Data Retention

  • Account data: While account active + 3 years after closure
  • Order/transaction data: 7 years (tax/legal)
  • Marketing logs: 2 years after last engagement
  • Support tickets: 3 years
  • Analytics/cookie data: 26 months (GA4 default)

6. Cookies & Tracking

  • Essential: Session, cart, checkout, fraud prevention — always on
  • Analytics: GA4 (anonymized IP) — opt-out via GA Opt-out
  • Marketing: Meta Pixel, TikTok Pixel, Klaviyo — require consent (banner)
  • Preference: Currency, language, loyalty tier

Manage via cookie banner (bottom-left) or browser settings.

7. Children's Privacy

Site not directed to children under 13 (or 16 per state law). We don't knowingly collect kids' data. If you believe we have, contact privacy@zillykick.com — we'll delete.

8. International Transfers

Data processed in USA. If you're in EEA/UK: we rely on Standard Contractual Clauses (SCCs) and adequacy decisions for transfers to subprocessors. Contact us for SCC copies.

9. Security

  • TLS 1.2+ encryption in transit; AES-256 at rest
  • PCI DSS Level 1 via Shopify Payments / Stripe — we never see full card numbers
  • Regular pen tests, vulnerability scans, SOC 2 Type II (Shopify)
  • Employee access: least privilege, MFA, background checks

10. Changes to This Policy

Material changes: posted on Site + emailed 30 days prior. Continued use = acceptance.

11. Contact

Data Protection Officer: privacy@zillykick.com

Mail: ZillyKick LLC, Attn: Privacy, 123 Sneaker Ave, Wilmington, DE 19801, USA