Privacy Policy

    Last updated: October 12, 2026

    Plain-English summary: We collect the minimum information needed to run our store, fulfill your orders, and (if you opt in) tell you about new drops. We don't sell your personal information. You have rights over your data, and we honor them no matter where you live.

    1. Who We Are (Data Controller)

    This Privacy Policy is issued by ShameFace ("we," "us," "our"), the operator of myshameface.com and related storefronts (the "Site"). For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), the Brazilian LGPD, and similar laws, ShameFace is the "data controller" of personal information collected through the Site.

    Contact: privacy@shameface.com

    2. Information We Collect

    We collect the following categories of personal information:

    • Identifiers & contact data: name, email, shipping/billing address, phone number.
    • Commercial information: products viewed or purchased, order history, returns.
    • Payment information: processed by our PCI-compliant payment processor (e.g., Shopify Payments, Stripe). We do not store full card numbers on our servers.
    • Internet/network activity: IP address, browser and device information, pages viewed, referring URLs, and interactions with the Site, collected via cookies and similar technologies.
    • Geolocation: approximate location derived from IP address.
    • Communications: messages you send us through contact forms, email, or social media.
    • Marketing preferences: opt-ins, opt-outs, and interactions with our emails.

    We do not knowingly collect "sensitive personal information" as defined under the CPRA or "special categories of data" under the GDPR. We do not knowingly collect information from children under 16.

    3. How and Why We Use Your Information (Legal Bases)

    We use personal information for the following purposes:

    • To perform our contract with you: processing orders, payments, shipping, returns, and customer support.
    • Legitimate interests: securing the Site, preventing fraud, analyzing site performance, and improving our products.
    • Consent: sending marketing emails, setting non-essential cookies, and other activities that require consent under applicable law.
    • Legal obligation: tax, accounting, and regulatory recordkeeping.

    You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

    4. How We Share Information

    We do not sell your personal information for money. We share it only with:

    • Service providers / processors: ecommerce platform (Shopify), payment processors, shipping carriers, email marketing tools, hosting and analytics providers, and customer support tools, bound by contract to use the data only for our instructions.
    • Legal & safety: when required by law, court order, or to protect our rights, property, or the safety of others.
    • Business transfers: in connection with a merger, acquisition, financing, or sale of assets, with notice to affected users where required.

    "Sale" / "Sharing" under US state laws: Some advertising and analytics cookies may qualify as a "sale" or "sharing" of personal information under California, Colorado, Connecticut, Virginia, Utah, and other state laws. You can opt out at any time, see Section 7.

    5. Cookies and Tracking Technologies

    We use strictly necessary, functional, analytics, and (with consent where required) advertising cookies. You can manage your preferences via our cookie banner or your browser settings. Browser-level signals such as Global Privacy Control (GPC) are honored as a valid opt-out of "sale" and "sharing" for users in jurisdictions that recognize them.

    6. International Data Transfers

    We are based in the United States. If you access the Site from outside the US, your information will be transferred to, processed, and stored in the US and other countries that may not provide the same level of data protection as your home jurisdiction. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent mechanisms.

    7. Your Privacy Rights

    Subject to applicable law, you have the right to:

    • Access the personal information we hold about you.
    • Correct inaccurate or incomplete information.
    • Delete your personal information ("right to be forgotten").
    • Restrict or object to certain processing.
    • Receive your data in a portable format.
    • Opt out of the "sale" or "sharing" of personal information and of targeted advertising.
    • Withdraw consent at any time.
    • Avoid being subject to solely automated decisions producing legal or similarly significant effects.
    • Lodge a complaint with your local supervisory authority (e.g., your EU/UK Data Protection Authority, the California Privacy Protection Agency, the ANPD in Brazil, the OAIC in Australia, or the OPC in Canada).

    To exercise any right, email privacy@shameface.com. We will respond within the timelines required by applicable law (generally 30–45 days). We will not discriminate against you for exercising your rights.

    Authorized agents: California residents may designate an authorized agent to make a request on their behalf, subject to verification.

    8. Region-Specific Disclosures

    California (CCPA / CPRA)

    In the past 12 months we have collected the categories of personal information described in Section 2 for the business purposes described in Section 3, and disclosed identifiers, commercial information, and internet activity to the categories of recipients in Section 4. We do not knowingly sell or share the personal information of consumers under 16.

    Other US States (VA, CO, CT, UT, TX, OR, MT, etc.)

    Residents of states with comprehensive privacy laws have rights substantially similar to those listed in Section 7, including the right to appeal a denied request by emailing us at the address above with the subject line "Privacy Appeal."

    EEA / United Kingdom (GDPR / UK GDPR)

    Our legal bases are listed in Section 3. You may contact your local Data Protection Authority. UK users may contact the ICO (ico.org.uk).

    Canada (PIPEDA / Quebec Law 25)

    We obtain meaningful consent for collection, use, and disclosure of personal information and honor access and correction requests.

    Australia (Privacy Act / APPs)

    We handle personal information consistent with the Australian Privacy Principles. Complaints can be made to the OAIC.

    Brazil (LGPD)

    We process personal data on the legal bases set out in Article 7 of the LGPD. Data subjects may contact the ANPD.

    9. Data Retention

    We retain personal information only as long as necessary for the purposes described in this policy, including to comply with tax, accounting, and other legal obligations. Order records are typically retained for at least 7 years for tax and warranty purposes. Marketing data is retained until you unsubscribe.

    10. Data Security

    We use industry-standard administrative, technical, and physical safeguards including TLS encryption in transit, restricted access controls, and PCI-DSS compliant payment processing. No system is 100% secure; we cannot guarantee absolute security.

    11. Children's Privacy

    The Site is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

    12. Third-Party Links

    The Site may contain links to third-party sites. We are not responsible for their privacy practices. Review their policies before sharing information.

    13. Changes to This Policy

    We may update this Privacy Policy from time to time. Material changes will be posted with a new "Last updated" date and, where required, notified to you directly.

    14. Contact

    Questions, requests, or complaints? Email privacy@shameface.com. EEA/UK users without a satisfactory response may also contact their local supervisory authority.