Privacy — Catulie

Before launch: Add the registered business name and postal address — required on a commerce privacy notice and for CAN-SPAM if marketing email is ever sent.

What we collect

To fill your order — name, shipping address, email, and optionally a phone number for delivery problems.
From the payment step — a payment reference and the amount. Card numbers are handled entirely by the payment provider and never reach this site.
Nothing else. There is no advertising pixel, no analytics profile, no third-party tracker on this site.

Cookies

The shop uses local browser storage to remember what is in your bag and, if you are the shop owner, to keep you signed in to the admin. No advertising or tracking cookies are set.

Who else sees your data

Only the services needed to complete your order: a PCI DSS Level 1 payment processor, a shipping carrier and label provider so the parcel can be addressed and tracked, a SOC 2 Type II email provider for the receipt and tracking notices, and SOC 2 Type II cloud infrastructure that hosts the shop. None of them receive your data for their own marketing.

How long we keep it

Order records are kept for seven years because tax rules require it. Everything else is deleted when it is no longer needed.

Your choices

Email hello@catulie.com to see, correct, or delete the personal data we hold about you. We answer within 30 days. If you are in California or the EU/UK, you have the statutory rights those laws give you, and exercising them never costs you anything.

Children

This shop is not directed at children under 13 and we do not knowingly collect their data.

Security

See the security page for how the shop is protected and how to report a vulnerability.