1. Who we are
This Privacy Policy explains how ZuZuPal (“ZuZuPal,” “we,” “us,” or “our”) handles personal information when you visit www.zuzupal.com (the “Site”), place an order for custom acrylic chibi collectibles, upload photos for personalization, join a waitlist or newsletter, or contact support.
For privacy questions or requests, email hi@zuzupal.com or use our contact form.
By using the Site, you acknowledge this Policy. Where consent is required by law for a specific processing activity (for example, certain marketing cookies or newsletters), we will ask for it.
2. Information we collect
We collect information in three ways: you provide it, it is collected automatically, and (in limited cases) it comes from our service providers.
Information you provide
- Checkout & orders — name, email, shipping address, phone (if provided), order contents, and payment confirmation details. Full card numbers are processed by Stripe; we do not store full card numbers on our servers.
- Photos & personalization — images you upload (and any crop/preview choices) so we can generate and print your custom acrylic chibi artwork. Do not upload photos of others without permission.
- Support — messages you send via the contact form, email (including hi@ / support@ / hello@), or support tools, plus any order number you share.
- Accounts & preferences — if we offer saved preferences, locale/currency choices, or newsletter signup, the details you submit.
- Promotions — email and related details when you claim a site offer (for example, a discount popup).
Information collected automatically
- Device & log data — IP address, browser type, device type, operating system, referring URLs, pages viewed, and timestamps.
- Cookies & similar technologies — cookies, pixels, and local storage used for site function, analytics, fraud prevention, and advertising measurement (see Cookies & ads below).
- Approximate location — derived from IP address for currency/locale hints, tax/shipping routing, and analytics.
Information from service providers
- Payment status and fraud signals from Stripe.
- Delivery and tracking events from carriers or tracking partners.
- Email delivery events (sent, bounced, complained) from our email provider.
- fal.ai — to generate a preview we send fal.ai the photo you uploaded (through a short-lived private link), a style reference image, and the text prompt for that style. We do not send your photo, prompt, or preview link to advertising or analytics vendors. Our checkout flow does not grant a separate license for AI-model training. fal.ai’s own terms govern how it processes that request. Artwork you order is for personal use, as described in our Creative Rights & Customer Content Policy.
3. How we use information
We use personal information to:
- Process, personalize, fulfill, and ship orders; send receipts, production, shipping, and delivery emails
- Generate previews and print-ready artwork from photos you upload
- Provide customer support and manage returns/refunds/reprints
- Operate Site features (cart, checkout, currency/locale, upload/preview tools)
- Prevent fraud, abuse, and security incidents
- Measure and improve Site performance and product experience
- Run advertising measurement and attribution (where allowed)
- Send marketing emails only when you opt in or as otherwise permitted by law; you can unsubscribe anytime
- Comply with legal obligations and enforce our Terms
Where GDPR/UK GDPR applies, we rely on one or more of: performance of a contract (fulfilling your personalized order), legitimate interests (securing and improving the Site, preventing fraud, basic analytics), consent (certain cookies/marketing), and legal obligation (tax/accounting records).
4. When we share information
We do not sell your personal information for money. We share information with service providers who process it only to operate the store, under contracts that limit their use of the data:
- Stripe — payments and fraud prevention
- Shipping carriers & logistics partners — delivery and tracking
- Mailgun (and related email infrastructure) — transactional and support email
- Hosting & infrastructure — for example Vercel and database/hosting providers that store Site and order data
- Image and print partners — transforming the photos you upload into print-ready artwork and producing the acrylic piece
- Newsletter / CRM tools — if you subscribe (for example Beehiiv or similar)
- Professional advisors & authorities — when required by law, legal process, or to protect rights, safety, and security
Advertising partners are not service providers for ad targeting. The advertising and analytics tools in this site are Google Analytics (measurement ID G-ZTL593HLPC) and Google Ads (AW-18369995659). If your IP address locates you outside California, those tags load when you open the site. If your IP address locates you in California, or we cannot tell the state, we do not load Google Analytics, Google Ads, Meta, or Pinterest at all. Outside California, Google can receive pages viewed, a page URL, commerce events (view item, add to cart, begin checkout, purchase), product name and price, and, after checkout, the contact details you entered so Google can match the conversion. We do not put uploaded photos, generation prompts, or preview URLs in those events. Meta and Pinterest code exists for the same kinds of events, but those pixels are not configured in the live site settings, so those requests are not sent. If they are turned on later, they follow the same on/off choice. Under the CCPA/CPRA, sharing identifiers with advertising platforms for cross-context ads can be a “sale” or “sharing.” We do not treat that use as a service-provider relationship. IP location can be wrong when someone uses a VPN or is traveling.
If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy or a successor policy.
Your Privacy Choices. California visitors, and visits we cannot place, do not get advertising tags. There is no allow prompt. Everyone else can use Your Privacy Choices and press Turn off advertising tracking. That choice is stored in this browser and stops both the browser tags and our server from sending advertising events. You do not have to email us. Checkout, preview generation, your gallery, order emails, and the three-preview daily limit keep working.
Sensitive personal information. Photos you upload can show a face or other personal details. We use them to create your acrylic figure, not for advertising, and we do not send the photo file, prompt, or preview link to ad networks. Approximate location may be inferred from your IP address for currency, shipping, and, when advertising tracking is on, measurement. Turn off advertising tracking in Your Privacy Choices stops that advertising use. Checkout, fal.ai previews, your gallery, and order emails still use the information they need to complete those jobs.
5. Cookies, analytics & ads
We use:
- Essential cookies — cart, checkout, security, and preference storage needed for the Site to work
- Analytics cookies — to understand traffic and improve the Site
- Advertising cookies / pixels — to measure campaigns and, where permitted, show more relevant ads
Cart, checkout, security, and your privacy choice use essential cookies and keep working when advertising tracking is off. Outside California, Google Analytics and Google Ads load with the page. In California, or when we cannot tell the state, those tags are not loaded. Your Privacy Choices turns tracking off for any visitor, and Global Privacy Control does the same without a click, including after a previous allow. Those signals also stop server-side advertising events.
6. International transfers
We are based in the United States and may process information in the U.S. and other countries where our providers operate. Those countries may have different data-protection laws than your home country. Where required, we use appropriate safeguards (such as standard contractual clauses or provider certifications) for cross-border transfers.
7. Retention
We keep information only as long as needed for the purposes described above:
- Order & payment records — typically for the period required for accounting, tax, chargebacks, warranties, and legal claims (often several years)
- Uploaded photos & generated artwork — photos tied to an order are kept for 24 months so we can produce, reprint, and support it. Photos and previews that never become an order are deleted after 30 days.
- Generation limit — a hashed IP used only to cap free previews is deleted after 48 hours.
- Abandoned cart records — email and cart details kept to send a reminder are deleted after 30 days.
- Support tickets & emails — for as long as needed to resolve your request and maintain service history, unless you ask us to delete and we are not required to retain them
- Analytics — according to our analytics provider retention settings
- Marketing lists — until you unsubscribe or we delete inactive contacts
8. Security
We use administrative, technical, and organizational measures designed to protect personal information (including HTTPS and restricted access to order systems). No method of transmission or storage is 100% secure. If we become aware of a breach that requires notice under applicable law, we will notify you and/or regulators as required.
9. Your rights & choices
Depending on where you live, you may have rights to:
- Access / know what personal information we hold about you
- Correct inaccurate information
- Delete information (subject to legal exceptions)
- Export / portability of information you provided
- Opt out of marketing emails (unsubscribe link in every marketing message)
- Opt out of sale/sharing for advertising, and limit the use of sensitive personal information, using the links in this policy and in the site footer
- Object to or restrict certain processing, or withdraw consent where processing is consent-based
To exercise these rights, email hi@zuzupal.com. We may need to verify your identity (for example, confirming control of the order email). We will respond within the time required by law (generally 30–45 days, extendable where permitted).
If you are in the EEA/UK and have concerns, you may also contact your local data protection authority. If you are a California resident, you may designate an authorized agent to submit requests as allowed by the CCPA/CPRA.
We will not discriminate against you for exercising privacy rights.
10. Children’s privacy
The Site is not directed to children under 16 (or under 13 where that is the applicable standard), and we do not knowingly collect personal information from children. If you believe a child provided information, contact us and we will delete it.
11. Third-party links
The Site may link to third-party websites or services. Their privacy practices are their own. Review their policies before providing information to them.
12. Changes to this Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. For material changes, we may also provide additional notice (for example, a Site banner or email). Continued use of the Site after an update means you acknowledge the revised Policy, except where consent is required by law for a specific change.