1. Who we are
This Privacy Policy explains how ZuZuPal (“ZuZuPal,” “we,” “us,” or “our”) handles personal information when you visit www.zuzupal.com (the “Site”), place an order for custom acrylic chibi collectibles, upload photos for personalization, join a waitlist or newsletter, or contact support.
For privacy questions or requests, email hi@zuzupal.com or use our contact form.
By using the Site, you acknowledge this Policy. Where consent is required by law for a specific processing activity (for example, certain marketing cookies or newsletters), we will ask for it.
2. Information we collect
We collect information in three ways: you provide it, it is collected automatically, and (in limited cases) it comes from our service providers.
Information you provide
- Checkout & orders — name, email, shipping address, phone (if provided), order contents, and payment confirmation details. Full card numbers are processed by Stripe; we do not store full card numbers on our servers.
- Photos & personalization — images you upload (and any crop/preview choices) so we can generate and print your custom acrylic chibi artwork. Do not upload photos of others without permission.
- Support — messages you send via the contact form, email (including hi@ / support@ / hello@), or support tools, plus any order number you share.
- Accounts & preferences — if we offer saved preferences, locale/currency choices, or newsletter signup, the details you submit.
- Promotions — email and related details when you claim a site offer (for example, a discount popup).
Information collected automatically
- Device & log data — IP address, browser type, device type, operating system, referring URLs, pages viewed, and timestamps.
- Cookies & similar technologies — cookies, pixels, and local storage used for site function, analytics, fraud prevention, and advertising measurement (see Cookies & ads below).
- Approximate location — derived from IP address for currency/locale hints, tax/shipping routing, and analytics.
Information from service providers
- Payment status and fraud signals from Stripe.
- Delivery and tracking events from carriers or tracking partners.
- Email delivery events (sent, bounced, complained) from our email provider.
- Image processing / AI pipeline providers that help transform uploads into print-ready artwork (under contracts that limit their use of your files).
3. How we use information
We use personal information to:
- Process, personalize, fulfill, and ship orders; send receipts, production, shipping, and delivery emails
- Generate previews and print-ready artwork from photos you upload
- Provide customer support and manage returns/refunds/reprints
- Operate Site features (cart, checkout, currency/locale, upload/preview tools)
- Prevent fraud, abuse, and security incidents
- Measure and improve Site performance and product experience
- Run advertising measurement and attribution (where allowed)
- Send marketing emails only when you opt in or as otherwise permitted by law; you can unsubscribe anytime
- Comply with legal obligations and enforce our Terms
Where GDPR/UK GDPR applies, we rely on one or more of: performance of a contract (fulfilling your personalized order), legitimate interests (securing and improving the Site, preventing fraud, basic analytics), consent (certain cookies/marketing), and legal obligation (tax/accounting records).
4. When we share information
We do not sell your personal information for money. We share information with service providers who help us operate the store, under contracts that limit their use of the data:
- Stripe — payments and fraud prevention
- Shipping carriers & logistics partners — delivery and tracking
- Mailgun (and related email infrastructure) — transactional and support email
- Hosting & infrastructure — for example Vercel and database/hosting providers that store Site and order data
- Analytics — Google Analytics (or equivalent) for aggregated Site measurement
- Advertising platforms — Meta (Pixel / Conversions API), Pinterest (Tag / Conversions API), and similar partners for ads measurement and optimization
- Newsletter / CRM tools — if you subscribe (for example Beehiiv or similar)
- Professional advisors & authorities — when required by law, legal process, or to protect rights, safety, and security
If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy or a successor policy.
California “sale” / “sharing.” Some analytics and advertising cookies may be considered a “sale” or “sharing” of personal information for cross-context behavioral advertising under the CCPA/CPRA. You can opt out via your browser privacy controls, industry tools (such as the NAI/DAA opt-outs), platform ad settings, and by contacting us at hi@zuzupal.com with the subject “Do Not Sell or Share.” We do not knowingly sell or share personal information of consumers under 16.
5. Cookies, analytics & ads
We use:
- Essential cookies — cart, checkout, security, and preference storage needed for the Site to work
- Analytics cookies — to understand traffic and improve the Site
- Advertising cookies / pixels — to measure campaigns and, where permitted, show more relevant ads
You can block or delete cookies in your browser settings. Blocking essential cookies may break checkout. Platform-level controls (Google, Meta, Pinterest) and mobile OS ad settings also affect advertising personalization.
6. International transfers
We are based in the United States and may process information in the U.S. and other countries where our providers operate. Those countries may have different data-protection laws than your home country. Where required, we use appropriate safeguards (such as standard contractual clauses or provider certifications) for cross-border transfers.
7. Retention
We keep information only as long as needed for the purposes described above:
- Order & payment records — typically for the period required for accounting, tax, chargebacks, warranties, and legal claims (often several years)
- Uploaded photos & generated artwork — retained as needed to produce, reprint, and support your order, then deleted or anonymized on a rolling schedule unless you ask us to delete sooner and we are not required to keep them
- Support tickets & emails — for as long as needed to resolve your request and maintain service history, unless you ask us to delete and we are not required to retain them
- Analytics — according to our analytics provider retention settings
- Marketing lists — until you unsubscribe or we delete inactive contacts
8. Security
We use administrative, technical, and organizational measures designed to protect personal information (including HTTPS and restricted access to order systems). No method of transmission or storage is 100% secure. If we become aware of a breach that requires notice under applicable law, we will notify you and/or regulators as required.
9. Your rights & choices
Depending on where you live, you may have rights to:
- Access / know what personal information we hold about you
- Correct inaccurate information
- Delete information (subject to legal exceptions)
- Export / portability of information you provided
- Opt out of marketing emails (unsubscribe link in every marketing message)
- Opt out of sale/sharing for advertising (see above)
- Object to or restrict certain processing, or withdraw consent where processing is consent-based
To exercise these rights, email hi@zuzupal.com. We may need to verify your identity (for example, confirming control of the order email). We will respond within the time required by law (generally 30–45 days, extendable where permitted).
If you are in the EEA/UK and have concerns, you may also contact your local data protection authority. If you are a California resident, you may designate an authorized agent to submit requests as allowed by the CCPA/CPRA.
We will not discriminate against you for exercising privacy rights.
10. Children’s privacy
The Site is not directed to children under 16 (or under 13 where that is the applicable standard), and we do not knowingly collect personal information from children. If you believe a child provided information, contact us and we will delete it.
11. Third-party links
The Site may link to third-party websites or services. Their privacy practices are their own. Review their policies before providing information to them.
12. Changes to this Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. For material changes, we may also provide additional notice (for example, a Site banner or email). Continued use of the Site after an update means you acknowledge the revised Policy, except where consent is required by law for a specific change.