Privacy Policy

1. Data Controller

ITZCULTURE, Inc. ("Platform," "we," "us," "our") is the data controller for personal information collected through itzculture.com. We are committed to protecting your privacy and handling your data transparently.

Contact: privacy@itzculture.com

2. Information We Collect

Information You Provide Directly:

• Account Data: Name, email address, phone number, password (stored as a bcrypt hash, never in plaintext)
• Profile Data: Display name, avatar, bio, social media links
• Transaction Data: Shipping address, billing address, order history, payment method type (card details are tokenized and processed by Stripe — we never store full card numbers)
• Communications: Messages you send through the platform, support tickets, feedback
• Seller Data: Business name, tax identification number (for verified sellers), bank account details (stored exclusively by Stripe Connect)

Information Collected Automatically:

• Device Data: IP address, browser type and version, operating system, device identifiers, screen resolution
• Usage Data: Pages viewed, products clicked, search queries, time spent on pages, referring URLs
• Location Data: Approximate location derived from IP address (we do not use GPS tracking)
• Cookie Data: Session identifiers, preferences, analytics tokens (see our Cookie Policy)

3. How We Use Your Data

We process your personal information for the following purposes:

• Process and fulfill orders, including payment processing and shipping coordination
• Create and manage your account
• Personalize product recommendations and search results based on browsing history
• Prevent fraud, detect suspicious activity, and enforce platform policies
• Send transactional communications (order confirmations, shipping updates, delivery notifications)
• Send marketing communications (opt-in only; you may unsubscribe at any time)
• Improve platform performance, features, and user experience
• Respond to your inquiries and provide customer support
• Comply with legal obligations, including tax reporting and law enforcement requests
• Generate anonymized, aggregate analytics about platform usage

Legal Bases for Processing (GDPR): Contract performance (orders, account management), legitimate interest (fraud prevention, platform improvement), consent (marketing), and legal obligation (tax compliance).

4. Data Sharing

We share your data only with the following categories of recipients:

• Stripe, Inc.: Payment processing (PCI-DSS Level 1 certified). Stripe receives your payment card details directly and provides us only with tokenized references.
• Amazon Web Services (AWS): Cloud infrastructure, email delivery (SES), image and file storage (S3). Data is encrypted at rest and in transit.
• Sellers: When you place an order, the seller receives your name, shipping address, and email address solely for order fulfillment purposes.
• Shipping Carriers: Name and address for delivery when sellers use integrated shipping label generation.
• Analytics Providers: Anonymized, non-personally-identifiable usage data for platform improvement.
• Law Enforcement: When required by valid legal process (subpoena, court order, or statutory requirement).

We never sell your personal data to third parties. We do not share data with advertisers or data brokers. We do not participate in ad networks or cross-site tracking.

5. Data Retention

• Account data: Retained while your account is active, plus 30 days after deletion request to allow recovery
• Order records: 7 years (required for tax compliance and legal obligations)
• Behavioral/usage data: 12 months in identifiable form, then permanently anonymized
• Support tickets: 3 years from resolution
• Marketing consent records: Retained for the duration of consent plus 3 years
• Server logs: 90 days, then deleted

6. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of Access: Request a complete copy of all personal data we hold about you
• Right to Correction: Update or correct inaccurate information
• Right to Deletion: Request permanent deletion of your account and associated data (subject to legal retention requirements)
• Right to Portability: Receive your data in a structured, machine-readable format (JSON or CSV)
• Right to Restrict Processing: Limit how we use your data while a dispute is resolved
• Right to Object: Object to processing based on legitimate interest
• Right to Opt-Out of Sale: Under CCPA, you may opt out of the "sale" of personal information (note: we do not sell data)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise any of these rights, email privacy@itzculture.com with your request. We will verify your identity and respond within 30 days (45 days for complex requests, with notice). You may also designate an authorized agent to make requests on your behalf.

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know what personal information is collected, used, and shared
• Right to delete personal information held by us and our service providers
• Right to opt-out of the sale or sharing of personal information
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

We do not sell or share personal information as defined under CCPA/CPRA. In the preceding 12 months, we have collected the categories of information described in Section 2 above.

8. International Transfers

Your data is processed and stored in the United States. If you are located outside the US, by using the Platform you consent to the transfer of your data to the United States. We implement appropriate safeguards including encryption and contractual protections with our service providers.

For EU/EEA/UK users: transfers are made pursuant to Standard Contractual Clauses approved by the European Commission.

9. Security

We implement industry-standard security measures to protect your data:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Bcrypt password hashing with appropriate work factors
• Rate limiting and brute-force protection
• Regular penetration testing and security audits
• Role-based access controls for internal systems
• Two-factor authentication available for all accounts

No system is 100% secure. In the event of a data breach affecting your personal information, we will notify you and applicable regulators within 72 hours as required by law.

10. Children's Privacy

The Platform is not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a person under 18, we will delete it immediately. If you believe a minor has provided us with personal information, please contact privacy@itzculture.com.

11. Do Not Track

We honor Do Not Track (DNT) signals sent by your browser. When DNT is enabled, we disable optional analytics and behavioral tracking.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 30 days before taking effect. The "Last revised" date at the top of this page indicates when the policy was most recently updated. Continued use of the Platform after the effective date constitutes acceptance of the revised policy.

13. Contact Us

For privacy-related inquiries, data requests, or complaints:

ITZCULTURE, Inc.
Email: privacy@itzculture.com
Legal Department: legal@itzculture.com

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.