Privacy Policy

Effective May 19, 2026 · Last updated May 19, 2026

This Privacy Policy describes how Sole Obsession Ecommerce Ltd ("we", "us", "our") collects, uses, and shares personal information when you use sole-obsession.com (the "Service"). We are a UK company with US operational mailing address in Wilmington, Delaware.

1. Information We Collect

From buyers:

• Account info — email, password (hashed), display name, date of birth (for 18+ verification).
• Order info — shipping address, billing address, items purchased, total amount paid, sales tax collected.
• Payment info — processed by Stripe; we do not store full card numbers. Stripe retains card data per its own privacy policy.
• Device info — IP address, browser type, device type, referring URL.
• Cookies and similar technology — essential cookies for login, analytics cookies (Google Analytics 4) when consented.

From sellers (additionally):

• Identity verification data — government-issued ID image, live selfie, biometric matching score (processed by Didit on our behalf for KYC).
• Stripe Connect Express data — legal name, date of birth, SSN (or EIN), US bank account routing and account numbers, address. This data goes directly to Stripe; we do not store sensitive financial identifiers.
• Listing info — listing photos, descriptions, prices, shipping origin (kept private; never shown to buyers).

2. How We Use Information

• To operate the Service, including processing payments, fulfilling orders, and providing customer support.
• To verify seller identity (via Didit) and prevent fraud.
• To collect and remit marketplace sales tax (via Stripe Tax) in states where we are registered.
• To send transactional emails about your account, orders, and the Service.
• To send marketing emails (with your consent; you can opt out anytime).
• To analyze Service usage and improve performance, with analytics cookies you have consented to.
• To comply with legal obligations, court orders, and lawful requests.

3. Third Parties We Share Data With

We do not sell personal information for commercial purposes.

4. Your Rights Under California Law (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you specific rights regarding your personal information:

• Right to know — you can request what personal information we have collected about you.
• Right to delete — you can request deletion of your personal information, subject to certain exceptions (e.g., we may retain order history for tax and audit purposes).
• Right to correct — you can request correction of inaccurate information.
• Right to opt-out of sale or sharing — we do not sell your personal information, but you can opt out of any sharing for cross-context behavioral advertising via the link below.
• Right to limit use of sensitive personal information — you can request that we limit the use of your sensitive personal information (e.g., biometric identifiers, account credentials).
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

Do Not Sell or Share My Personal Information: We do not sell your personal information. To exercise other CCPA/CPRA rights, email privacy@sole-obsession.com with the subject line "California Privacy Request".

5. Your Rights Under Other US State Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy laws have similar rights. To exercise these rights, email privacy@sole-obsession.com and specify your state of residence.

6. Data Retention

We retain personal information for as long as your account is active, plus periods required by US tax law (typically 7 years for transactional records) and applicable IRS / state revenue agency requirements. Seller identity-verification records are retained per AML/KYC best-practice retention windows. You can request account deletion at any time, subject to legal retention obligations.

7. Security

We use industry-standard technical and organizational measures to protect personal information, including TLS encryption in transit, encrypted storage, and role-based access controls. No system is perfectly secure; we cannot guarantee absolute security.

8. Children's Privacy

The Service is intended for adults 18 and older. We do not knowingly collect personal information from individuals under 18. If we learn we have collected information from a minor, we will delete it. Contact privacy@sole-obsession.com if you believe a minor has used the Service.

9. Cookies and Tracking

We use essential cookies (required for login and order flow) and, with your consent, analytics cookies (Google Analytics 4). You can manage cookie preferences via your browser settings. Most browsers honor "Do Not Track" signals; we do not currently respond differently to such signals.

10. International Transfers

Personal information may be transferred to and processed in the United States, the United States, and other countries where our service providers operate. The UK and EU adequacy frameworks apply to transfers between the US and our UK parent entity.

11. Changes

We may update this Privacy Policy. Material changes will be communicated by email or via a prominent notice on the Service. The "Last updated" date at the top reflects the most recent revision.

12. DMCA Notices

To report copyright infringement, send a written notice complying with 17 U.S.C. § 512(c)(3) to:

DMCA Agent — Sole Obsession Ecommerce Ltd
US mailing address: [iPostal1 Wilmington, Delaware address — to be finalized]
Email: dmca@sole-obsession.com

13. Contact

Privacy-related questions: privacy@sole-obsession.com
General support: support@sole-obsession.com
Sole Obsession Ecommerce Ltd, UK Co. No. 17019850.