Privacy Policy

This Privacy Policy explains how Katerina Kralina, a sole proprietor doing business as DREADSCULT (“DREADSCULT”, “we”, “us”), handles personal information when you visit dreadscult.com (the “Site”), place an order, or contact us. It is written to meet the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §§ 22575–22579) and, where they apply to us, the California Consumer Privacy Act as amended by the CPRA.

1. Personal information we collect

We collect the categories below, and nothing beyond them. All of it comes either directly from you or automatically from your browser when you load a page.

• Identifiers and order information — your name, email address, phone number, shipping address, billing address, order number, and the items in your order. Collected at checkout.
• Commercial information — the products you bought, order history, and any promotional or professional code you used.
• Messages and photos you send us — the contents of your emails, WhatsApp messages, and Instagram messages, including photographs of hair you send us for our free Color Matching Service.
• Pro Braider Program applications — your name, email, city, and the Instagram profile, portfolio link, licence, or business listing you submit for verification.
• Internet and network activity — your IP address, browser user agent, the pages you requested, and the time of the request. These are written to standard server logs by our hosting provider and web application firewall, and used to keep the Site running and to block abuse.

We do not collect or store payment card details. Card numbers are entered on a payment page operated by Stripe, Inc. and never reach our servers.

We do not collect biometric information, precise geolocation, government identifiers, or any of the categories of sensitive personal information defined by California law.

2. Why we use it

• To process, prepare, and ship your order, and to contact you about it.
• To answer your questions and help you choose a shade.
• To review Pro Braider Program applications and issue professional pricing codes.
• To handle returns, exchanges, refunds, and payment disputes.
• To detect fraud, prevent abuse of the Site, and keep it secure.
• To meet our tax, accounting, and other legal obligations.

We do not use your personal information for automated decision-making or profiling, and we do not use it for any purpose that is incompatible with the ones listed above.

3. Who we disclose it to

We disclose personal information only to the service providers we need to run the shop, and only the part of it they need to do their job. They are contractually or by their own terms limited to processing it on our behalf.

• Stripe, Inc. — payment processing, fraud prevention, and refunds. Stripe handles your card details as an independent controller under its own privacy policy.
• Shipping carriers — primarily the United States Postal Service, which receives the name and address needed to deliver your parcel.
• Our hosting, security, and email provider — GoDaddy, which stores the Site and its order records and delivers our order emails, and the web application firewall in front of the Site, which sees request data in order to block attacks.
• Web font providers — Fontshare and Google Fonts, which serve the typefaces used on the Site and therefore receive your IP address when a page loads. They are not used to track you.

We may also disclose information if the law or a valid legal process requires it, to protect our rights, safety, or property, or in connection with a merger or sale of the business, in which case this policy continues to apply to information transferred.

4. We do not sell or share your personal information

We have never sold personal information, and we do not share it for cross-context behavioral advertising as those terms are defined in the California Consumer Privacy Act. We also do not sell or share the personal information of consumers we know to be under 16. Because there is no sale or sharing, there is nothing for you to opt out of, and we publish no “Do Not Sell or Share My Personal Information” link.

California “Shine the Light” (Cal. Civ. Code § 1798.83). California residents may ask us once a year for a list of the third parties to whom we disclosed their personal information for those third parties’ own direct marketing purposes during the previous calendar year. We do not disclose personal information to third parties for their direct marketing purposes, so the list is empty. To make a request anyway, write to our designated contact: dreadscult.hair@gmail.com. Under Cal. Civ. Code § 1798.83 this email address is our designated contact for such requests.

5. Cookies, tracking, and Do Not Track

We do not use advertising, analytics, or cross-site tracking cookies. The Site keeps your shopping cart in your own browser’s local storage so it survives a page reload; that data stays on your device and is never transmitted to us. Stripe sets its own cookies on its payment page, which are strictly necessary for the payment to complete and to detect fraud.

Do Not Track. Some browsers send a “Do Not Track” (DNT) or Global Privacy Control signal. Because we do not track visitors across third-party websites or over time, there is nothing for such a signal to switch off, and we do not respond to DNT signals differently from any other request. Our behaviour is the same whether or not you send one.

Third-party tracking. To the best of our knowledge, no third party collects personally identifiable information about your online activities over time and across different websites when you use the Site. Links to Instagram, WhatsApp, and Stripe take you to services that have their own tracking practices and their own privacy policies, which we do not control.

6. Email, messages, and marketing

We send you transactional messages about an order you have placed — confirmation, tracking, and answers to your questions. These are not marketing and you cannot unsubscribe from them while an order is open.

If you join a waitlist or ask us to tell you when something launches, we will use your email only for that purpose. Every commercial message we send will identify us, include our postal address, and carry a working unsubscribe link, as required by the CAN-SPAM Act; we act on unsubscribe requests within ten business days.

7. How long we keep it

• Order and payment records — for as long as US tax, accounting, and chargeback rules require, normally seven years.
• Messages and Color Matching photos — only while they are useful for helping you, and deleted on request.
• Pro Braider applications — while the professional account is active, then deleted.
• Server and firewall logs — short-term, per our providers’ own retention.

8. Your rights and how to use them

You can ask us at any time to tell you what personal information we hold about you and why, to give you a copy of it, to correct it, or to delete it. Write to dreadscult.hair@gmail.com with enough detail for us to find your record — normally the email address or order number you used. We respond within 45 days, and we will never treat you worse for exercising a privacy right.

We may need to keep information that we are legally required to retain, such as completed order records, even after a deletion request; in that case we tell you what we kept and why. If we cannot verify that a request comes from you or an authorised agent, we will say so rather than act on it.

California residents. The California Consumer Privacy Act, as amended by the CPRA, gives residents the right to know, to delete, to correct, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and not to be retaliated against for exercising those rights. We honour these requests whether or not the CCPA legally applies to a business of our size, using the same contact address above. As explained in section 4, we do not sell or share personal information and do not collect sensitive personal information, so the opt-out and limitation rights have nothing to act on.

Visitors from outside the United States. We ship only within the United States and our servers are located there, so information you send us is processed in the US. If you contact us from the EU, the UK, or another jurisdiction with data protection law, you may also ask us to restrict processing or to export your data in a portable form, and we will comply.

9. Security

The Site is served over HTTPS with a valid certificate, payments run entirely on Stripe’s infrastructure, and order records are stored outside the public web root where the web server cannot serve them. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you as required by California Civil Code § 1798.82.

10. Children

The Site is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, write to us and we will delete it promptly.

11. Changes to this policy

If we change this policy we will update the effective date at the top of this page and post the new version here. If a change is material, we will say so prominently on the Site for at least 30 days, and, where we have your address and the law requires it, by email. Continuing to use the Site after a change means you accept the updated policy.