1. Introduction

Derive (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and make purchases from our online store. By using our services, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect information that you provide directly to us, as well as information that is gathered automatically when you interact with our website.

Personal Information

• Account Information: When you create an account or sign in, we collect your email address. We use a passwordless authentication system — we do not store or process passwords.
• Order Information: When you place an order, we collect your name, shipping address, billing address, email address, and phone number.
• Payment Information: Payment details are processed directly by Stripe, our third-party payment processor. We store only the last four digits of your card number and card brand for order reference purposes. We never have access to your full card number.

Automatically Collected Information

• Usage Data: We collect information about how you interact with our website, including pages visited, products viewed, and actions taken.
• Device Information: Browser type, operating system, device type, screen resolution, and language preferences.
• Cookies and Local Storage: We use cookies and browser local storage to maintain your shopping cart, currency preferences, and session state.

3. How We Use Your Information

• Process and fulfill your orders, including shipping and delivery
• Send you order confirmations and shipping updates
• Manage your account and provide customer support
• Administer our loyalty rewards program and gift card promotions
• Send promotional emails and newsletters (only with your consent)
• Improve our website, products, and services
• Detect, prevent, and address fraud or technical issues
• Comply with legal obligations

4. Information Sharing

We do not sell, rent, or trade your personal information to third parties. We may share your information with the following service providers who assist us in operating our business:

• Stripe: For secure payment processing.
• Shipping Carriers: To deliver your orders.
• Supabase: For secure data storage and authentication.
• Hosting Providers: To serve our website reliably.

These providers are contractually obligated to use your information only to provide services to us and are required to maintain the confidentiality of your data.

5. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law. Order records are maintained for accounting and legal compliance. You may request deletion of your account and associated data at any time by contacting us.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (“right to be forgotten”).
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to the processing of your personal data for marketing purposes.
• Withdrawal of Consent: Withdraw consent for newsletter subscriptions at any time.

To exercise any of these rights, please contact us at privacy@deriveshop.com.

7. Cookies

Our website uses essential cookies and local storage to provide core functionality such as maintaining your shopping cart, remembering your currency preference, and keeping you signed in. We also use analytics cookies to understand how visitors interact with our website. You can control cookie settings through your browser preferences. Disabling essential cookies may affect the functionality of our website.

8. Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. All data transmitted between your browser and our servers is encrypted using TLS/SSL. Payment processing is handled entirely by Stripe, a PCI DSS Level 1 certified provider.

9. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child under 16, we will take steps to delete that information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised “Last updated” date. We encourage you to review this policy periodically.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Derive
Email: privacy@deriveshop.com