Privacy policy
Judy Shop — operated by Cerebra Marcom LLC. Effective 2026-09-17.
This policy explains what we collect when you visit or buy from judyshop.com, why we collect it, who else sees it, and what you can ask us to do about it.
The data controller is Cerebra Marcom LLC, 4283 Express Lane, Suite SA20688, Sarasota, FL 34249, USA. For any privacy request, email privacy@judyshop.com.
1. What we collect
You give us:
| Data | When | Why |
|---|---|---|
| Name, email, phone number | Checkout, account creation, newsletter signup, support messages | To take payment, ship your order, and answer you |
| Shipping and billing address (including the Saudi National Address where required) | Checkout | Carriers cannot deliver in Saudi Arabia without it |
| Order contents and history | Checkout | Fulfilment, returns, warranty, accounting |
| Product reviews, photos and ratings you submit | When you post them | To publish them on the product page |
| Support conversations | When you contact us | To resolve your issue and train our support quality checks |
Your payment card never reaches us. Card numbers go straight to Shopify Payments (Stripe), or PayPal, where offered. We see only the card brand, the last four digits, the expiry month and whether the charge succeeded.
We collect automatically:
- Device and browser type, operating system, language, screen size.
- IP address and the country it resolves to, used to pick your market, currency and language, and to screen for fraud.
- Pages you viewed, what you searched for, what you added to the cart, and where you arrived from.
- Cookie and similar identifiers — see section 5.
We do not collect government ID numbers, and we never ask for your card PIN, full card number or online-banking password. No one from Judy Shop will ever ask you for those.
2. Why we are allowed to process it
| Purpose | Basis |
|---|---|
| Taking and delivering your order | Performance of our contract with you |
| Fraud, chargeback and abuse screening | Our legitimate interest in not being defrauded |
| Marketing emails and SMS | Your consent; withdrawable at any time |
| Analytics and advertising measurement | Your consent where required, otherwise legitimate interest |
| Tax, accounting and customs records | Legal obligation |
3. Who we share it with
We share the minimum each party needs. We do not sell your personal data, and we do not share it with data brokers.
| Processor | What it receives | What for |
|---|---|---|
| Shopify (store platform) | Everything you submit on the site | Hosting the store, checkout, order records |
| Shopify Payments / Stripe | Name, email, billing address, card data you enter in their fields, order amount | Taking payment, fraud screening, refunds |
| CJ Dropshipping, Zendrop and their carriers (Aramex, iMile, DHL, local last-mile) | Recipient name, address, phone, parcel contents | Picking, packing and delivering your parcel, and customs clearance |
| Klaviyo | Name, email, order history, site activity | Order emails and, with your consent, marketing emails |
| Judge.me | Name, email, order details | Inviting you to review a purchase and hosting the review |
| Chatwoot (self-hosted by us) | Your support messages and contact details | Running the support inbox and chat widget |
| Meta, TikTok, Snapchat, Google | Hashed email and event data, only with your advertising consent | Measuring ads and showing you relevant ones |
| Cloudinary | Product and review images | Hosting images |
| Accountants, auditors, lawyers, and authorities where the law requires | As needed | Compliance |
4. Where your data goes
We are a United States business. Shopify, Stripe, Klaviyo, Judge.me and Cloudinary store data in the United States and the European Union. Our suppliers and carriers are in the UAE, Saudi Arabia, China and the United States.
So if you are in the GCC, the EU or the UK, your data leaves your country. Where the law requires a transfer safeguard, we rely on the processor's Standard Contractual Clauses or its equivalent approved mechanism. You can ask us for the detail at privacy@judyshop.com.
5. Cookies and tracking
We use three kinds:
- Essential — cart, checkout, login, language and currency, fraud screening. These cannot be switched off; the store does not work without them.
- Analytics — how the store is used, in aggregate.
- Advertising — Meta Pixel, TikTok Pixel, Snap Pixel, and Google tags, which measure whether an ad led to a purchase and let us show you ads elsewhere.
Analytics and advertising cookies load only after you accept them in the consent banner. You can change or withdraw your choice at any time from the "Cookie preferences" link in the footer. Declining costs you nothing: the store works identically.
You can also block cookies in your browser, and use the opt-outs inside your Meta, TikTok, Snapchat and Google ad settings.
6. Marketing
We email you about your order regardless — that is part of the contract.
Marketing email and SMS go only to people who opted in. Every marketing message has a one-click unsubscribe, and we act on it immediately. Unsubscribing from marketing does not stop order and delivery notifications.
7. How long we keep it
| Data | Retention |
|---|---|
| Order, invoice and tax records | 7 years from the order, as tax law requires |
| Account and marketing profile | Until you ask us to delete it, or after 3 years of no activity |
| Support conversations | 2 years |
| Reviews | Until you ask us to remove them |
| Analytics and advertising identifiers | 14 months maximum |
| Card data | We never hold it |
8. Your rights
Wherever you are, you can ask us to:
- Tell you what we hold about you, and give you a copy.
- Correct anything wrong.
- Delete your data — we will, except records we must keep for tax or for an open dispute.
- Stop marketing to you.
- Withdraw consent for analytics and advertising.
- Port your data to another service in a machine-readable format.
- Object to processing based on legitimate interest.
Email privacy@judyshop.com. We answer within 30 days and we do not charge for it. We may ask you to confirm your identity first — usually by replying from the email address on the order.
Specific regimes that may apply to you:
- UAE — Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
- Saudi Arabia — the Personal Data Protection Law and its implementing regulations.
- EU / UK — GDPR and UK GDPR, including the right to complain to your national supervisory authority.
- California — CCPA/CPRA, including the right to know, delete, correct, and to opt out of "sharing" for cross-context behavioural advertising. We do not sell personal information for money.
9. Security
Traffic to judyshop.com is encrypted with TLS. Payment pages are hosted by our payment providers and are PCI DSS compliant. Access to the store admin is limited to the owner and protected by two-factor authentication. Automated systems that handle orders operate on least-privilege credentials and cannot export customer lists.
No system is perfectly secure. If a breach ever affects your personal data, we will notify you and the relevant regulator as the law requires.
10. Children
Judy Shop is not for children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, email privacy@judyshop.com and we will delete it.
11. Automated decisions
We use automated fraud screening at checkout, which can flag or decline an order. Nothing else is decided about you automatically. If an order of yours is declined and you think it is wrong, email us and a human will review it.
12. Changes
If we change this policy we update the effective date above and, for a material change, email everyone on our list. The current version always lives at judyshop.com/policies/privacy-policy.
13. Contact
privacy@judyshop.com for privacy and data rights. support@judyshop.com for orders.
Cerebra Marcom LLC, 4283 Express Lane, Suite SA20688, Sarasota, FL 34249, USA