Privacy Policy

Section 01

Overview

Kepher Fashion ("Kepher," "we," "us," or "our") operates the website located at kepher.co (the "Site") and provides fashion products and related services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Site or make a purchase from us.

By accessing or using our Site, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Site.

Section 02

Information We Collect

Information You Provide Directly

We collect information you voluntarily provide when you:

• Create an account — name, email address, username, and password
• Place an order — name, billing address, shipping address, phone number, and email address. Payment information (credit/debit card details) is processed directly by Stripe and is never stored on our servers
• Subscribe to our email list — email address and any preferences you provide
• Opt into SMS marketing — mobile phone number and consent confirmation
• Contact us — name, email address, and the content of your message
• Submit a product review — name, email address, and review content
• Participate in promotions — name, email, and any additional information requested

Information Collected Automatically

When you visit our Site, we and our third-party partners automatically collect certain technical and behavioral information, including:

• Device information — IP address, browser type, operating system, device identifiers
• Usage data — pages viewed, time spent, links clicked, referring URLs, exit pages
• Location data — general geographic location derived from your IP address (not precise GPS)
• Cookie data — see Section 5 for full details on cookies and tracking technologies
• Transaction data — purchase history, abandoned cart data, wishlist activity

Information from Third Parties

We may receive information about you from third-party sources, including:

• Social media platforms (e.g., Instagram, TikTok) if you interact with our brand accounts or use social login features
• Payment processors confirming transaction status
• Fraud prevention and identity verification services
• Marketing partners, to the extent permitted by applicable law

Section 03

How We Use Your Information

We use the information we collect for the following purposes:

To Fulfill Orders & Provide Services

• Process and fulfill your purchases, including coordinating with print-on-demand production partners
• Send order confirmations, shipping notifications, and delivery updates
• Process returns, exchanges, and refunds
• Respond to customer service inquiries
• Prevent and detect fraud

To Improve Our Site & Services

• Analyze site traffic, user behavior, and purchase patterns using Google Analytics
• Conduct A/B testing to improve user experience
• Understand which products and content resonate with our audience
• Fix bugs and improve site performance

To Communicate With You

• Send marketing emails to subscribers (with your consent and with easy unsubscribe options)
• Send SMS messages to opted-in subscribers (with your express written consent)
• Notify you about new collections, limited drops, and exclusive offers
• Send transactional messages required to fulfill your orders

Legal Basis for Processing

We process your personal information on the following legal bases:

• Contract performance — to fulfill orders you have placed with us
• Legitimate interests — to improve our services, prevent fraud, and conduct analytics
• Consent — for marketing communications, cookies, and SMS messaging
• Legal obligation — to comply with applicable laws and regulations

Section 04

Third-Party Services We Use

We partner with carefully selected third-party services to operate our business. Each service receives only the minimum data necessary for its specific function. We do not authorize any third-party service to use your data for their own marketing or to sell your information to others.

Section 05

Cookies & Tracking Technologies

We use cookies and similar tracking technologies (pixel tags, web beacons, local storage) to enhance your experience on our Site, analyze performance, and deliver relevant content.

Types of Cookies We Use

• Strictly Necessary Cookies — Required for the Site to function. These include session cookies, cart persistence, and authentication tokens. These cannot be disabled without impairing Site functionality.
• Performance & Analytics Cookies — Used by Google Analytics to collect anonymized information about how visitors use our Site. No personally identifiable information is collected through these cookies.
• Functional Cookies — Remember your preferences such as language, currency, and recently viewed items to improve your experience.
• Marketing Cookies — Used to deliver advertisements and track campaign effectiveness. These are only set with your explicit consent.

Managing Cookies

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our Site. To opt out of Google Analytics tracking specifically, you may install the Google Analytics Opt-out Browser Add-on.

Section 06

Email & SMS Marketing

Email Marketing

When you subscribe to our email list (the "Kepher Codex"), you consent to receive marketing emails from Kepher Fashion including new collection announcements, limited drop notifications, brand stories, and exclusive offers.

• You may unsubscribe at any time by clicking "Unsubscribe" in any email we send
• We honor unsubscribe requests within 10 business days
• Transactional emails (order confirmations, shipping notifications) are sent regardless of marketing preference as they are necessary to fulfill your order
• We comply with the CAN-SPAM Act and include our physical mailing address in all commercial emails

SMS Marketing

By providing your mobile phone number and opting in to SMS marketing, you provide express written consent to receive recurring automated marketing text messages from Kepher Fashion, including new arrivals, limited drops, and promotional offers. Consent is not a condition of any purchase.

• Message frequency varies. You may receive up to 4 messages per month
• To opt out: Reply STOP to any text message at any time. You will receive a single confirmation and no further messages
• For help: Reply HELP to any message or contact us at the address in Section 15
• Message and data rates may apply depending on your mobile carrier and plan
• We comply with the Telephone Consumer Protection Act (TCPA) and applicable state laws
• We do not share your mobile number with third parties for their own marketing purposes

Section 07

Data Security

We implement industry-standard technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and our Site (HTTPS)
• Payment data processed exclusively through Stripe's PCI-DSS Level 1 compliant infrastructure — your card details never touch our servers
• Access controls limiting employee access to personal data on a need-to-know basis
• Regular security assessments of our systems and third-party integrations
• Secure hosting via Vercel with automatic security patches and DDoS protection

Section 08

Data Retention

We retain your personal information only as long as necessary for the purposes outlined in this policy or as required by applicable law. Our general retention schedules are:

• Account information — retained for the life of your account plus 2 years after account closure, or as required by tax law
• Order records — retained for 7 years to comply with federal and state tax and accounting requirements
• Email marketing data — retained until you unsubscribe; dormant subscribers purged after 3 years of inactivity
• SMS marketing data — retained until you opt out; immediately suppressed upon STOP request
• Customer support communications — retained for 2 years
• Analytics data — Google Analytics data is retained for 14 months per our GA4 configuration
• Payment records — Stripe retains payment records per their own retention policy for fraud prevention and legal compliance

Upon request, and subject to legal obligations that require us to retain certain data, we will delete your personal information. See Section 9 for how to submit a deletion request.

Section 09

Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal information. To exercise any of these rights, please contact us as described in Section 15.

• Right to Access — Request a copy of the personal information we hold about you
• Right to Correction — Request that we correct inaccurate or incomplete personal information
• Right to Deletion — Request that we delete your personal information, subject to legal retention requirements
• Right to Portability — Request your personal information in a structured, machine-readable format
• Right to Opt-Out of Marketing — Unsubscribe from email marketing at any time; opt out of SMS by replying STOP
• Right to Restrict Processing — Request that we limit how we use your personal information in certain circumstances
• Right to Object — Object to our processing of your personal information based on legitimate interests
• Right to Withdraw Consent — Where processing is based on consent, withdraw that consent at any time without affecting prior processing

We will respond to verifiable requests within 45 days. In complex cases, we may extend this period by an additional 45 days with notice to you. We will not discriminate against you for exercising any of these rights.

Section 10

California Residents — CCPA / CPRA

California If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information. This section describes those rights and how to exercise them.

Categories of Personal Information We Collect

In the preceding 12 months, we have collected the following categories of personal information from California consumers:

• Identifiers — name, email address, IP address, mailing address, phone number
• Commercial information — purchase history, products viewed, cart activity
• Internet/network activity — browsing history on our Site, interaction with ads
• Geolocation data — general location derived from IP address only
• Inferences — preferences and interests derived from your interactions with our Site

Do We "Sell" or "Share" Personal Information? Your CCPA/CPRA Rights

• Right to Know — Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, our business purposes, and the categories of third parties we share it with
• Right to Delete — Request deletion of personal information we collected from you, subject to exceptions
• Right to Correct — Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing — Opt out of the sale or sharing of your personal information. Use our Do Not Sell or Share My Personal Information page
• Right to Limit Use of Sensitive Personal Information — Limit how we use and disclose sensitive personal information
• Right to Non-Discrimination — We will not discriminate against you for exercising your CCPA rights

How to Submit a California Privacy Request

You may submit a verifiable consumer request by:

• Emailing us at privacy@kepher.co with the subject line "California Privacy Request"
• Visiting our Do Not Sell or Share My Personal Information page
• Writing to us at our business address on file

We will verify your identity before processing your request. You may designate an authorized agent to make requests on your behalf. We will respond within 45 calendar days. We may extend by an additional 45 days with written notice.

California Shine the Light Law

California Civil Code Section 1798.83 ("Shine the Light" law) permits California residents to request information about disclosures of personal information to third parties for direct marketing purposes. As stated in this policy, we do not disclose personal information to third parties for direct marketing purposes without your consent.

Section 11

Other State-Specific Privacy Rights

Several U.S. states have enacted comprehensive privacy laws granting residents specific rights regarding their personal information. If you are a resident of any of the following states, the rights described below apply to you in addition to the general rights in Section 9.

Virginia Virginia Consumer Data Protection Act (VCDPA)

Virginia residents have the right to access, correct, delete, and obtain a copy of their personal data, as well as the right to opt out of targeted advertising, the sale of personal data, and profiling for decisions that produce legal or similarly significant effects. To exercise these rights, contact us at privacy@kepher.co.

Colorado Colorado Privacy Act (CPA)

Colorado residents have rights to access, correct, delete, and obtain a portable copy of personal data, as well as the right to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling.

Connecticut Connecticut Data Privacy Act (CTDPA)

Connecticut residents have similar rights to access, correct, delete, and port personal data, and to opt out of targeted advertising and the sale of personal data.

Texas Texas Data Privacy and Security Act (TDPSA)

Texas residents have rights to access, correct, delete, and obtain a copy of personal data, and to opt out of the processing of personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects.

Nevada Nevada SB 220

Nevada residents may opt out of the sale of their personally identifiable information to third parties. As noted throughout this policy, Kepher Fashion does not sell personal information. Nevada residents may still submit an opt-out request by emailing privacy@kepher.co.

New York SHIELD Act

New York residents are protected under the SHIELD Act, which requires us to implement reasonable safeguards for private information. We comply with these requirements through the security measures described in Section 7.

All Other States

Additional state privacy laws are evolving rapidly. Regardless of your state of residence, you may contact us at privacy@kepher.co to exercise any privacy rights you believe apply to you. We will respond in good faith and in accordance with applicable law.

Section 12

Children's Privacy — COPPA

We comply with the Children's Online Privacy Protection Act (COPPA). If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will take immediate steps to delete that information from our records.

If you are a parent or guardian and believe that your child under 13 has provided personal information to us, please contact us immediately at privacy@kepher.co so that we can take appropriate action.

For users between the ages of 13 and 18, we recommend that a parent or guardian review this Privacy Policy. By using our Site, users between 13 and 18 represent that their parent or guardian has reviewed and agreed to this policy.

Section 13

International Users

Kepher Fashion is based in the United States. If you are accessing our Site from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we note that such transfers are made pursuant to appropriate safeguards, including Standard Contractual Clauses where applicable. We process EEA personal data on the legal bases described in Section 3 and in accordance with applicable GDPR requirements.

EEA, UK, and Swiss residents have the right to lodge a complaint with their local data protection authority if they believe their personal data has been processed unlawfully.

Section 14

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on our homepage for material changes
• Send an email notification to subscribers when changes materially affect how we use their personal information

We encourage you to review this Privacy Policy periodically. Your continued use of our Site after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with any changes, please stop using our Site and contact us to close your account and request deletion of your data.

Section 15

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through any of the following methods. We are committed to addressing your inquiry promptly and in good faith.

We will respond to all privacy-related inquiries within 45 days. For urgent matters, please include "URGENT" in your email subject line.