Privacy Policy

1. Introduction

This Privacy Policy describes how GTA Merch Store ("we", "us", or "our") collects, uses, and shares your personal information when you visit our website or make a purchase. We are committed to protecting your privacy in accordance with applicable data protection laws including GDPR, CCPA/CPRA, and PIPEDA.

2. Information We Collect

3. How We Use Your Information

• Order fulfillment: Process and ship your orders, send order confirmations and shipping updates
• Customer support: Respond to your inquiries and resolve issues
• Service improvement: Analyze usage patterns to improve our website and product offerings
• Marketing: Send promotional emails if you've opted in (you can unsubscribe anytime)
• Legal compliance: Meet our legal obligations, including tax and regulatory requirements
• Fraud prevention: Detect and prevent fraudulent transactions

4. How We Share Your Information

We share your information only as necessary to fulfill our services:

• Production partners: Your shipping address and order details are shared with our print-on-demand production facilities to fulfill your order
• Payment processor: Stripe processes all payments securely. We never have access to your full card number
• Shipping carriers: Your shipping address is shared with carriers (USPS, UPS, FedEx, DHL) for delivery
• Analytics: We use analytics tools to understand how our site is used (aggregated, non-identifying data)

We do not sell your personal information to third parties.

5. Cookies & Tracking

We use cookies for:

• Essential cookies: Required for the site to function (cart, session, currency preference)
• Analytics cookies: Help us understand site usage and improve our service
• Marketing cookies: Track the effectiveness of our advertising (only with your consent)

You can control cookies through your browser settings. Disabling essential cookies may affect site functionality.

6. Data Retention

• Order data: Retained for up to 10 years for tax and legal compliance
• Account data: Retained until you request deletion, plus 30 days for processing
• Analytics data: Retained for up to 26 months
• Support communications: Retained for up to 3 years

7. Data Security

We implement industry-standard security measures to protect your data, including SSL/TLS encryption for all data in transit, secure server infrastructure, and strict access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Request your data in a portable format
• Opt-out: Unsubscribe from marketing communications at any time
• Do Not Sell (CCPA): We do not sell personal information

To exercise any of these rights, please contact us.

9. International Data Transfers

Our production facilities are located in the United States. If you are ordering from outside the US, your personal data will be transferred to the US for order processing and fulfillment. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

10. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please reach out through our contact page.