Privacy Policy
Katura 1999 ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or make a purchase.
Quick Summary
- ✓We never sell your personal data
- ✓Payment data secured by Stripe (PCI DSS Level 1)
- ✓You can delete your account anytime
- ✓CCPA, GDPR, and LGPD compliant
- ✓Opt out of marketing anytime
- ✓No tracking of children under 16
- ✓Data encrypted in transit and at rest
- ✓No automated decision-making on orders
Introduction
Katura 1999 ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or make a purchase.
This Privacy Policy ("Policy") applies to all personal data collected by October Skies Benediction LLC, doing business as Katura 1999 ("Katura," "we," "us," or "our"), a South Carolina limited liability company, through:
- Our website at katura1999.com and all subdomains
- Our mobile applications (iOS and Android)
- Email and SMS communications
- In-person consultations, showroom visits, and jewelry repair services
- Third-party marketplaces where Katura products are sold
- Social media pages operated by Katura
By using our Services, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please do not use our Services. This Policy is incorporated into and subject to our Terms of Service.
Information We Collect
Information You Provide Directly
We may collect personal information that you voluntarily provide to us when you:
- Account Information: Name, email address, phone number, password (hashed with bcrypt)
- Purchase Information: Billing and shipping addresses, order history, ring sizes, engraving details
- Payment Information: Processed securely by Stripe — we never store full card numbers, CVV, or bank account details
- Communication Content: Support inquiries, reviews, consultation notes, custom design requests
- Identity Verification: Government-issued ID for high-value transactions (as required by anti-money laundering regulations)
- Wholesale Applications: Business name, tax ID, resale certificate, trade references
- Repair Requests: Item descriptions, photos, preferred repair timeline
Information Collected Automatically
When you visit our website, we may automatically collect certain information, including:
- Device Data: Device type, operating system, browser type and version, screen resolution
- Network Data: IP address (anonymized after 30 days), approximate geolocation (city-level only)
- Usage Data: Pages viewed, time spent, click patterns, search queries, referral source
- Cookie Data: Session identifiers, authentication tokens, locale and currency preferences
- Performance Data: Page load times, error logs (anonymized), API response metrics
Information from Third Parties
- Payment Processors: Transaction confirmation, fraud risk signals from Stripe
- Shipping Carriers: Delivery status, address verification results
- Analytics Providers: Aggregated demographic and interest data from Google Analytics
- Social Media: Public profile information if you log in with a social account
Sensitive Data: We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, or health information. If you voluntarily provide such information (e.g., in a custom design request), we will treat it with heightened protection.
How We Use Your Information
We use the information we collect to:
Order Fulfillment
Process purchases, send confirmations, arrange shipping, handle returns and exchanges
Account Management
Create and maintain your account, authenticate logins, manage your preferences
Customer Service
Respond to inquiries, process repair requests, provide consultations, resolve disputes
Fraud Prevention
Detect and prevent fraudulent transactions, chargebacks, and unauthorized account access
Marketing (with consent)
Send promotional emails, personalized offers, and new collection announcements — you can opt out anytime
Product Improvement
Analyze usage patterns to improve our website, mobile app, and product offerings
Legal Compliance
Meet tax reporting obligations, respond to lawful requests from authorities, enforce our Terms of Service
Security
Monitor for threats, maintain system integrity, and protect against cyberattacks
Lawful Basis for Processing (GDPR)
For individuals in the European Economic Area (EEA), United Kingdom, and Switzerland, we process personal data under the following lawful bases as defined by the GDPR:
Contract Performance (Art. 6(1)(b))
Order processing, account creation, shipping, returns, repair services
Legitimate Interests (Art. 6(1)(f))
Fraud prevention, analytics, security monitoring, product improvement. We balance our interests against your rights and freedoms.
Consent (Art. 6(1)(a))
Marketing emails, optional cookies, newsletter subscriptions. You may withdraw consent at any time without affecting the lawfulness of prior processing.
Legal Obligation (Art. 6(1)(c))
Tax reporting, anti-money laundering compliance, law enforcement requests, consumer protection obligations
International Data Transfers
Katura 1999 is based in Atlanta, Georgia, United States. Your data may be transferred to, stored, and processed in the United States and other countries where our service providers operate.
For transfers of personal data from the EEA, UK, or Switzerland to the United States, we rely on the following legal mechanisms:
- Standard Contractual Clauses (SCCs): Approved by the European Commission for international data transfers
- UK International Data Transfer Addendum: For transfers from the United Kingdom
- Data Processing Agreements: With all sub-processors, requiring equivalent protections
Our primary infrastructure providers (Vercel, Supabase, Stripe) maintain robust compliance programs and process data in accordance with applicable data protection regulations.
Brazil (LGPD): If you are located in Brazil, we comply with the Lei Geral de Proteção de Dados (LGPD). International transfers are conducted under appropriate safeguards, including standard contractual clauses and adequacy assessments as required by Brazil's National Data Protection Authority (ANPD).
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, or as required by law. Below are our specific retention periods:
Account Data
Account functionality, then grace period for accidental deletion recovery
Order & Transaction Records
Tax reporting, audit requirements, warranty claims (IRS requires 7-year retention)
Payment Card Data
PCI DSS compliance; Stripe retains data per their privacy policy
Customer Support Logs
Quality assurance, dispute resolution, legal claims
Marketing Preferences
Honoring opt-out requests
Analytics Data
Google Analytics default; IP addresses anonymized after 30 days
Server Logs
Security monitoring, debugging, performance analysis
Repair Service Records
Warranty tracking, quality assurance, repeat service reference
Wholesale / B2B Records
Tax, compliance, ongoing trade account management
After the applicable retention period, data is securely deleted or anonymized so that it can no longer be associated with you. Anonymized data may be retained indefinitely for statistical purposes.
Data Security
We implement appropriate technical and organizational measures to protect your personal information. However, no method of transmission over the Internet is 100% secure.
We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:
TLS 1.3 Encryption
All data in transit encrypted with the latest TLS standard
AES-256 Encryption at Rest
Database and backups encrypted with AES-256
PCI DSS Level 1 (via Stripe)
We never store, process, or transmit cardholder data
Row-Level Security (RLS)
Database-level access controls on every table
SOC 2 Type II Infrastructure
Vercel and Supabase maintain SOC 2 Type II compliance
Bcrypt Password Hashing
Passwords are salted and hashed — never stored in plaintext
CSRF & XSS Protection
Cross-site request forgery tokens and content security policies
Rate Limiting
Brute-force protection on authentication and API endpoints
Breach Notification: In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify affected individuals within 72 hours of becoming aware of the breach (as required by GDPR Article 33), and promptly notify relevant supervisory authorities. We will also comply with all applicable U.S. state breach notification laws.
Your Rights
Depending on your location, you have specific rights regarding your personal data. We honor these rights regardless of where you live, to the extent commercially practicable:
Right of Access
Request a copy of the personal data we hold about you
Right to Rectification
Request correction of inaccurate or incomplete personal data
Right to Erasure
Request deletion of your personal data ("right to be forgotten")
Right to Restrict Processing
Request that we limit how we use your data while a dispute is resolved
Right to Data Portability
Receive your data in a structured, machine-readable format (JSON or CSV)
Right to Object
Object to processing based on legitimate interests, including profiling
Right to Withdraw Consent
Withdraw consent for marketing or optional data processing at any time
Right to Opt Out of Sale
We do not sell personal data, but you may still submit a formal opt-out request
Right to Non-Discrimination
Exercise your privacy rights without receiving different pricing or service quality
To exercise any of these rights, email legal@katura1999.com with the subject line "Privacy Rights Request." We will verify your identity and respond within 30 days (extendable by 60 days for complex requests, with notice).
California Residents (CCPA/CPRA): You have the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell or share personal information as defined by the CCPA. You may designate an authorized agent to make requests on your behalf. We will not discriminate against you for exercising your CCPA rights.
EU / EEA / UK Residents (GDPR / UK GDPR): You have the right to lodge a complaint with your local supervisory authority if you believe we have violated data protection law. For EU residents, you may contact the data protection authority in your country of residence. For UK residents, contact the Information Commissioner's Office (ICO) at ico.org.uk.
Brazil Residents (LGPD): You have the right to confirmation of processing, access, correction, anonymization, portability, deletion of data processed with consent, information about shared data, and the right to revoke consent. Complaints may be filed with Brazil's National Data Protection Authority (ANPD).
Do Not Track Signals
Some browsers transmit a "Do Not Track" (DNT) signal. There is currently no uniform standard for interpreting DNT signals. However, when we detect a DNT signal, we:
- Disable non-essential analytics cookies
- Do not load the Meta Pixel or marketing tags
- Continue to use strictly necessary cookies required for site functionality
We also support the Global Privacy Control (GPC) signal. When we detect a GPC signal, we treat it as a valid opt-out of the sale or sharing of personal information under CCPA/CPRA.
Children's Privacy
Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at legal@katura1999.com.
If we discover that we have collected personal data from a child under 16 without verified parental consent, we will delete that data within 48 hours and notify the parent or guardian.
Automated Decision-Making & Profiling
We do not use automated decision-making (including profiling) that produces legal effects or similarly significantly affects you. Specifically:
- Order approvals and rejections are reviewed by human staff
- Credit decisions are not made by Katura — payment processing is handled by Stripe
- Product recommendations are based on non-personal, aggregated purchase patterns
- Fraud detection flags are always reviewed by a human before any action is taken
If we introduce automated decision-making in the future, we will update this Policy, provide meaningful information about the logic involved, and offer the right to contest decisions and obtain human review.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:
- Material Changes: We will email registered account holders at least 30 days before the changes take effect
- Minor Changes: We will update the "Last reviewed" date at the top of this Policy
- Continued Use: Your continued use of our Services after a change constitutes acceptance of the updated Policy
We encourage you to periodically review this Policy. The full revision history is available upon request by emailing legal@katura1999.com.
Dispute Resolution
If you have a concern about our privacy practices that we cannot resolve directly, you may pursue the following options:
- Direct Resolution: Contact us at legal@katura1999.com. We aim to resolve all privacy complaints within 30 days.
- Binding Arbitration: If we cannot reach a resolution, either party may elect binding arbitration administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules. Arbitration will be conducted in Charleston County, South Carolina, United States.
- Supervisory Authorities: EU/EEA residents may file complaints with their local data protection authority. UK residents may contact the ICO. Brazilian residents may contact the ANPD.
Class Action Waiver: To the fullest extent permitted by law, any disputes arising under this Policy shall be resolved on an individual basis. You agree to waive the right to participate in a class action, class-wide arbitration, or representative proceeding.
Contact Us & Data Protection Officer
For any privacy-related questions, data subject requests, or to exercise your rights under CCPA, GDPR, LGPD, or any other applicable privacy law:
Privacy & Legal
legal@katura1999.comData Protection Officer
dpo@katura1999.comGeneral Support
clientcare@katura1999.comResponse Time
30 days (GDPR/CCPA), 15 days (LGPD)
Mailing Address
October Skies Benediction LLC — Attn: Data Protection Officer
d/b/a Katura 1999
South Carolina, United States