Privacy Policy – koruta.net

KORUTA PRIVACY POLICY

Last Updated: January 7, 2026

Koruta LLC (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://koruta.net (the “Site”).

We are a registered company in Delaware, USA, with operations managed from Montreal, Quebec, Canada. We comply with the privacy laws of the jurisdictions where our customers are located, including Quebec’s Law 25, the CCPA/CPRA (USA), and the GDPR.

1. COLLECTION OF PERSONAL INFORMATION

We collect information that you voluntarily provide to us or that is automatically collected when you use the Site.

A. Information You Provide to Us

We may collect the following personal data when you place an order, create an account, or contact support:

Contact & Identity: First name, last name, email address, phone number, shipping address, and billing address.
Payment Data: Credit card details are processed securely by third-party payment processors (such as PayPal, Stripe, Apple Pay, or Google Pay). We do not store full credit card numbers on our servers.
Comments & Reviews: When visitors leave comments or product reviews on the site, we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.
Profile Pictures (Gravatar): An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. After approval of your comment/review, your profile picture is visible to the public. The Gravatar service privacy policy is available here: https://automattic.com/privacy/.

B. Media & Uploads

If you upload images to the website (e.g., for a photo review of your jewelry), you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

C. Information Collected via Social Media

If you connect via Facebook, Instagram, or TikTok, we collect profile information (name, email, profile picture) permitted by your settings on that platform.

2. HOW WE USE YOUR INFORMATION

We use your information to fulfill orders, manage payments, prevent fraud, and comply with the law. Specifically, we use your data to:

Process and ship your jewelry orders from our US or Canadian warehouses.
Send you order confirmations, invoices, and shipping updates.
Screen for potential risk or fraud.
Send you marketing emails (only if you have opted-in).

Password Resets: For security purposes, if you request a password reset, your IP address will be included in the reset email.

3. COOKIES & TRACKING TECHNOLOGIES

We use cookies to improve your experience, manage your shopping cart, and for marketing purposes. For a full detailed list of every cookie we use, please refer to our dedicated Cookie Policy.

WordPress System Cookies

Login Cookies: If you visit our login page, we set a temporary cookie to check if your browser accepts cookies. When you log in, we set cookies to save your login info (lasts 2 days) and screen choices (lasts 1 year). If you select “Remember Me”, your login persists for two weeks.
Comment Cookies: If you leave a comment/review, you may opt-in to saving your name, email, and website in cookies. These last for one year for your convenience.

4. EMBEDDED CONTENT

Articles on this site may include embedded content (e.g., videos, images, articles). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content.

5. DATA RETENTION

Comments/Reviews: If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically.
Registered Users: We store the personal information provided in user profiles. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.
Transaction Data: Retained for at least 7 years for tax and legal auditing purposes (US and Canada).
Inactive Accounts: We may delete accounts that have been inactive for 3 years.

6. SHARING OF INFORMATION

We do not sell your data. We share it only with service providers needed to operate our business (e.g., Shipping carriers, Email Marketing platforms, Payment Processors, and Hosting providers) and to comply with the law. Visitor comments may be checked through an automated spam detection service.

7. REGIONAL RIGHTS (LAW 25, CCPA, GDPR)

A. QUEBEC (Law 25)

Residents of Quebec have the right to access, rectify, or withdraw consent for the use of their data. Your data may be processed outside Quebec (specifically in the USA where our LLC and certain servers are located). By using this site, you consent to this transfer.

Privacy Officer Contact: See Section 8 below.

B. CALIFORNIA (CCPA/CPRA)

If you are a California resident, you have the right to know what data we collect, request deletion, and opt-out of “sharing” data for cross-context behavioral advertising (such as Facebook/Google Ads). To opt-out, please email us.

C. EUROPE (GDPR)

For European visitors: You have rights to access, rectification, erasure, and portability. We process data based on Consent, Contract (to fulfill your order), and Legitimate Interests. We act as joint controllers with Meta Platforms for data processed through our Facebook/Instagram interactions.