Privacy Policy

LAST UPDATED: 08/2026

This privacy policy explains how Hey Ruca (“Hey Ruca,” “we,” “us,” or “our”) collects, uses and protects your information when you visit www.heyruca.art, place an order, contact us, or subscribe to our emails.

If you do not agree with this policy, please do not use the site. Questions can go to heyrucaa@gmail.com.

THE SHORT VERSION

  • We collect only what we need to send your order and answer your messages.
  • We do not sell your personal information, and we do not share it for advertising.
  • We only send marketing email if you asked for it, and you can stop it any time.
  • You can ask what we hold about you, correct it, or have it deleted.

01  What we collect

In short: Your name, contact and shipping details when you order or write to us, plus basic technical data your browser sends automatically.

Information you give us

When you place an order, contact us, or sign up for emails, we collect:

  • Your name
  • Your email address
  • Your shipping and billing address
  • Your phone number, if you provide one for delivery updates
  • The contents of any message you send us
  • For commercial enquiries, your company name and role if you provide them

Payment information

We never see or store your full card number. Payments are handled by Shopify Payments under their own privacy policy. We receive only confirmation that payment succeeded, the last four digits, and the billing address for our records.

Information collected automatically

Like every website, ours records basic technical information when you visit: your IP address, browser and device type, operating system, the pages you view, and the site you arrived from. Our store runs on Shopify, which collects this to keep the site working and secure and to give us aggregate visitor numbers. We use it for those purposes and nothing else.

What we do not collect

We do not collect sensitive personal information: no government ID numbers, no precise GPS location, no biometric data, no health information, and nothing about your race, religion or sexual orientation. We do not buy personal information from data brokers or receive it from third parties.

02  How we use it

In short: To fulfil orders, answer questions, send emails you asked for, keep the store secure, and meet our legal obligations.

  • To fulfil your order — processing payment, packing, shipping and sending tracking
  • To provide support — answering questions about orders, returns and commissions
  • To send marketing email — only if you signed up, and only until you unsubscribe
  • To keep the store secure — detecting fraud, preventing abuse, fixing errors
  • To meet legal obligations — keeping tax and sales records as required by law

We do not use your information to build advertising profiles, and we do not make automated decisions about you.

03  Who we share it with

In short: Only the companies that help us run the store and ship your order. We never sell your data.

We do not sell your personal information, and we have not sold or shared it for advertising in the past twelve months. We share the minimum necessary with:

  • Shopify — the platform hosting our store and processing orders
  • Our payment processor — SHOPIFY Payments— to take payment securely
  • Shipping carriers — USPS, UPS or FedEx, who receive your name and address to deliver your parcel
  • Our email provider —  Shopify Email — which stores your address if you subscribed
  • Law enforcement or regulators — only where we are legally required to respond
  • A future buyer of the business — if the business is ever sold, customer records may transfer with it. We would notify you first.

Each of these is bound by contract to use your information only to provide their service to us.

04  Cookies and tracking

In short: Cookies that keep the store working, plus basic analytics. You can turn most of them off.

Cookies are small files your browser stores. Our store uses:

  • Essential cookies — these keep your cart working and let you check out. The store will not function without them.
  • Analytics cookies — these tell us how many people visit and which pages they read, in aggregate. They do not identify you by name.

You can block or delete cookies in your browser settings, though blocking essential ones will break checkout. We honour the Global Privacy Control signal: if your browser sends it, we treat it as a request to opt out of any sale or sharing of your information.

05  How long we keep it

In short: Order records for seven years because tax law requires it. Everything else until you ask us to delete it.

  • Order and transaction records — seven years, for tax and accounting requirements
  • Email subscribers — until you unsubscribe, after which we keep only a record that you opted out so we do not email you again
  • Messages you send us — up to two years, so we can pick a conversation back up
  • Website analytics — retained by Shopify on their own schedule, in aggregate

When we no longer need your information we delete it, or strip out anything that identifies you.

06  How we protect it

In short: Encrypted connections, a locked-down store account, and no card numbers on our side.

The site runs over an encrypted HTTPS connection, our store account is protected with a strong password and two-factor authentication, and card details never touch our systems. That said, no method of transmitting information over the internet is completely secure. We cannot guarantee absolute security, and we would tell you promptly if a breach affected your information.

07  Your choices

  • Marketing email — unsubscribe from the link in any email, or write to us. We will still send order and shipping messages, since those are part of what you bought.
  • Your account — if you created one, you can review or update it at any time, or ask us to close it.
  • Cookies — manage them in your browser settings.

08  Children

In short: We do not knowingly collect information from anyone under 13, and we do not sell or share the information of anyone under 16.

Our store is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us their information, write to heyrucaa@gmail.com and we will delete it.

We do not sell or share the personal information of anyone under 16 for any purpose. California law would require their opt-in consent, and we do not engage in that activity at all.

09  California privacy rights

In short: If you live in California you can ask what we hold, have it corrected or deleted, and opt out of sale or sharing. We do neither, but the right is still yours.

Categories we collect

In the past twelve months we have collected the following categories of personal information, as defined by the California Consumer Privacy Act:

Categories of personal information collected in the past twelve months
CATEGORY EXAMPLES COLLECTED
A. Identifiers Name, email, shipping and billing address, phone number, IP address YES
B. California customer records Name, contact details, payment information handled by our processor YES
C. Protected classification characteristics Age, gender and similar characteristics NO
D. Commercial information Orders placed, purchase history, returns YES
E. Biometric information Fingerprints, voiceprints NO
F. Internet or network activity Pages viewed, session data, referring URLs YES
G. Geolocation data Approximate location derived from your IP address YES
H. Audio, visual or similar information Recordings or images NO
I. Professional or employment information Business contact details if you write to us about commercial work YES
J. Education information Student records NO
K. Inferences Profiles or summaries built from any of the above NO
L. Sensitive personal information Government ID, precise geolocation, racial or ethnic origin, health data NO

Your rights

  • Right to know — what we collect, why, and who we share it with
  • Right to access — a copy of the specific information we hold about you
  • Right to delete — subject to exceptions such as completing your order or keeping legally required tax records
  • Right to correct — fix information that is inaccurate
  • Right to opt out of sale or sharing — we do neither, so there is nothing to opt out of, but the right remains yours
  • Right to limit use of sensitive information — we do not collect any
  • Right to non-discrimination — we will not charge you more, give you worse service, or refuse to sell to you for exercising any of these rights

How to use them

Email heyrucaa@gmail.com with the subject line Privacy Request, or write to the postal address in section 14. We will confirm receipt within 10 business days and respond within 45 days. If we need longer we will tell you why, and will take no more than 90 days in total.

To protect your information we need to verify who you are, usually by matching the email address you write from against our records. You may also use an authorized agent, who must show written proof that you authorized them.

Under California’s Shine the Light law you may request once a year, free of charge, a list of any personal information we disclosed to third parties for their own direct marketing. We make no such disclosures, so that list would be empty.

If you are a California resident under 18 with a registered account, you may ask us to remove content you posted publicly on the site.

10  Other US state rights

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comparable privacy laws have similar rights to access, correct, delete and obtain a portable copy of their information, and to opt out of targeted advertising, sale and profiling. We extend the rights in section 9 to every customer regardless of where they live. Use the same contact route. If we deny a request you may appeal by replying to our decision, and we will respond within 45 days.

11  Visitors outside the United States

We operate from California and our services are intended for customers in the United States. If you order from elsewhere, your information will be processed in the US, where privacy laws may differ from those where you live. We process it to perform our contract with you, with your consent for marketing, and in our legitimate interest in running a secure store.

12  Do Not Track

There is no agreed standard for how websites should respond to a browser’s Do Not Track signal, so we do not respond to it. We do honour the Global Privacy Control signal, as described in section 4.

13  Accessibility

We want this site to be usable by everyone, and we aim to meet the Web Content Accessibility Guidelines (WCAG) 2.1 at Level AA. In practice that means keyboard navigation throughout, visible focus indicators, text that meets minimum contrast ratios, descriptive alternative text on images, labelled form fields, and respect for reduced-motion settings.

Accessibility is ongoing rather than finished, and parts of the site may fall short. If you have trouble using any part of it, or need information in another format, email heyrucaa@gmail.com with the subject line Accessibility. Tell us the page and what happened. We will reply within 5 business days and work with you to get you what you need.

14  Contact us

For any privacy question or request:

15  Changes to this policy

We may update this policy as our practices or the law change. The date at the top shows when it was last revised. If we make a material change, meaning one that affects how we use your information, we will post a notice on the site and email subscribers where appropriate. Continuing to use the site after a change means you accept the updated policy.