Privacy Policy

1. Introduction

Fish Sandals (“we,” “our,” or “us”) operates the fishsandals.com website, an online shop selling to addresses in the United States in US dollars. This policy describes what the site collects and what it does with it. It is written against the United States state privacy statutes that apply to a seller of this kind — California's CCPA as amended by the CPRA, and the comparable acts in Colorado, Connecticut, Utah and Virginia among others — rather than against a general promise.

2. Who operates this store

Not published yet. A legal entity name and a registered address belong on this page and on Terms, and neither is published because neither has been confirmed. That is a gap, it is stated here rather than glossed, and About says the same thing.

3. What we collect

There are no accounts on this site, so there are no account records, no passwords and no profile. What exists is:

• Order information: the items and sizes you chose, the order reference, the total, and the delivery address and email address Stripe collects during payment and passes to us.
• Payment details: handled entirely by Stripe on its own pages. Card numbers never reach this site and we do not store them.
• Messages: if you use the contact form, your name, email address and what you wrote.
• Usage data: pages visited and interactions, through analytics that run only if you accept them in the cookie banner.
• Device information: browser type, operating system and IP address, as any web server receives them.

4. Why we have it

• To take payment, record an order, and let you look it up afterwards
• To get a parcel to the right address
• To answer a message you sent us
• To see which pages are used, where analytics consent was given
• To meet tax, accounting and consumer-protection obligations

We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is no advertising identifier on this site to share.

5. Who else sees it

• Stripe, which processes payment and holds the card relationship.
• Hosting and infrastructure providers, which run the site and its database.
• Analytics, only where you accepted analytics cookies.
• A fulfilment partner, when one exists, which will need a delivery address to post a parcel. None is contracted today.
• Legal requirements, where a law, subpoena or court order compels disclosure.

6. Security

Traffic to this site is encrypted in transit, the database is not publicly readable, and card details never touch it. No penetration test or security audit has been commissioned for this site, so none is claimed here; an earlier version of this page said “regular security audits” and that had nothing behind it. No method of transmission or storage is completely secure.

7. Cookies

Essential cookies keep the site working and cannot be turned off. Analytics cookies run only if you accept them in the banner, and declining is a one-click option that is not buried. Your bag is kept in your own browser's local storage and is never sent to us until you start a checkout.

If you accept analytics, two services load. Google Analytics 4 (Google LLC) records the pages you view, the referring site, device and browser type, and approximate location; it sets cookies named _ga and _ga_* that last up to two years, keeps the data for two months, and runs with Google signals and advertising features off. PostHog (PostHog, Inc.) records the pages you view, the links and buttons you click and the forms you submit (but not what you type into them), your device and browser type, and your IP address, which it uses to estimate approximate location; it sets a cookie and browser-storage entry beginning ph_ and keeps data for one year. Both are based in the United States, and data may be processed there. You can withdraw or change your choice at any time: Change cookie choice clears your choice and these analytics cookies, and shows the cookie banner again.

8. Your rights

Depending on where you live, state privacy law gives you the right to:

• Know what personal information we hold about you
• Ask for a copy of it
• Ask us to correct it
• Ask us to delete it, subject to records we must keep for tax and order history
• Opt out of the sale or sharing of personal information — which for this site is a right with nothing to exercise it against, because there is no sale and no sharing

Ask by email. We will not charge you for it and we will not make you create an account to do it, for the obvious reason that there are no accounts.

9. How long we keep it

Order records are kept for as long as tax and consumer-protection law requires them. Messages sent through the contact form are kept until they are dealt with and for a reasonable period afterwards. Analytics data is kept for the periods in Section 7; each service assigns your browser a random identifier, which we do not link to your name, email or orders.

10. Children's Privacy

This shop is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe we have, tell us and it will be deleted.

11. Contact

For anything on this page, write to privacy@fishsandals.com. There is no telephone number, and no postal address is published, for the same reason the entity is not: neither has been confirmed.