Privacy policy

Checkout happens on Stripe's own domain, not ours — your name, shipping address, email, and payment details are collected and processed there, under Stripe's privacy policy, and we never see or store your full card details ourselves. Stripe shares back with us what we need to fulfil the order: your name, shipping address, email, and order contents.

If you email us (for a return, a question, anything), we keep that email thread to handle the request.

Your cart (rosy-cart-v1) — the items you've added, saved in your browser's local storage so they're still there if you leave and come back. This is strictly necessary for the site to function as a store; it isn't used to track you and isn't shared anywhere.

Your cookie choice (rosy-cookie-consent) — whether you accepted or declined the cookie notice, so we don't ask again on every visit.

No analytics, no advertising pixels, and no third-party tracking scripts run on this site today. If that changes, this page and the cookie notice will be updated first — accepting the notice is the switch those scripts would check before loading, not a formality that happens after the fact.

Payment is processed by Stripe. When you check out, you're taken to a page on Stripe's own domain, governed by Stripe's privacy policy — we don't see or store your card details ourselves.

Declining the cookie notice still lets you browse and buy normally — only the cart's local storage is used either way, since it's necessary for the site to work. You can clear it at any time from your browser's site settings, or by clearing your cart in the drawer.

Which privacy law actually governs ROSY depends on where the business is registered and where its customers are — facts this page can't guess at, so this explains what triggers each law rather than declaring one "the" answer:

Israel's Privacy Protection Law (including Amendment 13, in force since August 2025) applies to anyone holding or processing personal data of Israeli residents, including from outside Israel. Its heavier duties — a mandatory Data Protection Officer, formal database registration — target organisations whose main activity is processing sensitive data or systematic monitoring; a small storefront like this is unlikely to cross that line on its own, but the general duty to keep personal data secure applies regardless of size.

GDPR applies once ROSY actively offers goods or services to people in the EU/EEA — since ROSY intends to sell worldwide with no geographic restriction, this is realistically expected to apply as soon as an EU customer orders, not just a hypothetical. In practice that means: a documented lawful basis for each use of personal data (order fulfilment, and separately, opted-in marketing — already the case here), relying on Stripe's own GDPR compliance for the payment data it processes directly, and honouring EU data-subject rights (access, deletion, etc. — already covered under "Your rights & contact" below).

CCPA/CPRA (California) applies only to for-profit businesses that do business in California and cross specific size thresholds — broadly, over $25M in annual gross revenue, or personal information from 100,000+ California consumers or households bought, sold, or shared a year, or 50%+ of revenue from selling personal information. A store this size is very unlikely to meet any of those thresholds today.

This explains how each law decides whether it applies — it isn't a determination that any of them definitely does. That depends on where ROSY is actually registered and who it sells to, and should be confirmed with a lawyer rather than assumed from this page.

To ask what we hold about you, correct it, or have it deleted, email concierge@rosy.example. Depending on where you live, you may have specific legal rights over this (for example under GDPR or the CCPA) — the exact process for exercising those isn't fully built out on our end yet, but the email address works today.