This site is operated by GOCHA INC ("Gocha", "we", "us"). For any privacy question, write to admin@getgocha.com. We are the data controller for the information described here.

• Order details — name, email, shipping address, phone number, the items you bought and the amount paid.
• Account details — if you create an account, your email and the order history linked to it.
• Support messages — anything you send us by email or the contact form.
• Technical data — information your browser sends with every request (such as IP address and browser type), used by our hosting and security providers to deliver the site and prevent abuse.
• Optional analytics — only if you choose “Accept optional analytics”: a random visitor ID stored in your browser, pages viewed (with order numbers, tokens and email addresses removed), referring site, device type and approximate country, recorded by us and by Google Analytics.

We never see or store your full card number. Card details are entered on our payment provider's hosted checkout and stay with them.

• To take payment, ship your order and email you tracking updates (performing our contract with you).
• To handle returns, refunds and warranty claims.
• To prevent fraudulent orders and protect the store (our legitimate interest).
• To send marketing email only if you opted in — every message has a one-click unsubscribe.
• To meet tax and accounting obligations.

We share the minimum necessary with the partners that make an order possible. None of them may use your data for their own marketing:

• Amazon Multi-Channel Fulfillment — receives your name, shipping address, phone number and the items ordered so the parcel can be picked, packed and shipped. It does not receive payment details.
• Our sourcing partner — for items listed as Gocha Finds, the fulfillment partner that ships them receives your name, shipping address, phone number and the items ordered. That partner may be located outside the United States, so this data can be transferred abroad under contractual safeguards. It does not receive payment details.
• Carriers (UPS, USPS, FedEx, Amazon Logistics and, for imported parcels, customs brokers) — receive delivery address and contact details to complete the delivery and clear the shipment.
• Our payment processor — handles the card transaction and returns only a confirmation and the last four digits to us.
• Our hosting, database and email providers — store order data and send transactional email on our behalf.
• Google Analytics — only if you accept optional analytics; receives page views and shopping events (such as items added to cart and purchases, without your name, email or address).
• Authorities, where the law requires it.

We do not sell or rent your personal information, and we do not share it with advertising networks for cross-context behavioural advertising.

Essential cookies and browser storage keep your cart, sign-in and checkout working and remember your privacy choice; they are always on. Optional analytics (our own visit log and Google Analytics cookies such as _ga) run only after you choose “Accept optional analytics”. If your browser sends Global Privacy Control or Do Not Track, optional analytics stay off while that signal is active. You can change your choice at any time with “Privacy choices” in the footer; turning it off stops further collection and removes the analytics identifiers we can control. Separately, our hosting platform's built-in visitor statistics may record page visits (including the page address and referring site) and set a session cookie; this runs independently of these preferences unless that platform feature is turned off.

Order records are kept for 7 years to satisfy tax and accounting rules. Account data is kept while your account is open. Support emails are kept for 2 years. Marketing consent records are kept until you unsubscribe, plus a short period to prove the opt-out.

Depending on where you live, the law may give you specific privacy rights. Whatever your location, you can ask us to:

• Give you a copy of the data we hold about you.
• Correct anything inaccurate.
• Delete your data, where we're not required to keep it.
• Stop using it for marketing, at any time.
• Confirm that we have not sold or shared your personal information.

Email admin@getgocha.com, or send a Privacy request through our contact form, and we aim to respond within 30 days. A person handles each request; please don't include passwords, card numbers or ID documents. We will never charge you or treat you differently for exercising these rights.

Traffic is encrypted with TLS, access to order data is restricted to authorised staff, and key admin actions are logged. No system is perfect — if a breach ever affects you, we will tell you.

Our store is not intended for children under 16, and we do not knowingly collect their data. If this policy changes we update the date at the top of the page, and for material changes we may also notify account holders by email.