Privacy policy

Sualta Studio LLC (“we”, “us”) operates the online store at sualta.com. This policy covers the personal information we handle through that store, through our customer support email, and through the marketing messages we send.

It does not cover the independent practices of third parties we link to, including social platforms and payment providers, each of which runs under its own privacy policy.

By using the site you accept the practices described here. If you do not agree with them, please do not use the site.

We collect information you give us directly, information collected automatically as you browse, and information passed to us by the services that process our orders and payments.

• Contact and order details: name, email address, shipping and billing address, phone number where you provide one, and what you bought.
• Payment information: processed by our payment provider. We receive a confirmation, the card type, and the last four digits — never the full card number or security code.
• Support correspondence: the messages you send us and our replies, including any order details or photographs you attach.
• Marketing preferences: whether you have subscribed to email, and whether you have unsubscribed.
• Device and usage data: IP address, browser and device type, pages viewed, referring site, and general location inferred from the IP address.
• Cookie identifiers: the identifiers described in section 4, used to keep your bag intact and to measure advertising.

We use personal information only for the purposes below, and we do not sell it in the ordinary sense of the word — though some advertising cookies may count as a “sale” or “share” under certain state laws. Section 8 explains how to opt out of that.

• To take payment for, fulfil, and deliver your order, and to send order and dispatch confirmations.
• To answer support requests and to handle returns, exchanges and refunds.
• To detect and prevent fraud, abuse and payment chargebacks.
• To send marketing email, where you have subscribed. Every message has an unsubscribe link.
• To understand how the site is used and to improve merchandising, sizing guidance and page performance.
• To measure advertising and to show relevant ads on third-party platforms.
• To meet our legal, tax and accounting obligations.

Cookies are small files stored by your browser. We use strictly necessary cookies to keep your shopping bag and your language preference between page loads; without these the store cannot function.

With your browser's permission (see section 16), we also use the Meta Pixel and Google Analytics 4 to measure which pages and campaigns work, and Klaviyo's onsite script to send the cart and product reminders you may receive by email. These set their own cookies, such as _fbp and _ga.

You can refuse or delete cookies in your browser settings, send a Global Privacy Control signal, or use the “Your privacy choices” control on this page. Blocking strictly necessary cookies will break checkout.

We share personal information with service providers who need it to do a job for us, under contracts that limit them to that job.

• Payment processors, to take payment and to handle refunds and chargebacks.
• Fulfilment and warehousing partners, to pick, pack and dispatch your order.
• Shipping carriers, to deliver the parcel and to provide tracking.
• Email and customer support platforms, to send order notifications and to manage correspondence.
• Analytics and advertising platforms, as described in sections 4 and 6.
• Professional advisers, and law enforcement or regulators where we are legally required to disclose.
• A buyer or successor, if the business is sold or merged. You would be notified of any such change here.

We use the Meta Pixel (Facebook and Instagram) and Google Analytics 4 to understand which ads and pages lead to orders. When you view a product, add to your bag, start checkout or sign up for email, we record that event with the product, price and page address.

Each event is sent both from your browser and from our server through Meta's Conversions API, so that it is counted once even when a browser blocks the pixel. The server copy includes your IP address and browser type, the Meta cookie identifiers described in section 4, and, if you have given us your email, a one-way SHA-256 hash of it — never the address itself.

Meta and Google act as independent controllers of the data they receive. You can limit ad personalisation in your settings on each platform and in your device settings, and you can stop all of this for your browser with the control below or a Global Privacy Control signal.

Depending on where you live, you may have some or all of the following rights over your personal information. We will not discriminate against you for exercising any of them.

• Access: ask for a copy of the personal information we hold about you.
• Correction: ask us to fix information that is wrong or out of date.
• Deletion: ask us to delete your information, subject to records we must keep for tax and fraud purposes.
• Portability: ask for your information in a portable, machine-readable format.
• Opt out of marketing: unsubscribe from any email, or write to us.
• Opt out of targeted advertising, and of any sharing that counts as a “sale” under your state law.

If you live in California, Colorado, Connecticut, Virginia or another state with a comprehensive privacy law, you may exercise the rights in section 7 by emailing care@sualta.com with the subject line “Privacy request”, or through our contact form.

We will verify your identity — usually by confirming details of a recent order — and respond within the period your state law requires. You may use an authorised agent, in which case we will ask for written proof of their authority.

We do not sell personal information for money. Sending event data to Meta and Google for advertising can count as “sharing” under California law. To opt out, use the “Your privacy choices” control on this page or send a Global Privacy Control signal; either takes effect immediately for that browser.

Order records are kept for as long as tax and accounting law requires, currently a minimum of seven years. Support correspondence is kept for two years. Marketing contact details are kept until you unsubscribe, and then suppressed so we do not accidentally contact you again.

Analytics and advertising identifiers expire on the schedules set by the relevant platform, typically within twenty-five months.

The site is served over an encrypted connection, payments are handled by a PCI-DSS compliant processor, and access to customer data is limited to the people who need it to do their work.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information we will notify you and the relevant regulator as required by law.

The store is intended for adults and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has given us information, email care@sualta.com and we will delete it.

We operate in the United States, and information you give us is processed there. United States privacy law may differ from the law where you live. If you use the site from outside the United States, you consent to that processing.

We may update this policy as the business changes. The date at the top of this page always reflects the current version, and material changes will be flagged on the site before they take effect.

Where UK or EU law applies, we rely on the following legal bases under Article 6 of the UK GDPR and EU GDPR:

• Performance of a contract — to take payment, fulfil your order, arrange delivery and handle returns.
• Legitimate interests — to secure the site, prevent fraud, understand which pages and products perform, and improve what we sell. We balance these against your rights and you can object at any time.
• Consent — for marketing email and for non-essential cookies. You can withdraw consent at any time without affecting anything done before you withdrew it.
• Legal obligation — to keep tax, accounting and consumer-law records for the periods the law requires.

We do not hold stock ourselves. To ship an order we pass your name, delivery address, phone number and the items you bought to our fulfilment partner, who picks, packs and dispatches the parcel and passes the same details to the carrier handling delivery.

That partner operates outside the United States and the UK/EEA, which means your delivery details are transferred internationally in order to get your parcel to you. Where UK or EU law applies, that transfer is made under Standard Contractual Clauses, and it is necessary for the performance of your contract with us.

We share only what is needed to deliver the order. Fulfilment partners are not permitted to use your details for their own marketing.

We honour the Global Privacy Control (GPC) signal. If your browser or extension sends it, the Meta Pixel and Google Analytics do not load at all, and our server does not forward any event from that browser to Meta — without you having to fill anything in.

The “Your privacy choices” control on this page does the same for browsers that do not send GPC. Both are stored in the browser rather than against you, so repeat them on each browser and device you use.

If we decline a privacy request, we will tell you why. You can ask us to reconsider by replying to that decision or writing to care@sualta.com with “appeal” in the subject line, and a different person will review it. We will respond to an appeal within 45 days.

If you are still unhappy, you may complain to your state attorney general. In the UK you may complain to the Information Commissioner’s Office; in the EU, to your local supervisory authority.

If a breach affects your personal information and is likely to put you at risk, we will notify you and the relevant regulator within the timeframes the applicable law sets — 72 hours to the regulator under UK/EU GDPR, and without unreasonable delay under US state law.

We will tell you what happened, what data was involved and what we are doing about it, rather than a generic notice.

We do not make decisions about you by automated means that produce legal or similarly significant effects. The fit finder is a sizing suggestion calculated from the height and weight you enter; it is advisory, it is not stored against your account, and it does not determine whether you can buy anything.

Questions, requests or complaints about privacy go to care@sualta.com — put “Privacy” in the subject line so it reaches the right person quickly — or use the contact form at sualta.com/contact.