Privacy Policy

Knurle (“we”, “us”) runs knurle.com as a headless storefront. Checkout, payments and order fulfilment run through Shopify and our fulfilment partner Supliful in Colorado. This policy explains what we collect, why, and what rights you have.

Who is the controller?

For GDPR / UK GDPR purposes the controller is Knurle, contactable at hello@knurle.com and by post at 14701 W. 65th Way, Suite 5, Arvada, CO 80004, USA. Our Shopify Payments entity is registered in the United Kingdom, so UK GDPR and the UK Data Protection Act 2018 apply alongside EU GDPR for EU visitors and the CCPA/CPRA for California residents.

What we collect

• Storefront browsing: pages viewed, referrer, device and approximate location (derived from IP). Stored via Cloudflare and Next.js logs for security and performance.
• Cart & checkout: products, quantities and prices via Shopify Storefront API. We store a cart ID in a cookie (knurle_cart, httpOnly, 30 days) to keep your cart between visits.
• Checkout details: name, email, shipping/billing address, phone and payment information you enter on checkout.knurle.com. This is processed directly by Shopify. We do not see full card numbers.
• Support: emails to hello@knurle.com and their contents.

Why we use it (legal basis)

• Contract: to run the cart, create your checkout, take payment and ship your order.
• Legitimate interest: to secure the site, prevent fraud, improve the storefront and answer support queries.
• Consent: for marketing emails, which we send only if you opt in.
• Legal obligation: VAT, customs, accounting and product safety records.

Cookies

Essential only: knurle_cart (cart persistence), Shopify_shopify_y/_shopify_s (checkout security), and Cloudflare __cf_bm (bot protection). We set no advertising cookies and no analytics cookies. You can block cookies in your browser; checkout will then not retain a cart.

Our analytics are cookieless. We run our own copy of Plausible on our own server, which counts page views without cookies, without fingerprinting and without collecting anything that identifies you. Nothing about your visit is sent to a third-party analytics company, so there is nothing here for you to consent to or opt out of.

Processors we share data with

• Shopify Inc.: store, checkout and payments (data stored in the US and Canada; SCCs + UK IDTA for transfers).
• Cloudflare, Inc.: DNS, CDN and security for knurle.com and checkout.knurle.com.
• Supliful / fulfilment facility: name, address, phone and line items needed to print, pack and ship your order from Colorado.
• Shipping carriers (USPS, FedEx): address and phone for delivery and tracking.

We do not sell your personal information.

International transfers

If you are in the UK/EU, your data is transferred to the US to perform the contract (shipping from Colorado) under Art.49(1)(b) GDPR and under Standard Contractual Clauses with Shopify/Cloudflare. US law may allow government access; we minimise what is transferred.

Retention

Cart cookies 30 days. Checkout/order records 6 years for tax and product safety. Support emails until the thread is resolved plus 12 months. Logs 30 days.

Your rights

Under GDPR/UK GDPR you can request access, correction, deletion, restriction, portability and objection. Under CCPA/CPRA you can request to know, delete and opt out of sale/share (we do not sell). To exercise any right, email hello@knurle.com. We reply within 30 days (45 under CCPA).

You also have the right to lodge a complaint with the UK Information Commissioner (ico.org.uk) or your local EU supervisory authority, and with the California Attorney General.

Security

Shopify and Cloudflare handle payments and edge security. We use TLS, httpOnly cart cookies, and store no card data on our servers.

Children

Knurle is not directed at under-18s and we do not knowingly collect their data.

Changes

We will update this page and change the date above. Material changes will be flagged via the announcement bar for 14 days.

Questions? Contact us or email hello@knurle.com.