Privacy Policy

Last updated: August 2026

KOTOMOTO ("we", "us", "our") is committed to protecting your personal information. This policy explains what data we collect, why we collect it, and your rights.

Who We Are

KOTOMOTO is a global e-commerce store. For GDPR purposes, we act as the data controller. Contact our data protection enquiries at privacy@kotomoto.co.

Data We Collect

Data you provide

• Order data: name, shipping address, email address, phone number
• Payment data: handled entirely by Stripe; we never store card numbers
• Communications: messages you send via our contact form

Data collected automatically

• Usage data: pages visited, clicks, session duration (via PostHog analytics)
• Device data: browser type, operating system, screen resolution
• IP address: for fraud prevention and geographic analytics
• Cookies: see our Cookie Policy

How We Use Your Data

• Order fulfilment: processing, shipping, and customer support
• Fraud prevention: detecting and preventing fraudulent transactions
• Analytics: understanding how the store is used to improve it
• Legal compliance: meeting our obligations under applicable law
• Communications: transactional emails (order confirmation, shipping)

We do not sell your data, use it for profiling, or send unsolicited marketing without explicit consent.

Legal Basis (GDPR)

• Contract performance — fulfilling your order
• Legitimate interests — fraud prevention, analytics
• Legal obligation — financial records retention
• Consent — optional marketing emails (you may opt out at any time)

Third-Party Services

Data Retention

• Order records: 7 years (legal/tax obligation)
• Analytics data: 30 days in raw form; aggregated indefinitely
• Contact messages: 2 years
• Account data: until you request deletion

Your Rights

Depending on your location, you may have the following rights:

• Access: request a copy of your data
• Rectification: correct inaccurate data
• Erasure: "right to be forgotten"
• Portability: receive your data in a machine-readable format
• Objection: object to processing for legitimate interests
• Restriction: limit how we process your data
• Withdraw consent: at any time for consent-based processing

To exercise any right, email privacy@kotomoto.co. We will respond within 30 days.

California Residents (CCPA/CPRA)

California residents have the right to know what personal information we collect, to delete it, to opt-out of its sale (we do not sell data), and to non-discrimination. Submit requests at privacy@kotomoto.co.

Saudi Arabia Residents (PDPL)

We comply with Saudi Arabia's Personal Data Protection Law. Saudi residents may request access, correction, or deletion of their personal data by contacting privacy@kotomoto.co.

Security

We employ industry-standard security measures: TLS encryption for all data in transit, encrypted storage for sensitive data, access controls, and regular security reviews. No method is 100% secure; we cannot guarantee absolute security.

Children

Our store is not directed to children under 16. We do not knowingly collect data from minors. If you believe we have, contact us and we will delete it promptly.

Changes to This Policy

We may update this policy. Significant changes will be notified via email (if we have your address) or prominently on the site. The "Last updated" date above indicates when this version was published.

Contact

privacy@kotomoto.co