Privacy Policy

“Kilimy” is a consumer brand operated at kilimy.com. To keep things transparent about the different names you may see at checkout, on your card statement, and in our emails:

• ZFactor Labs LLC — a Wyoming (USA) limited liability company, operating as Kle.me [CONFIRM: DBA filing]. ZFactor Labs LLC is the merchant of record for purchases and the primary data controller. Your card statement may show the property KLE.ME.COM.
• Kilimy S.A.S. — a company based in Casablanca, Morocco, which operates the artisan marketplace and verifies artisans.

ZFactor Labs LLC and Kilimy S.A.S. act as joint data controllers, with ZFactor Labs LLC as the primary controller for buyer data.

• Account data — name, email, and a password (stored hashed by our authentication provider).
• Order data — the items you buy, order reference, and amounts paid.
• Shipping data — postal address and phone number, shared with DHL Express so your order can be delivered.
• Payment data — processed by Stripe. We receive limited confirmation details (e.g. card brand, last four digits, payment status) but never your full card number or security code.
• Usage & device data — collected via analytics and advertising cookies (see section 4).
• Communications — messages you send to our support team.

We share data with a small set of vetted service providers who process it only on our instructions:

• Stripe — payment processing.
• DHL Express — international shipping and delivery.
• Supabase — database, authentication, and file storage. Hosting region: [CONFIRM: hosting region].
• Vercel — website hosting and content delivery.
• Apify — catalog and product-research data collection.

We use the following cookies and tracking technologies:

• Meta Pixel — measuring and retargeting Facebook/Instagram advertising.
• Pinterest Tag — measuring and retargeting Pinterest advertising.
• PostHog — first-party product analytics to understand and improve the store.

These help us measure traffic, improve the store, and (for the advertising pixels) measure and target ads. A consent management mechanism is being rolled out [CONFIRM: consent tool rollout]. In the meantime you can control cookies through your browser settings and opt out via each platform’s own ad-preference tools.

Where the EU or UK GDPR applies, we rely on these legal bases: performance of a contract (fulfilling your order), legitimate interests (fraud prevention, analytics, improving the service), consent (advertising cookies and marketing email), and legal obligation (tax and accounting records).

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time. You may also lodge a complaint with your local supervisory authority.

California residents have the right to know, delete, and correct their personal information, to opt out of its “sale” or “sharing,” and not to be discriminated against for exercising these rights.

We do not sell your personal information for money. We do share certain identifiers and online-activity data with advertising partners (Meta, Pinterest) for cross-context behavioral advertising, which may count as “sharing” under the CPRA. You can opt out via Global Privacy Control signals and by emailing privacy@kle.me [CONFIRM: “Do Not Sell or Share” opt-out mechanism].

Your data may be processed in Morocco, the United States, and the European Union. Where required, we rely on Standard Contractual Clauses and equivalent safeguards for cross-border transfers. [COUNSEL REVIEW]

Retention: we keep order and tax records for as long as needed for the purposes above and to meet legal and accounting obligations, then delete or anonymise them. [CONFIRM: retention periods]

Children: the store is not directed to children, and we do not knowingly collect data from anyone under 16 (or under 13 in the United States).

Security: we use encryption in transit, access controls, and reputable processors. No method of transmission or storage is 100% secure.

To exercise any right, email privacy@kle.me [CONFIRM: mailbox to be created]. We may need to verify your identity before acting on a request.

We may update this policy from time to time. Material changes will be posted here with a new “Last updated” date. Effective date: 14 June 2026.