Privacy policy
1. Who we are
Ecell Global Ltd, a company registered in England and Wales, is the controller of your personal data for this website. Registered address: [REGISTERED ADDRESS — to be confirmed]. Company number [COMPANY NO.]. ICO registration [ICO REG. NO.]. Who sells to you depends on where your order ships: orders shipped to UK and EU addresses are sold by Ecell Global Ltd (VAT GB864395193) from its UK hub; orders shipped to US addresses are sold by Ecell Global Inc (Florida, United States) from its Florida hub. Payments for all orders are processed by Ecell Global Inc through Shopify on the seller's behalf, and your receipt names the seller.
Privacy contact: privacy@ecellglobal.com [mailbox to be confirmed].
2. What we collect, why, and on what basis
| Data | Why | Legal basis (UK/EU) | Kept |
|---|---|---|---|
| Your bag, the device you selected, worlds you opened and recent searches — stored in your own browser (local storage), not on our servers. | To run the store you asked for: the right case for your device, your bag between pages. | Strictly necessary for the service (PECR reg. 6(4)); performance of a contract. | Until you clear your browser storage. |
Your shipping market (hcfd.market, only when you pick one) and, when that market covers several countries — the European Union does — the country you picked inside it (hcfd.country, again only when you pick one), the reference of the checkout cart we open for you at Shopify (hcfd.cart: its id, checkout link, country, creation time, the catalogue version it was priced from, when you last started checkout and any discount code you entered) and a note of the last checkout problem the bag showed you (hcfd.cartErrors) — all in your own browser (local storage). | To price your bag in the right currency and to hand the same bag to checkout again if you come back before it expires. | Strictly necessary for the service (PECR reg. 6(4)); performance of a contract. | The cart reference expires 25 days after the cart was created (Shopify deletes the cart itself within 30 days); the rest until you clear your browser storage. |
| Pseudonymous usage analytics — pages viewed, searches made (their length, never the words), items viewed and added to the bag, a random client id and session id, approximate location (country/region), device type. Collected by Google Analytics 4. | To measure which pages and searches lead to purchases and to fix what does not work. | Your consent in the UK and EU (you can withdraw it any time under Cookie settings). Legitimate interests elsewhere, with an opt-out. | 14 months in Google Analytics; a daily export we hold for analysis is pseudonymous. |
| What you type or upload into Head Case Ask — your request in plain words and, if you choose, a photo of a device or artwork. | To understand your request and suggest matching products. The AI model never decides prices, stock or eligibility. | Performance of a contract / legitimate interests (helping you find a product you asked about). | We keep no transcript. The request is processed by Google's Gemini API as our processor; on the API tier we use, prompts are not used to train Google's models and are retained only briefly for abuse monitoring [tier to be confirmed]. |
| Order and contact details when you buy — name, address, e-mail, payment handled by Shopify. Each order also carries the catalogue version and market it was priced from and, when analytics is on for you (because you accepted it in the UK or EU, or because you have not opted out elsewhere), a hashed analytics id (a salted one-way hash of your Google Analytics client id — never the id itself) so we can match the order to our own analytics. | To fulfil, ship and support your order; tax and accounting; to check that what we show on the site matches what checkout charged. | Performance of a contract; legal obligation (tax records). For the hashed analytics id: your consent in the UK and EU, legitimate interests elsewhere with an opt-out — the same basis as the analytics row above. | Per statutory record-keeping periods (typically 6–7 years for tax). |
| E-mails you send us. | To answer you. | Legitimate interests. | Up to 24 months after the last exchange. |
We do not use your data for advertising, we do not build profiles of you, and we do not sell your personal information.
3. Cookies and similar storage
Before you choose, this site stores only what it needs to work. Analytics cookies (_ga, _ga_*, 2 years) are set only after you accept in the UK and EU, or unless you opt out elsewhere. Your choice itself is remembered (hcfd.consent or the consent tool's cookie, up to 12 months). Checkout runs on Shopify's own domain, which shows its own cookie notice to UK and EU visitors and records that answer in Shopify's _tracking_consent cookie (1 year). Today your choice on this site does not carry across to checkout — the two are asked and stored separately; once this site and checkout share a domain we will forward your answer to Shopify instead. The consent tool never removes that cookie. Rejecting is as easy as accepting.
4. AI features
Head Case Ask uses an AI model to interpret what you ask and to write short suggestions. The panel tells you on screen when text is AI-written. It never invents products, prices, devices or delivery promises — those come from our catalogue.
5. Who we share data with
Processors acting on our instructions: Shopify (checkout, orders), Google (Analytics; Gemini API for Ask), Netlify and Cloudflare (hosting and security), Supabase (catalogue data), Veeqo (shipping), our transactional e-mail provider [E-MAIL PROVIDER — Resend unless confirmed otherwise], which delivers the messages you send through our support form (your name, e-mail address, order number and message) to our support mailbox, and our fulfilment partner in the Philippines for order production. Each is bound by a data-processing agreement. We share data with authorities only where the law requires it.
6. International transfers
Some processors are outside the UK/EU, mainly in the US. Where the processor is certified under the UK Extension to the EU-US Data Privacy Framework (for example Google LLC, Shopify) we rely on that; otherwise we use the UK International Data Transfer Agreement or EU Standard Contractual Clauses.
7. Your rights — UK and EU
You can ask for access to your data, correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time. We answer within one month. You can complain to the UK Information Commissioner's Office (ico.org.uk) or to your local EU supervisory authority.
8. Your rights — US states
If you live in California or another US state with a privacy law, you have the right to know what personal information we collect and how we use it, to access and delete it, to correct it, to opt out of the sale or sharing of personal information and of targeted advertising, and not to be discriminated against for exercising these rights. We do not sell or share personal information for advertising. We honour Global Privacy Control browser signals as an opt-out of sale and sharing and confirm it on screen. We answer within 45 days. You may use an authorised agent.
9. How to make a request
E-mail privacy@ecellglobal.com from the address you want us to check, or use the request form in Cookie settings where available. No account is needed. We may ask you to confirm your identity before we act on a request.
10. Children
This store is not directed at children under 13 (US) or under 16 (UK/EU) and we do not knowingly collect their data.
11. Changes
We date every version at the top of this page. Material changes are announced on the site before they take effect.