Doré Vendetta
Search

Privacy Policy

This policy explains how Doré Vendetta uses personal information when you browse the site, place an order, use a gift card, open an account or send a message. It also describes the service providers and site features involved.

Last updated: 2026-10-17.

The data controller is DORE VENDETTA GROUP, LLC, trading as Doré Vendetta.
Registered address:
6611 GRAND ESTUARY TRAIL
UNITE-102
BRADENTON, FL 34212
United States.
Contact: [email protected].

Who to contact

Write to [email protected] for any question about this policy, to ask for a copy of your data, or to ask us to correct or erase it. We answer from the same address.

What we collect, and why

When you send us a message

The contact form asks for your name, email address, a topic, an optional order number and your message. We store that submission in this site’s own database as a private record and email a copy to our own address so we can reply. Your email address is set as the reply-to address on that email. We also briefly store a one-way hash of your IP address for ten minutes to stop the same visitor submitting more than five messages in that window; the hash is discarded automatically and is never linked to your message.

We keep enquiries for as long as they are useful for answering you and for our own records of the conversation, and delete them on request.

When you place an order

To sell you a garment we need your name, billing and shipping address, email address and telephone number, together with the items, prices and totals of the order. We use it to take the order, arrange delivery, handle returns and keep the accounting and tax records we are legally required to keep.

Stripe provides the card and wallet fields, so full card details go directly to Stripe rather than being stored on this site. The shop receives payment status and references, billing details and limited payment information such as card type and last four digits to manage payments and refunds. Stripe is in test mode while the store is being prepared. Test details are not charged, and checkout remains unavailable while the catalogue is in preview.

If you allow Statistics in Cookie preferences, WooCommerce attribution can record referring sites, campaign parameters, entry pages, visit timing, page and visit counts, and browser or device information. Attribution can be stored with an order or account so we can understand which channels bring customers. Permitted WooCommerce usage events can send Automattic the order reference and total, source and medium, device type, visit counts and account status, with site and pseudonymous identifiers and request information. Visitor-derived attribution and usage events are blocked without this permission. Declining statistics does not prevent account creation or purchases.

When you buy, send or redeem a gift card

We use the recipient email address, any recipient name, sender name and optional message you provide to prepare and email a gift card. Purchased gift-card details are stored with the order; the recipient receives the sender name, message, card code and value. Card codes, balances, issue and redemption activity, related orders and staff adjustment records are kept to deliver the card, honour its balance, handle refunds and prevent misuse. Manual issuance can also send a card to the recipient address supplied by staff. These details pass through the email services used to deliver the card. Only provide another person’s details when you are entitled to do so, and do not include sensitive information in a gift message.

When you open an account

An account stores your email address, a username generated from it, a one-way hash of your password (never the password itself), any addresses you save, and the orders attached to you. You can create an account at checkout or on the account page. Public pieces can be bought without an account; Backstage-only pieces require an invited customer account. Ask us and we will close it and erase it, keeping only the order records we must retain for tax.

For Backstage access, we use the invited email address to send a personal code and record a code hash, invitation status, issuing staff account, issue and activation or revocation dates, and recent failed-code attempt counts and expiry times. These records control access to private releases and prevent unauthorized code use. The code is sent by email; issuing staff can also retrieve it once from a temporary record that expires after five minutes. Invitations can be revoked or reissued.

When you review a piece

Only customers who bought a piece can review it, so a review is attached to your account name. Your name, rating and review text are published on the product page. WordPress also stores the IP address and browser user-agent string of the submission for spam handling; neither is published. Ask us to remove a review and we will.

When you simply browse

Cloudflare provides DNS, HTTPS, caching and security, processing IP addresses, requested pages and browser and security telemetry. Cloudflare Web Analytics and browser RUM are disabled. Our web server keeps access logs to operate and secure the site. Optional Statistics, Marketing and External media are off until you choose to allow them. Marketing permission controls advertising click cookies and customer events from the installed Google, Reddit, Snapchat and TikTok integrations; an integration also needs a configured account or pixel before it can send advertising events. External media permission controls the embedded SoundCloud player. Simply browsing or scrolling does not grant permission.

Cookies

Essential shop, login, security and consent-preference cookies keep the site working. Optional cookies and embedded media need your permission. Use Cookie preferences, also available in the footer, to accept or reject optional purposes, choose Statistics, Marketing and External media separately, or withdraw permission. Choices are remembered for up to 180 days; expired or unrecognised choices leave optional purposes off. Global Privacy Control keeps Marketing off when your browser sends that signal. Refusing optional purposes does not remove cart, account, checkout or payment-security features.

  • a cart and session cookie, so the pieces you add are still there on the next page, and so checkout can find your cart;
  • login cookies if you sign in — two days, or two weeks if you tick “Remember me”; removed when you log out;
  • dv_consent stores the consent version, choice time and selected purposes for up to 180 days. An opaque, HTTP-only dv_consent_receipt identifies the consent record used to check queued event permissions and withdrawals. That record holds choice/version/time information, not your IP address or browser string, and expires within 180 days. These cookies record privacy choices, not advertising profiles;
  • WordPress consent-compatibility cookies with names beginning wp_consent_ communicate purpose choices to compatible integrations;
  • with Statistics permission, WooCommerce attribution cookies beginning sbjs_ record visit source, campaign and session information, with a 30-minute session window. Information already saved to an order or account remains subject to its normal retention requirements;
  • with Marketing permission, tiktok_ttclid can retain a TikTok click identifier for 30 days when a link includes ttclid. Connected advertising services can use their own permitted identifiers and events;
  • Stripe cookies such as __stripe_mid and __stripe_sid on payment-enabled surfaces for payment security and fraud prevention; Stripe is currently in test mode;
  • essential Cloudflare security cookies if Cloudflare needs to verify a request;
  • a short-lived cookie set when you visit the login page to check whether your browser accepts cookies.

Third parties

Very few, and each for a stated reason:

  • SoundCloud: the embedded player stays unloaded until you allow External media. With that permission and JavaScript, it can load near the viewport, but never starts playback automatically. Loading sends connection information such as your IP address and browser details to SoundCloud, which can use its own cookies under its privacy policy. Without JavaScript, use the external SoundCloud link instead; no player loads automatically. Withdrawing External media removes the player and stops further loading through this site. Existing third-party cookies cannot be erased by this site’s first-party controls; your browser can remove them.
  • Stripe: processes payment and fraud-prevention information through its payment fields under its privacy policy. The store currently uses test mode.
  • Cloudflare: processes connection and request data for DNS, HTTPS, caching and security under its privacy policy. Cloudflare Web Analytics and browser RUM are disabled.
  • Automattic / WooCommerce: can receive permitted visitor-derived usage and attribution events when Statistics is allowed, under its privacy policy. Essential shop processing and separately configured store-administration reporting are not permission to send customer attribution events.
  • Email services: process delivery addresses and message contents for enquiries, account access, Backstage invitations, order messages and gift-card delivery. Gift-card messages also disclose the sender name and message to the recipient you specify.
  • WooCommerce Tax: when the service is connected and automated tax is enabled, Automattic’s WooCommerce tax service and its tax provider, TaxJar, process the destination street, city, state, postcode and country, store address, product identifiers, quantities, prices, discounts and shipping amount to calculate tax. This disclosure describes the service when enabled, not confirmation that the account connection has been completed. Tax-service data processing.
  • Our carrier — the name, address and phone number needed to deliver your parcel.
  • Our hosting provider — the site runs on a server in the United States, so any data you send us is stored there.

We use personal information for the shop, communication, security and permitted measurement purposes described here. Advertising connections do not override your purpose choices. Changing or withdrawing a choice updates future optional processing and queued event permissions through this site; it does not undo earlier lawful processing or automatically erase order and tax records we must retain. We clear known first-party tracking cookies for purposes you turn off, without removing your essential cart, login or payment-security cookies. Review this notice when advertising connections or other processing change.

Your rights

You can ask us for a copy of the information we hold about you, ask us to correct or delete it, or object to a use, wherever you live. Email [email protected] and we will act on your request within one month. We may need to verify your identity. Additional statutory rights, exceptions and complaint routes depend on your location and the laws that apply. Where available, you may also complain to the relevant privacy regulator.

If a request would erase records we must keep by law — order and tax records, for example — we will tell you exactly what we are keeping and why.

Security and changes

The whole site is served over HTTPS, passwords are stored only as hashes, and account and order pages are reachable only to the signed-in customer. If we change what we collect, this page changes with it.