This policy explains what personal information we collect, why we collect it, and what we do with it. We keep as little as we can, for as long as we need, and we do not sell it to anyone.
Who we are
Gypsy Amazon Co., Ltd., 26/2 Moo 4, Bo Phut, Koh Samui, Surat Thani 84320, Thailand, is responsible for the personal information described here (the "controller"). You can reach us about anything in this policy at tatiana@gypsyamazon.com. Full details: Legal Notice.
What we collect
When you order: your name, email address, shipping and billing address, phone number if you give it, and what you ordered.
When you pay: payment is handled by Stripe. We never see or store your full card details.
When you subscribe: your email address, and your name if you give it.
When you write to us: whatever you choose to tell us in a form or email.
When you browse: the country you choose for shipping and your cookie choice, so prices and the banner stay as you set them. Analytics only with your consent, see Cookies below.
Why we use it, and on what basis
To take, pack, ship and support your order, and to send order and shipping updates: because we need it to perform our contract with you.
To send newsletters and offers: only with your consent, which you can withdraw at any time with the unsubscribe link in every email or by writing to us.
After an order, we may write to you once personally, for example to ask how your piece fits. We do this on the basis of our legitimate interest in looking after our customers. If you would rather not hear from us, tell us and we stop.
To prevent fraud and keep the shop secure: our legitimate interest in protecting the business.
To meet accounting and tax obligations: because the law requires it.
Who we share it with
Only with the services that make the shop work, and only what they need:
- Cloudflare, which hosts our website and stores our shop data
- Stripe, which processes your payment
- Klaviyo, which sends our emails, if you ordered or subscribed
- Shipping carriers and our fulfilment partners in Brazil, Thailand and Bali, to deliver your order
- Analytics services, only if you agreed in the cookie banner
Our shop previously ran on Shopify. Your past orders and customer record were moved from Shopify into our own shop system so we can keep serving you.
We may also disclose information where the law requires it. We do not sell your personal information.
International transfers
We work from Thailand and ship from Brazil, Thailand and Bali, and the services above may process data in other countries, including the United States. Your information may therefore be processed outside your own country, including outside the European Economic Area and the United Kingdom. Where that happens, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism offered by the provider. You can ask us for details.
Cookies and similar storage
Our site stores a few things in your browser that it needs to work: your bag, the country and language you chose, and your answer to the cookie banner. These do not need your consent.
Analytics tools that use cookies only run after you say yes in the cookie banner. You can change your mind at any time by clearing this site's data in your browser, which brings the banner back.
How long we keep it
Order and invoice records: for as long as tax and accounting law requires, normally seven years.
Newsletter contacts: until you unsubscribe.
Messages: up to two years, so we can pick up a conversation where it left off.
Analytics data: in line with the retention settings of the service, normally no more than 26 months.
Your rights
Depending on where you live, you may have the right to a copy of the personal information we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. You can withdraw consent at any time.
To use any of these rights, write to tatiana@gypsyamazon.com. We answer within one month.
If you are in the European Economic Area or the United Kingdom and believe we have not handled your information properly, you also have the right to complain to your data protection authority.
Children
Our shop is not intended for children, and we do not knowingly collect their information.
Changes
We update this policy when our shop changes or the law requires it. The date below shows the latest version.
Last updated: 22 October 2026