Privacy Policy

This Privacy Policy explains how Overvoy ("we", "us") collects, uses, and protects your personal data when you visit our website or purchase products from us. We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Last updated: 22 September 2026. This Policy describes the cookie and analytics behavior currently in effect on this site; if we change that behavior, we will update this page and the date above.

We collect personal data that you provide directly, including your name, email address, shipping and billing address, phone number, and payment information when you place an order or create an account.

We also collect usage data automatically, such as your IP address, browser type, device information, and pages visited, through cookies and similar technologies.

We process your personal data to process and fulfill your orders, to provide customer support, and to communicate with you about your account and purchases. Processing is based on the performance of a contract and our legitimate business interests.

With your consent, we may also send you marketing communications and use your data to improve and personalize our website. You may withdraw your consent at any time by following the unsubscribe link in our emails or contacting us.

We use cookies and similar technologies to operate the website, remember your preferences, analyze traffic, and — only if you explicitly accept — enable marketing features. Essential cookies are necessary for the website to function and cannot be disabled.

Analytics cookies (Google Analytics 4 and PostHog) show us how many people reach each page, what visitors search for, and which products attract interest. They process identifiers such as your IP address, device and browser characteristics, and the approximate location derived from your IP address. Where prior consent is required, these cookies are set only after you accept; elsewhere they may be set automatically.

To say no to analytics cookies: use the "Cookie Settings" link in the page footer, email us at [email protected], or block them in your browser settings. We honor the Global Privacy Control (GPC) and Do Not Track (DNT) signals — when your browser sends either, analytics cookies are not set, wherever you are located. Changing your mind later is just as easy: reopen Cookie Settings in the footer, or email us.

We do not sell your personal information. If you accept marketing cookies, data may be shared with advertising partners in a way that California treats as "sharing for cross-context behavioral advertising"; the opt-out routes above and the section "Your California Privacy Rights" both cover it.

Under the GDPR, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request that we correct inaccurate or incomplete data.
• Erasure — request that we delete your personal data, subject to legal exceptions.
• Restriction of processing — request that we limit the processing of your data in certain circumstances.
• Data portability — receive your personal data in a structured, machine-readable format and transmit it to another controller.
• Objection — object to the processing of your personal data based on legitimate interests or for direct marketing.

To exercise any of these rights, please contact us using the details below. You also have the right to lodge a complaint with your local data protection authority.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the CCPA), gives you additional rights over the personal information we collect. This section supplements the rest of this Policy.

Categories of personal information collected in the preceding 12 months:

• Identifiers — name, email address, shipping address, phone number, IP address, and account credentials.
• Customer records — the contact and delivery details you provide when ordering or creating an account.
• Commercial information — products viewed, searches submitted, saved cart contents, back-in-stock and newsletter sign-ups, and order history.
• Internet or other electronic network activity — pages visited, referring site, browser and device characteristics, and interactions with our pages.
• Geolocation — approximate location, such as country or city, derived from your IP address.

We collect this information directly from you, automatically through cookies and similar technologies, and from the service providers listed under "Third-Party Services". We use it to operate the store, fulfill orders, provide support, keep the site secure, and measure how well the site and our marketing perform. We do not collect sensitive personal information, payment card numbers (PayPal handles payments under its own terms), or the personal information of minors.

We do not sell personal information. We also do not share it for cross-context behavioral advertising, unless you accept marketing cookies in the cookie notice. Your rights are:

• Right to know and access — request the categories and the specific pieces of personal information we collected about you, and the sources, purposes, and recipients.
• Right to delete — ask us to remove personal information we collected from you, subject to legal exceptions such as order and tax records.
• Right to correct — ask us to fix inaccurate personal information.
• Right to opt out of sale or sharing — stop any sharing for cross-context behavioral advertising.
• Right to limit use of sensitive personal information — you may ask us to restrict it; we do not collect any, so there is nothing to limit today.
• Right to non-discrimination — we will not deny goods, charge differently, or treat you worse for exercising these rights.

To exercise a right, email [email protected] from the address associated with your account and tell us which right you want to use. We may need to verify your identity before responding; for access, deletion, and correction requests we normally do this by requiring that the request come from the email address on file. You may send a request through an authorized agent, in which case we may ask for proof of the agent's authority and confirm the request with you directly. Requests are free. You may make two verified requests per individual in a rolling 12-month period.

We respond within 45 days of a verified request, and may extend that once by a further 45 days where reasonably necessary. If we decline a request as unfounded, excessive, or repetitive, we will tell you why.

Opt-out of sale or sharing: a Global Privacy Control (GPC) signal sent by your browser counts as a valid opt-out request for that browser or device, so you do not need to write to us. You can also opt out through the cookie notice while it is on screen, as described under "Cookie Usage".

Email [email protected] with any questions about this section. If you believe we have not handled a CCPA request properly, you may file a complaint with the California Attorney General's office.

We use third-party services that may collect and process your personal data independently. PayPal is used to process payments and is governed by its own privacy policy. We do not store your full payment card details.

Our store is built on the Medusa commerce platform, which provides the infrastructure for order management and fulfillment. Medusa may process data as a processor on our behalf and in accordance with our instructions.

The service providers that process data on our behalf include: Google Analytics 4 and Google Tag Manager (site analytics), PostHog (product analytics), Sentry (error monitoring), Resend (transactional email), PayPal (payments), and our logistics partners (shipping and tracking). Each processes only what is necessary for its function.

Retention: we keep analytics data for up to 14 months, order and tax records for as long as the law requires, and support correspondence for up to 24 months, after which it is deleted or anonymized.

International transfers: our servers and some of these providers are located outside your country, including in South Korea and the United States. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.