Privacy policy

Last updated: January 21, 2026

Rootstep US operates this shop and website, including all related information, content, features, tools, products, and services, to provide you as a customer with a customized shopping experience (the “Services”). Rootstep US is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, or disclose personal data when you visit, use, or make a purchase or other transaction using the Services, or otherwise communicate with us. If there is any conflict between our Terms and Conditions and this Privacy Policy, this Privacy Policy shall prevail with respect to the collection, processing, and disclosure of your personal data.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you confirm that you have read this Privacy Policy and agree to the collection, use, and disclosure of your data as described herein.

What personal data do we collect or process?

When we use the term “personal data,” we refer to information that identifies you or can be directly associated with you. Personal data does not include information that has been anonymized or aggregated so that it can no longer be used to identify you. Depending on how you interact with the Services, where you live, and as permitted or required by applicable law, we may collect or process the following categories of personal data, including inferences drawn from such data:

  • Contact details including name, postal address, billing address, shipping address, phone number, and email address.
  • Financial data including credit/debit card numbers, payment information, transaction details, payment method, and confirmations.
  • Account information including username, password, security questions, and settings.
  • Transaction data including viewed products, cart activity, purchases, returns, exchanges, cancellations, and order history.
  • Communications including any information you provide when contacting customer support.
  • Device information including browser, IP address, and unique identifiers.
  • Usage data including how and when you interact with the Services.

Sources of personal data

We may collect personal data from:

  • Directly from you (e.g., when creating an account, making a purchase, or contacting us).
  • Automatically through the Services (e.g., via cookies and tracking technologies).
  • Service providers acting on our behalf.
  • Partners and third parties.

How we use your personal data

We may use your personal data for:

  • Providing and improving Services
    Including processing payments, fulfilling orders, managing accounts, shipping, returns, and personalizing your experience.
  • Marketing and advertising
    Sending promotional emails, SMS, or displaying personalized ads based on your activity.
  • Security and fraud prevention
    Detecting and preventing fraudulent or malicious activity and ensuring safe transactions.
  • Communication
    Providing customer support and responding to inquiries.
  • Legal obligations
    Complying with laws, enforcing policies, and handling disputes.

How we share personal data

We may share your personal data in the following cases:

  • With service providers (e.g., IT, payments, shipping, analytics).
  • With marketing and business partners for advertising purposes.
  • When you request or consent to sharing.
  • Within our corporate group or affiliates.
  • In legal or business transactions (e.g., mergers, compliance with law).

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal data to provide and improve the Services. Data may be transferred to Shopify and third parties in other countries. Shopify may also process data from interactions across different merchants and platforms.

For more details, please refer to Shopify’s consumer privacy policy.

Third-party websites and links

The Services may contain links to third-party websites. We are not responsible for their privacy or security practices. Information shared publicly or on social platforms may be visible to others.

Children’s data

The Services are not intended for children. We do not knowingly collect data from minors. If such data is identified, it can be requested for deletion.

Data security and retention

We implement security measures, but no system is completely secure. Data retention depends on legal, operational, and contractual needs.

Your rights

Depending on your location, you may have rights such as:

  • Access to your data
  • Deletion of your data
  • Correction of inaccurate data
  • Data portability
  • Opt-out of marketing communications

For users in the UK or EEA, additional rights include:

  • Restriction or objection to processing
  • Withdrawal of consent

Complaints

You may contact us regarding complaints or escalate them to your local data protection authority.

International transfers

Your data may be processed outside your country. We rely on approved legal mechanisms such as standard contractual clauses where required.

Changes to this Privacy Policy

We may update this policy periodically. Changes will be posted with an updated “Last updated” date.

Contact

If you have questions or wish to exercise your rights, please contact us: