Privacy Policy

1. Introduction & Controller

TRUE FAN ("we", "us", or "our"), a division of Dirty Bucks, is committed to safeguarding the privacy of fans, creators, and shoppers who visit our digital storefront. This Privacy Policy explains how we collect, process, share, and protect your personal data when you browse our website, purchase physical merchandise, or redeem serialized digital collectibles.

For the purposes of the General Data Protection Regulation (GDPR) and UK data protection laws, TRUE FAN is the Data Controller responsible for your personal information.

2. Information We Collect

We collect personal information directly from you, automatically through your device interactions, and via trusted payment and logistics partners:

3. Legal Bases & How We Use Data

Under the EU / UK GDPR, we only process your personal data where we have a lawful legal basis:

• Contract Performance (Art. 6(1)(b) GDPR): To process orders, print shipping labels, deliver merchandise, authenticate your Wear + Unlock claim codes, and grant digital media access.
• Legitimate Interests (Art. 6(1)(f) GDPR): To defend against botting attacks, secure user accounts, prevent payment fraud, manage inventory limits, and analyze aggregated platform performance.
• Consent (Art. 6(1)(a) GDPR): Where you explicitly opt in to optional analytics cookies or direct marketing newsletters. You may withdraw consent at any time.
• Legal Obligation (Art. 6(1)(c) GDPR): To maintain sales records, comply with tax laws, and fulfill legitimate law enforcement requests.

4. Cookies & Telemetry

Cookies are small data files stored on your browser. TRUE FAN categorizes cookies into:

• Strictly Necessary: Essential for shopping cart persistence, secure customer login, CSRF security tokens, and Stripe payment processing. Always active.
• Performance & Analytics (Optional): Measures site responsiveness, drop queue times, and traffic sources in anonymized aggregates. Only activated with your consent.
• Preferences & Personalization (Optional): Saves your preferred merchandise sizing and category filters across visits.

5. Sharing & Service Providers

We do not sell, rent, or trade your personal information for monetary compensation. We share data only with the following categories of trusted service providers under strict data protection agreements:

• Payment Processing: Stripe Inc. (PCI-DSS Level 1 certified payment infrastructure).
• Cloud Infrastructure & CDN: Cloudflare (R2 object storage, DDoS mitigation, asset caching).
• Logistics & Carriers: USPS, FedEx, UPS, and DHL to fulfill and deliver physical merchandise.
• Transactional Communications: Brevo / secure SMTP relays for order confirmation and code claim emails.

6. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA"), provides you with specific rights regarding your personal information:

• Right to Know / Access: You may request disclosure of the specific pieces and categories of personal information we have collected about you over the past 12 months.
• Right to Delete: You have the right to request deletion of your personal data, subject to statutory exceptions (e.g., active orders, warranty, tax compliance).
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: You have the right to direct businesses not to "sell" or "share" your personal information for cross-context behavioral advertising. TRUE FAN does not sell personal information for money. You can ensure cross-context sharing is disabled via our "Do Not Sell or Share My Info" toggle.
• Non-Discrimination: We will never deny merchandise, charge different prices, or provide different quality of service if you exercise your privacy rights.

7. European & UK Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you hold the following rights under the General Data Protection Regulation:

• Right of Access (Art. 15): Obtain confirmation of whether your data is being processed and receive a structured copy.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten", Art. 17): Request deletion of your personal data when it is no longer necessary for the purposes for which it was collected.
• Right to Restriction (Art. 18): Restrict processing under certain circumstances (such as pending data accuracy disputes).
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object at any time to processing based on legitimate interests or for direct marketing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local Data Protection Authority (DPA) in the EU or the Information Commissioner’s Office (ICO) in the UK.

8. Data Retention & Security

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected:

• Customer Orders: Retained for 7 years to satisfy statutory tax, accounting, and financial reporting mandates.
• Digital Collectible Records: Retained for the lifetime of your account to verify your permanent ownership of numbered editions.
• Server & Security Logs: Rotated and anonymized after 90 days unless preserved for an active fraud or security investigation.

We implement comprehensive technical and organizational safeguards: all traffic is protected by TLS 1.3 encryption, customer passwords are irreversibly hashed using salted bcrypt, and administrative access requires multi-factor authentication.

9. Children’s Privacy

TRUE FAN is not directed toward children under the age of 13 (or under 16 in California and the EEA). We do not knowingly collect or solicit personal information from children without verified parental consent. If we learn that a child has provided us with personal information, we will delete it promptly.

10. International Transfers

TRUE FAN operations are based in the United States. If you visit from the EEA, UK, or other regions, your information may be transferred to and processed in the United States. We protect cross-border transfers through Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring adequate data protection benchmarks.

11. Contact & Privacy Inquiries

To exercise any of your privacy rights, request data erasure, or ask questions about our data governance practices, please contact our Data Protection Officer: