Privacy policy

Last updated: 20 September 2026

Koppā Beauty (“Koppā”, “we”, “us” or “our”) is operated by Shapelab FZC, a company registered in Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates. We serve customers worldwide through koppabeauty.com.

This policy explains how we collect, use, disclose and retain personal information when you browse our website, buy products, manage a subscription, use our tools, sign up for communications or contact us. Shapelab FZC is responsible for the personal information it controls. Some providers also process information independently, as explained below. This policy does not replace consent where consent is required.

Privacy contact: [email protected]
Postal address: Shapelab FZC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates.

Do Not Sell or Share My Personal Information · Cookie preferences

1. Personal information we collect

Identity and contact information: your name, email, telephone number and billing and delivery addresses.
Order, account and subscription information: customer identifiers, account preferences, products viewed or purchased, cart contents, transaction and payment status, delivery information, subscription choices and records of returns, refunds or cancellations.
Payment information: payment details provided to checkout and payment providers, together with payment confirmations and transaction information made available to us. Full payment credentials are handled by the relevant payment provider; we do not ask you to send card details by email.
Communications and preferences: enquiries, correspondence, marketing choices, signup details, consent and opt-out records, and information you choose to provide through forms or a routine-finding tool.
Device and online activity: IP address, approximate location derived from it, browser and device details, cookie and other identifiers, referral information, pages and products viewed, clicks, scrolling, cart and checkout activity, and interactions with emails or advertisements.
Inferences: product interests or preferences inferred from shopping and website activity, where used to personalise recommendations or marketing.

We collect information directly from you, automatically through cookies, pixels, logs and similar technologies, and from Shopify, payment, fulfilment, marketing and analytics providers supporting your interactions with us. The information involved depends on the services you use and your choices. If you do not provide details needed for an order, subscription or enquiry, we may be unable to complete it.

Please avoid sending sensitive information that is unnecessary for your request. If you voluntarily provide health-related information in a product or support enquiry, we use it to address that enquiry, subject to applicable law.

1A. Skincare quizzes and your answers

Our optional skincare quizzes ask about your skin type, concerns, sensitivities, skincare goals, current routine and preferences. These answers, and skin-related inferences drawn from them, may reveal health-adjacent or sensitive information. We use them to suggest a skincare routine; the quiz is not a medical diagnosis. You can view your recommendations without providing an email address.

What is processed and stored:

In your browser: your selections are held in the page while the quiz calculates and displays your recommendations. If you add your recommended routine to the cart, we may save a recommended product reference and expiry time in browser session storage to support that shopping session.
Our custom quiz analytics, with analytics consent: we send Amplitude coded answer choices, question numbers, quiz and attempt identifiers, completion status, timing and recommended products. Codes still represent your selected answers; they are not anonymous simply because they are coded. These events may be associated with browser/device identifiers and, where available, customer identifiers such as an email address or customer ID. We also keep recent quiz completion and recommendation context in browser session storage and use it for up to 30 minutes to understand the journey from quiz to purchase. Browser session storage normally lasts for the tab session; the 30-minute context window does not mean server-side analytics records are deleted after 30 minutes. Consented session-replay tools may also capture interactions with quiz pages, subject to their masking settings.
If you choose email signup or giveaway entry: Shopify stores your submitted email address and signup/quiz/giveaway participation tags, including the relevant giveaway month. The quiz signup form does not submit your individual answer choices to Shopify as customer-form fields. Contact and participation records may be processed by the service providers described in this policy for the signup or giveaway.

How we use this information: to provide your requested recommendations, support your shopping session, administer an optional signup or giveaway, and, with analytics consent, understand and improve the quiz and shopping experience. Providers supporting these purposes may process the relevant information on our behalf. We treat answer codes and skin-related inferences as quiz information too.

No advertising targeting: we do not use your quiz answers, coded answer choices or skin-related inferences from the quiz to target or personalise advertising, build advertising audiences, or retarget you. We do not sell or share this information with advertising partners for those purposes. The general descriptions of advertising, marketing and inferred interests elsewhere in this policy do not permit those uses of quiz information. Any separate email-marketing choice does not authorise advertising targeting based on your quiz answers.

Retention and your choices: quiz analytics and linked records under our control follow the 12-month standard retention period and limited exceptions in section 8. You can decline or withdraw optional analytics through Cookie preferences and still use the quiz. Withdrawing analytics consent stops our custom quiz-event tracking; it does not by itself delete records already collected. To request access, correction or deletion of quiz-related information, email [email protected]. We will handle your request under the rights and verification process in section 10.

2. Why we use personal information

To accept and process purchases, take payments, deliver orders, manage subscriptions and handle returns, refunds and support.
To communicate about your orders, account, subscription or enquiries and send requested availability notifications.
To operate, secure and improve the website, remember appropriate preferences, troubleshoot problems and prevent fraud or misuse.
To understand shopping behaviour, measure website and campaign performance, and personalise product recommendations.
To send marketing and deliver or measure advertising, subject to your choices and applicable consent requirements.
To maintain required business records, comply with legal obligations, respond to lawful requests and establish, exercise or defend legal claims.

Where the EEA or UK GDPR applies, we rely on performance of a contract for purchases, subscriptions and related support; legal obligations for required records and lawful disclosures; consent where required for optional tracking, marketing or sensitive information; and legitimate interests for proportionate security, fraud prevention, service improvement and business administration where those interests are not overridden by your rights. Where another law requires consent or a different lawful basis, we follow that requirement. You may withdraw consent at any time without affecting processing already lawfully carried out.

3. Providers and recipients

We use the following providers and connected services. Their access depends on the service, integration permissions, privacy settings and applicable law. Providers acting on our behalf process information to provide their services; some platform, payment and advertising providers also act independently under their own privacy notices.

Shopify hosts the store and checkout and provides customer accounts, Shop/Shop Pay, Shopify Payments, Messaging, Subscriptions, security and consent records. It processes shopping activity, account and contact details, transactions and device information. Shopify's enhanced services are described in the Relationship with Shopify section below.
Google, including Google Analytics 4 provides website analytics and, where enabled, advertising and campaign measurement. Google Analytics 4 measures visits, pages, interactions and shopping activity using browser/device information, identifiers and referral information. Google privacy notice.
Meta (Facebook and Instagram) provides advertising measurement and targeting. Our Meta integration can process page and shopping events, device/browser identifiers and, where supplied through our commerce integration, customer matching and purchase information. Meta privacy notice.
Amplitude provides product and shopping analytics, including pages viewed, product and cart interactions, checkout and purchase events, device identifiers and, where supplied, customer identifiers and order/contact information. We also use session replay to understand how visitors interact with the site. Amplitude privacy notice.
Microsoft Clarity provides interaction analytics, heatmaps and session replay using browser/device information and activity such as clicks and scrolling. Microsoft privacy notice.
Klaviyo provides email/SMS marketing tools, signup and back-in-stock forms, customer profiles and onsite/shopping-event measurement. Information can include submitted contact details, communication preferences, device identifiers and browsing, cart or order events. Email/SMS subscriptions are separate from cookie preferences. Klaviyo privacy notice.
Selleasy (LogBase) provides product recommendations, upsell offers and offer/conversion measurement. Information can include products and offers viewed or clicked, cart contents, device storage identifiers and order/conversion information. LogBase privacy notice.
Our third-party warehousing, fulfilment and delivery providers receive the order, product, contact and delivery details needed to store, pack, dispatch and deliver your purchases and handle fulfilment enquiries.
PayPal, where selected at checkout, processes payment and transaction information under its own privacy notice. Other available payment methods and wallets are identified at checkout.
hCaptcha (Intuition Machines) provides bot protection on forms, including privacy-request forms, and can process browser/device and interaction information for security. hCaptcha privacy notice.
jsDelivr delivers some website software, including the Amplitude library, and receives network information such as IP address and browser request details when those resources are requested. jsDelivr privacy notice.

Our connected administrative tools include Claude (Anthropic), ChatGPT/Codex (OpenAI), Lovable, Shopify's CLI Connector and Theme Access, and our internal Koppa HQ integration. When staff use these tools, store records may be accessed within the permissions granted to each integration for administration, analysis, development and support. They are distinct from visitor-facing advertising pixels.

Session replay reconstructs interactions with pages; it is different from recording your camera or microphone. Do not submit sensitive information in fields that do not request it. We use available masking controls, but the data collected depends on the page and integration configuration.

We may disclose relevant information to professional advisers or authorities where necessary and lawful, and in connection with a proposed or completed business transfer, subject to applicable protections. We do not disclose more information than is appropriate for the relevant purpose.

4. Our relationship with Shopify

Shopify hosts our store and checkout and processes information to provide, secure and improve those services. We use Shopify features that may combine information about interactions with our store, other merchants and Shopify to support enhanced services, including personalisation and advertising. For processing for which Shopify is independently responsible, consult the Shopify Consumer Privacy Policy and Shopify Privacy Portal. Requests about information controlled by Koppā can be sent directly to us.

5. We never sell personal information for money

We never sell your personal information for money. We disclose information to operate our business and support the purposes described in this policy. Disclosures to advertising partners, including online identifiers, contact identifiers used for matching, browsing activity, purchase events and inferred interests, may constitute a “sale”, “sharing” or “targeted advertising” under certain privacy laws even where no money changes hands.

To exercise an applicable opt-out right, use Do Not Sell or Share My Personal Information. Shopify's form provides a browser/device opt-out and an optional account opt-out in supported regions. If the form is unavailable in your region, you can manage optional tracking through Cookie preferences or contact [email protected].

Where applicable, a supported Global Privacy Control signal is treated as an opt-out for the browser and device sending it and, where the platform can associate it with your account, that account. Ordinary “Do Not Track” signals are different and are not currently treated as a separate opt-out instruction. Browser choices may need to be renewed if you clear cookies or use another browser or device. Opting out does not prevent you from shopping or stop all advertising.

6. Cookies, analytics, session replay and marketing

Essential technologies support the cart, checkout, security and saved privacy choices. Optional technologies support analytics, personalisation and advertising. Our site provides Cookie preferences to accept or decline optional categories and revisit your choices. Where consent is required, optional technologies are subject to that consent.

Amplitude and Microsoft Clarity help us understand page interactions, including through session replay. Session replay reconstructs website interactions rather than recording your camera or microphone. We use available masking controls; the information involved depends on the page and configuration.

Email subscriptions are separate from cookie preferences. You can unsubscribe using the link in a marketing email. If you subscribe to SMS marketing, follow the opt-out instructions in the message. Withdrawing marketing consent does not stop necessary order, subscription, security or service communications. We may keep a limited suppression record to avoid contacting you again for marketing.

7. International processing and transfers

Koppā is registered in the UAE and uses providers with international operations. Information may be accessed, stored or processed outside the UAE or your country of residence, including in the United States, Canada and European countries, as well as countries in which fulfilment and delivery take place.

Shopify operates internationally, including in Canada and the United States. Klaviyo stores customer data in the United States, and our Amplitude integration is configured for the US region. Google and Meta operate global infrastructure. These are examples, not an exhaustive list of every provider location; locations depend on the service and its supporting providers.

Privacy laws may differ between countries. Where required, international transfers are subject to an applicable lawful transfer mechanism and safeguards, such as recognised adequacy arrangements or contractual protections. For transfers subject to EEA or UK rules, these may include applicable standard contractual clauses or UK transfer terms. Contact us to request information about the safeguards relevant to your information.

8. How long we retain information

Our standard retention period is 12 months from collection for personal information under our control, subject to the exceptions below. Information is deleted or anonymised when its applicable retention period ends and it is no longer needed for a lawful purpose.

Active services: information needed to fulfil an outstanding order, maintain an account or provide an active subscription may be retained while that service continues and for the period needed to close it out or meet a legal obligation.
Tax and accounting records: relevant transaction records are retained for the legally required period. Where UAE corporate-tax recordkeeping requirements apply, this is at least seven years after the end of the relevant tax period. Other mandatory periods or lawful preservation requirements may apply to particular records.
Disputes, security and legal claims: relevant records may be retained for the time reasonably necessary and legally permitted to investigate an incident, resolve a dispute, meet a preservation obligation or establish, exercise or defend a claim.
Privacy choices: limited consent, opt-out and suppression records may be retained for as long as necessary to respect your choices and demonstrate compliance.

Exceptions apply only to information needed for the stated purpose. Information held by a provider acting independently, including certain payment or platform records, is subject to that provider's retention obligations and privacy notice. Our 12-month standard is not a representation that every third-party platform automatically deletes all records after 12 months. Contact us to request deletion or ask about a particular category.

9. Security

We take reasonable technical and organisational measures to protect personal information from loss, misuse and unauthorised access, alteration or disclosure. No transmission or storage system is completely secure. Please keep account access details secure and avoid sending payment credentials or unnecessary sensitive information through email or ordinary contact forms.

10. Your rights and how to exercise them

Depending on applicable law, you may have rights to access or know what information we hold, obtain a copy, correct inaccurate information, request deletion, receive portable information, restrict or object to processing, withdraw consent, opt out of sale/sharing or targeted advertising, or exercise rights concerning certain automated decisions.

Email [email protected] or write to our postal address above. Describe your request and provide sufficient information to locate the relevant records. We may verify identity for access, correction or deletion requests where appropriate, using only information reasonably needed for verification. You do not need to create an account to submit a request. Sale/sharing opt-outs do not require the identity verification used for access requests.

You may use an authorised agent where permitted; we may ask for evidence of authority and, where lawful, verify your identity directly. We respond within applicable legal time limits and explain any lawful refusal or extension. We will not unlawfully discriminate against you for exercising privacy rights. Where an exception prevents deletion, we retain only what is necessary for the relevant purpose.

UAE: you may exercise rights available under applicable UAE data-protection law, including requests for information, correction, erasure and restriction or cessation of processing, subject to the law's conditions and exceptions.

EEA and UK: where applicable, you may also object to processing based on legitimate interests, object to direct marketing and withdraw consent. You can complain to your local supervisory authority. EEA supervisory authorities; UK Information Commissioner's Office.

Canada and Australia: you may request access or correction and raise a complaint under applicable law. Canadian customers may withdraw consent subject to lawful restrictions; we will explain relevant consequences. Australian customers may contact the Office of the Australian Information Commissioner where applicable.

11. Additional information for US residents

Where applicable state privacy laws cover our processing, the rights above include access/knowledge, correction, deletion, portability, opt-outs and non-discrimination. The following summarises categories collected or disclosed through the services described in this policy, including during the preceding 12 months to the extent those services were used:

Identifiers and contact details: used for accounts, orders, support and communications; disclosed to Shopify, payment and fulfilment providers, Klaviyo and relevant support/administrative providers. Contact and online identifiers may also be disclosed to advertising partners for matching, subject to choices.
Commercial information: purchases, cart, subscription and transaction information used for commerce, service, analysis and marketing; disclosed to relevant store, payment, fulfilment, marketing, recommendation and analytics providers. Purchase events may be disclosed to advertising partners.
Internet/device activity and approximate location: used for site operation, security, analytics and advertising; disclosed to relevant hosting, security, analytics and marketing partners.
Communications and inferences: enquiries and preferences used for support and personalisation, and product-interest inferences used for recommendations or marketing; disclosed to relevant support, administrative, analytics or marketing providers as needed.
Payment credentials and sensitive information: payment providers handle payment credentials for transactions; information you voluntarily provide in support enquiries is used to address them. Such information is not requested for advertising targeting.

The sources, purposes, recipient categories and retention criteria are described above. Advertising disclosures of identifiers, commercial activity, internet activity and inferred interests may be considered sale or sharing. We do not sell personal information for money. Use Do Not Sell or Share My Personal Information to exercise an applicable opt-out. If you have a right to limit use of sensitive information, contact us. We do not knowingly sell or share personal information of children under 16.

If applicable law gives you a right to appeal a privacy decision, email us with the subject “Privacy appeal”. We will review the decision and respond within the applicable period, including information about further complaint options where required.

12. Children, complaints and policy changes

Our services are intended for adults aged 18 and over. We do not knowingly collect children's personal information. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action, including deletion where required.

For a privacy complaint, email [email protected] with details of your concern. We will investigate and respond within applicable legal time limits. You may also contact the competent privacy authority where you live or where the relevant processing occurs. This does not restrict any statutory complaint or court rights.

Third-party websites linked from our services have their own privacy practices. We may update this policy as our services, practices or legal obligations change. We will update the date above and provide additional notice or request consent where required.

Contact: Shapelab FZC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates · [email protected].