Privacy policy

1. WHO WE ARE AND SCOPE
TIME WORLDWIDE LLC, trading as Cotoala ("we", "us" or "our"), operates https://cotoala.com. This notice explains personal information processing for our shopping website, purchases and related customer support. Where applicable, we are the controller responsible for that processing.
FOTOCUBE COMPANION APP
Our products use the FotoCube companion application. FotoCube's published privacy notice identifies ZOLA HOME PTE. LTD. and describes processing of account and device information, uploaded media and connected calendar data. Depending on the feature, processing may occur on devices or through cloud services. Its notice describes content and account deletion controls and provides privacy contacts at FotoCubeUserQA@gmail.com and Support@ifotocube.com.
Read FotoCube's privacy notice before connecting accounts or uploading family content: https://www.ifotocube.com/protocol_en.html.
This reference explains the app provider's published practices; it does not replace Cotoala's obligations for information we process. For shopping, orders and Cotoala support, contact support@cotoala.com. You may also contact us for assistance identifying the appropriate app privacy channel.
Cotoala and our customer support staff cannot view your FotoCube photos, calendar entries or family member information through an administrative or support dashboard. This does not mean the app provider never processes that information. If you voluntarily send screenshots or other information to Cotoala support, we process what you send for customer support under this notice. Avoid sending unnecessary private family information.

2. INFORMATION WE PROCESS
Depending on your interaction with the store, information may include:
- Contact and delivery details: name, email, phone number, billing and shipping addresses.
- Order and payment information: items purchased, amounts, payment status, transaction references, returns and refunds. Payment information is processed through the payment services used at checkout; the precise payment details accessible to us depend on the provider. Do not email full card details to us.
- Account information: account identifiers and preferences associated with the account features actually offered.
- Communications: support requests, information voluntarily supplied, and reviews submitted for publication.
- Website and device information: IP address, browser and device details, pages viewed, interactions, referring pages and cookie identifiers, subject to applicable consent requirements and your choices.
We receive information directly from you, through website technologies, and from service providers supporting payment, fulfillment, security and other enabled services. We do not request information unrelated to these purposes merely to collect it.

3. PURPOSES AND LEGAL GROUNDS
We use information to process orders and payments, deliver goods, provide support, manage returns, maintain accounts, prevent fraud, secure the store, comply with legal obligations and improve the shopping experience.
Where applicable European or UK data protection law requires a legal basis, processing may rely on performance of a contract or requested pre-contract steps, legal obligations, consent, or legitimate interests such as proportionate security and service improvement after considering your rights. We seek consent for non-essential tracking and marketing where required. We do not rely on acceptance of shopping terms as blanket consent.
Optional marketing is separate from order fulfillment. You can unsubscribe from promotional emails without stopping essential order or account messages. Our website offers an optional free email newsletter signup associated with extending the commercial warranty from 1 year to a total of 2 years. The signup form must clearly explain that you are subscribing to marketing emails; this is not a paid product-feature subscription. If SMS marketing is offered, the applicable consent and unsubscribe instructions must be provided at signup.

4. COOKIES, ANALYTICS AND ADVERTISING
Essential technologies support functions such as checkout, security and remembering a shopping session. Where enabled and permitted, analytics and advertising technologies help measure visits and campaigns and show relevant advertising. Non-essential technologies must be controlled through the applicable consent and opt-out mechanisms.
We do not sell customer contact lists for money. Some disclosures of online identifiers or browsing activity to advertising partners may nevertheless constitute a "sale", "sharing" or "targeted advertising" under applicable US privacy laws. Such uses are subject to applicable rights and choices; this notice does not claim that all advertising data disclosures fall outside those definitions.
We do not use your identifiable photographs or personal information in advertising creative without your permission. Permission to process an order is not permission to feature you or your family in an advertisement.
MERCHANT CONFIRMATION REQUIRED: Inventory active tools, including any Meta pixel/Conversions API, Google services, Microsoft Clarity, Shopify enhanced services and installed marketing apps. Disclose the actual recipients and data categories. Configure and link working cookie preferences and any required "Your Privacy Choices" or "Do Not Sell or Share My Personal Information" control. Confirm that browser and server-side tracking both respect choices and legally required Global Privacy Control signals. Email requests alone do not replace an online opt-out mechanism where one is required.

5. RECIPIENTS OF INFORMATION
We share information as necessary with Shopify and providers supporting payments, order fulfillment, shipping, hosting, IT, security, customer support and, where enabled and permitted, analytics and advertising. Their access and processing must be appropriate to their services and applicable law.
We may disclose information when you request or authorize it, to meet lawful obligations, protect legal rights, or in a business restructuring subject to applicable safeguards. We do not authorize providers to use information for unrelated purposes contrary to applicable agreements and law.

6. SHOPIFY
Shopify hosts our store and processes information needed to provide its services. If we enable Shopify services that use data across merchants or for Shopify's own purposes, Shopify's own privacy notice explains that processing and available rights. Confirm which enhanced services are actually enabled before publishing specific claims about them.
Shopify Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers
Shopify Privacy Portal: https://privacy.shopify.com/en
These resources supplement, rather than replace, our responsibility for processing we control.

7. SECURITY AND RETENTION
Our shopping website uses HTTPS/TLS to protect information transmitted through secure website connections. We use appropriate technical and organizational safeguards for personal information. No system is perfectly secure; do not send passwords or full payment details through ordinary email or public messages.
We retain information only for as long as reasonably necessary for the purposes described, including fulfilling orders, handling returns and warranty matters, meeting accounting and legal obligations, preventing fraud and resolving disputes. We then delete or anonymize it as appropriate, subject to lawful retention obligations.
MERCHANT CONFIRMATION REQUIRED: Verify HTTPS across checkout and forms, provider access controls, actual retention rules and deletion procedures. Do not publish unsupported claims about end-to-end encryption, certifications or fixed deletion periods.

8. YOUR RIGHTS AND CHOICES
Depending on your location and applicable law, you may request access to, correction or deletion of your information, a portable copy, restriction of processing, objection to certain processing, withdrawal of consent, or opt-out of sale, sharing or targeted advertising. Withdrawing consent does not invalidate processing already lawfully carried out.
Email support@cotoala.com with the subject "Privacy Request". We may reasonably verify your identity and the authority of an agent acting for you without collecting unnecessary information. We respond within applicable legal deadlines and explain any permitted refusal or limitation. We do not unlawfully discriminate against you for exercising your rights.
Use the unsubscribe link in a marketing email to stop promotional email. Use the store's implemented privacy controls for tracking choices; those controls must be active and clearly linked before publication of this notice.
If you disagree with our response, contact us to request review. Where applicable, you may appeal or complain to your local data protection or consumer authority. These options do not depend on first exhausting informal discussions with us where the law provides otherwise.

9. INTERNATIONAL PROCESSING
Shopify and other providers may process information outside your country. Where international transfer restrictions apply, we use the applicable lawful transfer basis and safeguards, such as an adequacy decision or appropriate contractual safeguards. Contact us for information about safeguards relevant to processing we control.
MERCHANT CONFIRMATION REQUIRED: Check actual provider agreements, storage/processing countries and EU/UK transfer mechanisms. Determine whether local representatives or additional jurisdiction-specific disclosures are legally required for the markets served.

10. CHILDREN AND FAMILY INFORMATION
The shopping website is intended for adults making purchases, not for children to create purchasing accounts. If you believe a child has provided information to our shopping website inappropriately, contact support@cotoala.com so we can investigate and take appropriate action.
A family calendar may involve information about children supplied by a parent or guardian. That is different from asserting that the product never processes children's information. Product-specific privacy practices, parental controls and any legally required consent must be verified and disclosed before collection. Do not provide another person's information unless authorized to do so.

11. THIRD-PARTY LINKS AND UPDATES
External websites have their own privacy practices. Review their notices before supplying information. We may update this notice to reflect actual changes and legal requirements, publish the effective date, and provide notice or seek renewed consent where required. A policy change does not retroactively authorize a new incompatible use of existing information.

12. CONTACT
TIME WORLDWIDE LLC, trading as Cotoala
Email: support@cotoala.com
Business contact address: 1417 South Burgandy Trail, Jacksonville, FL 32259, United States
MERCHANT CONFIRMATION REQUIRED: Verify the legal entity, address, contact channel and actual effective date before publication. The duplicated address and unverified phone number from the original text have not been repeated.