Privacy policy

Privacy Policy

Last updated: September 15, 2026

Elrak is owned and run by Kara Joy Ortriz, a sole proprietor at 19 Bender Court, Portsmouth, VA 23702, United States. This policy sets out what we collect when you visit or buy from elrakus.com, why, who else sees it, and what you can require of us. It is written against FTC requirements, the Virginia Consumer Protection Act, and the Virginia Consumer Data Protection Act (VCDPA).

1. What We Collect

  • Name: first and last.
  • Contact details: email address, plus a phone number if you supply one for delivery.
  • Shipping details: the delivery address on your order.
  • Order history: items bought, value, date, and confirmation that payment cleared. Full card numbers never reach us.
  • Technical data: IP address, browser and device type, referring page, and pages viewed, collected through cookies and analytics.
  • Correspondence: emails, contact form messages, and return requests, including attachments.

We do not knowingly collect data from anyone under 18. We do not collect sensitive categories as the VCDPA defines them, meaning no health, biometric, genetic, precise geolocation, immigration, or racial and ethnic origin data.

2. Where It Comes From

  • From you, at checkout, through a form, or by email.
  • Automatically as you browse, through the cookies described in our Cookie Policy.
  • From the platforms operating the store on our behalf, principally Shopify, and from analytics providers.

3. What We Do With It

  • Take, process, pack, and deliver your order.
  • Send transactional email: confirmations, dispatch notices, tracking updates, return correspondence.
  • Answer questions and handle complaints, returns, and warranty claims.
  • Detect and prevent fraudulent orders and payment abuse.
  • Meet tax, accounting, and other legal obligations.
  • Understand how the store is used and improve it, where you consented to analytics.
  • Send marketing email, only where you opted in, never as a condition of purchase.

4. Retention

  • Orders and payment records: 7 years, as tax and accounting rules require.
  • Support and returns correspondence: 3 years from the final message.
  • Marketing lists: until you unsubscribe, after which only a suppression record remains so we do not contact you again.
  • Analytics and technical data: 13 months maximum.

5. Who Else Receives It

Elrak does not sell personal data and does not process it for targeted advertising as defined by the VCDPA. We disclose it only to the providers who make the business run, and only to the extent each needs:

  • Shopify Inc., which hosts the store and processes orders.
  • Shopify Payments and the card networks, which handle payment. They receive card data directly; we do not.
  • Carriers and fulfilment partners, which receive the name, address, and contact details required to deliver.
  • ParcelPanel, which matches tracking numbers to orders for the tracking page.
  • Google Analytics, for aggregate usage, subject to your cookie consent.
  • Meta and Google Ads, for advertising measurement, subject to your cookie consent.

We also disclose where a law, subpoena, or court order compels it, or where necessary to establish or defend a legal claim.

6. Security

The store runs over encrypted HTTPS. Payment data stays inside PCI DSS certified systems we never touch. Administrative access is limited to the owner and protected by two-factor authentication. No system is beyond failure, and should a breach put your data at risk we will notify affected customers and the relevant authorities without undue delay.

7. Your Rights Under the VCDPA

Virginia residents may:

  • Confirm and access the personal data we hold about you.
  • Correct inaccuracies in it.
  • Delete it, subject to records we are legally required to keep.
  • Obtain a copy in a portable, machine-readable format.
  • Opt out of targeted advertising, sale of personal data, and profiling with legal or similarly significant effects. We do none of these, so the right is satisfied by default.
  • Appeal a refusal. If we decline a request, we will explain why and tell you how to appeal. We answer appeals within 60 days, and if we reject an appeal we will give you a route to complain to the Virginia Attorney General.

8. Customers in Other States

Residents of California, Colorado, Connecticut, Utah, Texas, Oregon, Maryland, and other states with comprehensive privacy statutes hold comparable rights. Rather than sort customers by ZIP code, Elrak extends the same rights and the same response times to everyone in the United States. California residents additionally have the CCPA right to be free from discrimination for exercising them, which we observe.

9. Visitors from Outside the United States

Elrak ships only within the United States, so we do not sell to customers in the European Economic Area or the United Kingdom. The site is nonetheless reachable worldwide. If you browse from the EEA or the UK, the limited data collected during that visit is processed on the basis of your cookie consent, you may withdraw it at any time, and you may write to info@elrakus.com to request access to it or its deletion.

10. Data Processed Abroad

Providers including Shopify and Google run global infrastructure and may process data on servers outside the United States. Where that happens, transfers are covered by standard contractual clauses or equivalent safeguards in our agreements with them.

11. Making a Request

Email info@elrakus.com with "Privacy Request" in the subject. Name the right you are exercising and give us enough detail, such as the email address on your orders, to identify your records reliably. We may ask one follow-up question to verify identity, precisely so nobody else can obtain or erase your data.

We respond within 45 days, extendable once by a further 45 days where a request is genuinely complex, in which case we tell you before the first period expires. There is no charge. Authorised agents may act for you with written proof of authority.

12. Complaints

Unhappy with how a request was handled? Contact the Virginia Office of the Attorney General at oag.state.va.us or 1-800-552-9963, or the Federal Trade Commission at reportfraud.ftc.gov. California residents may also contact the California Privacy Protection Agency.

13. Changes

This policy is updated when our practices or the law change. The date at the top identifies the current version, and material changes will be announced on the store.

14. Contact

  • Email: info@elrakus.com
  • Post: Kara Joy Ortriz, Elrak, 19 Bender Court, Portsmouth, VA 23702, United States