Privacy policy

PRIVACY POLICY

Operator: Star Thing LLC d/b/a Kremage
Website: kremage.com
iOS App: Kremage
Effective: September 19, 2026
Version: 4.1

1. Introduction

Star Thing LLC, doing business as Kremage (“Kremage,” “we,” “us,” or “our”), respects your privacy and is committed to handling personal information responsibly.

This Privacy Policy explains how we collect, use, disclose, retain, and otherwise process personal information when you:

• visit kremage.com;
• use the Kremage iOS application;
• create or use a Kremage account;
• browse, search, save, or purchase products;
• use Shop Pay, Apple Pay, Google Pay, payment cards, or other supported payment methods;
• contact customer support;
• request a return, refund, cancellation, replacement, or shipping investigation;
• participate in promotions or marketing;
• interact with push notifications or other app features;
• interact with Kremage advertising or social-media content;
• otherwise use Kremage products or services.

This Policy also explains certain privacy rights that may apply depending on where you live.

2. Who We Are

Star Thing LLC d/b/a Kremage
Website: kremage.com
Email: afterglow@kremage.com
Phone: (718) 501-9424

Mailing address for correspondence:

447 Broadway
New York, NY 10013
United States

For privacy questions or privacy-rights requests, contact:

afterglow@kremage.com

3. Personal Information We Collect

The information we collect depends on how you interact with Kremage.

A. Identity and Contact Information

We may collect:

• name;
• email address;
• telephone number;
• billing address;
• shipping address;
• account username or profile information;
• customer-support contact details.

B. Order and Transaction Information

We may collect:

• order number;
• products purchased;
• variants;
• quantities;
• pricing;
• discounts;
• taxes;
• shipping charges;
• order status;
• fulfillment information;
• Partner Brand fulfillment information;
• tracking information;
• returns;
• refunds;
• cancellations;
• replacements;
• customer notes;
• transaction history.

C. Payment and Authentication Information

Payments may be processed by Shopify Payments, Stripe infrastructure, banks, card networks, digital-wallet providers, and other payment providers.

Kremage generally does not receive or store your complete payment-card number or CVV where those details are handled directly by the payment provider.

We may receive or process related information such as:

• transaction identifiers;
• payment-method type;
• card brand;
• partial card details such as the last digits where provided;
• authorization status;
• payment status;
• AVS results;
• CVV verification results;
• 3-D Secure or other authentication results;
• tokenized-payment or digital-wallet indicators;
• refund and dispute information.

D. Shipping and Fulfillment Information

We may collect:

• shipping address;
• carrier;
• tracking number;
• package status;
• delivery confirmation;
• delivery date and time;
• signature information;
• delivery photographs where provided by the carrier;
• package weight;
• fulfillment location;
• serial numbers or other product identifiers where applicable;
• customs or import information reasonably necessary to fulfill international orders.

E. Website and Device Information

When you use kremage.com, we may automatically receive information such as:

• IP address;
• browser type;
• operating system;
• device type;
• language settings;
• referring pages;
• pages viewed;
• products viewed;
• search activity;
• cart activity;
• checkout activity;
• timestamps;
• cookie or similar identifiers;
• general or approximate location derived from IP;
• interaction data;
• fraud and security signals.

F. Mobile App Information

When you use the Kremage iOS app, we may collect or receive information associated with your use of the app, depending on the app features you use and the permissions you grant.

This may include:

• account and profile information;
• product views and searches;
• cart activity;
• saved items or favorites;
• purchase activity;
• order and fulfillment information;
• device type;
• operating-system version;
• app version;
• device or application identifiers where permitted;
• IP address;
• approximate location derived from IP;
• crash information;
• diagnostic information;
• app-performance information;
• notification preferences;
• interactions with push notifications;
• authentication, security, and fraud-risk signals;
• information generated through third-party SDKs or service providers used by the app.

G. Customer Support and Communications

We may collect information you provide in:

• emails;
• support requests;
• return requests;
• refund requests;
• shipping claims;
• photographs;
• videos;
• attachments;
• dispute communications;
• reviews;
• survey responses;
• telephone communications;
• other correspondence.

H. Fraud, Risk, and Transaction-Integrity Information

To protect Kremage, customers, Partner Brands, carriers, and payment providers, we may process information such as:

• billing/shipping consistency;
• IP and geographic consistency;
• device or browser information;
• order velocity;
• transaction history;
• prior successful or disputed orders;
• chargeback history where available;
• fraud-risk scores or indicators;
• authentication results;
• delivery records;
• return tracking;
• package weights;
• product identifiers;
• serial numbers;
• return inspection results;
• customer communications;
• other transaction-related signals reasonably used to detect or investigate fraud or abuse.

4. Information We Receive From Other Sources

We may receive information from:

• Shopify;
• Shopify Payments;
• payment processors;
• card networks;
• banks;
• Apple Pay;
• Google Pay;
• Shop Pay;
• Partner Brands;
• carriers;
• fulfillment providers;
• fraud-prevention providers;
• analytics providers;
• marketing providers;
• customer-support providers;
• social-media platforms;
• app analytics or crash-reporting providers;
• other service providers involved in operating Kremage.

Where applicable privacy law requires disclosure of information obtained from other sources, we provide the categories of information and relevant processing purposes in this Policy. UK GDPR guidance specifically requires transparency about categories and sources where data was not obtained directly from the individual.

5. How We Use Personal Information

We may use personal information to:

A. Provide Kremage Services

Including to:

• operate kremage.com and the Kremage iOS app;
• create and manage accounts;
• maintain shopping carts and saved items;
• process orders;
• process payments;
• arrange fulfillment and shipping;
• send order confirmations;
• provide tracking;
• process returns, refunds, cancellations, and replacements;
• communicate about orders;
• provide customer support.

B. Verify Transactions and Prevent Fraud

We may use transaction and device information to:

• verify payment authorization;
• detect account takeover;
• detect unauthorized card use;
• detect card testing;
• detect suspicious order velocity;
• detect empty-box returns;
• detect return substitution;
• detect counterfeit returns;
• detect false non-delivery claims;
• detect fabricated damage claims;
• detect duplicate recovery;
• detect promotion or coupon abuse;
• verify high-value or higher-risk transactions;
• protect customers and Kremage against fraud.

C. Resolve Payment Disputes and Chargebacks

We may retain and use information relevant to payment disputes, including:

• transaction records;
• authorization results;
• AVS/CVV results;
• 3-D Secure results;
• wallet or tokenized-payment indicators;
• shipping and billing details;
• IP and device information;
• product descriptions;
• applicable policy versions;
• checkout disclosures;
• customer acknowledgments;
• order history;
• fulfillment information;
• package weight;
• tracking;
• delivery confirmation;
• signatures;
• serial numbers;
• customer communications;
• refunds;
• return tracking;
• inspection records.

We may submit relevant evidence to authorized dispute participants where reasonably necessary to establish, exercise, or defend Kremage’s rights.

D. Improve the Website and App

We may use information to:

• troubleshoot errors;
• diagnose crashes;
• improve app performance;
• improve website performance;
• understand how customers use Kremage;
• improve navigation;
• improve product discovery;
• improve checkout;
• evaluate feature performance;
• maintain security.

E. Communicate With You

We may send:

• order confirmations;
• shipping notifications;
• delivery notifications;
• transaction-verification messages;
• return/refund communications;
• account notices;
• security notices;
• service announcements;
• customer-support responses.

Where permitted and with any consent required by law, we may also send:

• promotional emails;
• offers;
• product recommendations;
• push notifications;
• other marketing communications.

F. Legal and Compliance Purposes

We may process information to:

• comply with tax and accounting obligations;
• comply with consumer-protection laws;
• respond to valid legal requests;
• enforce our Terms and policies;
• prevent abuse;
• protect legal rights;
• investigate suspected misconduct;
• establish, exercise, or defend legal claims;
• cooperate with regulators or law enforcement where legally required or appropriate.

6. Legal Bases for Processing in the EEA and UK

Where GDPR or UK GDPR applies, we may process personal data under one or more of the following legal bases:

Contract

Processing necessary to:

• process an order;
• accept payment;
• fulfill and deliver goods;
• administer returns;
• provide customer support;
• manage accounts;
• perform our contractual obligations.

Legitimate Interests

We may rely on legitimate interests where appropriate, including:

• preventing fraud;
• securing accounts;
• detecting abuse;
• improving services;
• protecting Kremage and customers;
• responding to disputes;
• defending legal claims;
• maintaining records necessary for business operations.

Where we rely on legitimate interests, we consider the interests and rights of affected individuals.

Legal Obligation

We may process information where necessary to comply with:

• tax laws;
• accounting laws;
• consumer-protection obligations;
• regulatory obligations;
• court orders;
• valid governmental requests.

Consent

We may rely on consent where required, including for certain:

• marketing communications;
• optional cookies or analytics;
• iOS permissions;
• advertising or tracking activities.

Where processing is based on consent, you may withdraw consent as permitted by law.

UK guidance requires businesses to identify the purposes and legal bases of processing and, where applicable, explain the legitimate interests relied upon.

7. Cookies and Similar Technologies

Kremage and its service providers may use:

• cookies;
• pixels;
• tags;
• local storage;
• software development kits;
• similar technologies.

These may be used for:

• essential website functions;
• account authentication;
• cart persistence;
• security;
• fraud prevention;
• analytics;
• preferences;
• advertising;
• attribution;
• performance measurement.

Where applicable law requires consent for non-essential cookies or similar technologies, Kremage will seek that consent.

You may also be able to control certain cookies through your browser or Kremage cookie-management tools where available.

8. iOS Permissions

The Kremage iOS app may request access to device features where needed for functionality you choose to use.

Depending on the current app version, these permissions may include:

• push notifications;
• camera access;
• photo-library access;
• other iOS-protected resources.

Apple system permission prompts are used where required.

You may review or revoke device permissions through your iPhone settings.

Kremage does not treat denial of an optional device permission as permission to bypass that choice through another method.

9. App Tracking Transparency

If Kremage or a third-party SDK engages in activity Apple defines as “tracking,” Kremage will request permission through Apple’s App Tracking Transparency framework where required.

If you decline that permission, Kremage will not intentionally use another identifier to circumvent your ATT choice.

Apple defines tracking generally as linking app data with data from other companies’ apps, websites, or offline properties for targeted advertising or advertising measurement.

Fraud prevention, security, and certain other processing may fall outside Apple’s definition of advertising tracking when used solely for permitted security purposes.

10. Push Notifications

If you allow push notifications, Kremage may send:

• order updates;
• shipping updates;
• security notices;
• account notices;
• product or promotional notifications where permitted.

You can manage push-notification permissions through your device settings.

Disabling promotional notifications does not prevent us from sending transactional or security communications where otherwise permitted.

11. Analytics and Diagnostics

Kremage may use analytics and diagnostics providers to understand website and app performance.

These services may process information such as:

• device information;
• app version;
• crash reports;
• session information;
• interactions;
• technical errors;
• performance information;
• approximate location;
• identifiers where permitted.

We use such information to maintain, secure, and improve Kremage services.

Ask, our AI shopping assistant. Ask is an AI assistant, not a person. If you use it, what you type is read by a language model that runs in your browser, and questions about our policies are sent to Shopify, which runs our store, to find answers. Shopify may keep these questions to answer you and to help us improve the answers. The last few questions are also kept in your browser for the session. Please don’t type health or other sensitive details into Ask.

Studio. Photos you add to Studio stay in your browser on your device. They are not uploaded to Kremage or anyone else, and Studio does not detect or measure faces.

Providers we use. Shopify (store, checkout, analytics and customer events), Klaviyo (email, if you sign up), Google (Google Analytics and Google’s sales channel through Shopify), and Judge.me (reviews). Our site’s own events go only to Shopify’s customer-events system and respect your cookie and privacy choices, including Global Privacy Control.

12. Advertising and Marketing

Kremage may use information to:

• measure advertising effectiveness;
• understand campaign performance;
• personalize marketing where permitted;
• build audiences where lawfully permitted;
• attribute purchases or app installs to campaigns.

Where legally required, we seek consent before using personal information for targeted advertising or cross-company tracking.

California residents may also have rights concerning the sale or sharing of personal information, as described below. California law includes rights to know, delete, correct, opt out of sale or sharing, and avoid discrimination for exercising privacy rights.

13. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients when reasonably necessary:

Shopify and Ecommerce Providers

For:

• website hosting;
• checkout;
• account management;
• order processing;
• ecommerce operations;
• fraud analysis.

Payment Providers

Including:

• Shopify Payments;
• Stripe;
• banks;
• payment processors;
• wallet providers;
• card networks.

For:

• payment authorization;
• settlement;
• fraud prevention;
• refunds;
• disputes;
• chargebacks.

Partner Brands and Fulfillment Providers

We may disclose information necessary to:

• fulfill an order;
• prepare a shipment;
• process a return;
• resolve a product issue;
• administer warranty or support.

This may include:

• name;
• shipping address;
• phone number;
• email where needed;
• product/order details;
• return information.

Carriers and Logistics Providers

For:

• shipping;
• delivery;
• customs processing;
• returns;
• delivery investigations.

Fraud Prevention and Security Providers

For:

• transaction verification;
• identity/address checks;
• risk scoring;
• fraud investigation;
• abuse prevention.

Analytics and Technology Providers

For:

• app analytics;
• website analytics;
• crash reporting;
• performance monitoring;
• security;
• customer support.

Marketing and Advertising Providers

Where permitted by law and subject to applicable consent or opt-out requirements.

Professional Advisers

Including:

• attorneys;
• accountants;
• auditors;
• insurers;
• consultants.

Government and Legal Authorities

Where required or permitted by law, including in connection with:

• subpoenas;
• court orders;
• legal investigations;
• fraud investigations;
• safety issues;
• regulatory obligations.

14. Payment Disputes and Claims

When reasonably necessary to investigate or respond to:

• payment disputes;
• chargebacks;
• return disputes;
• shipping claims;
• insurance claims;
• suspected fraud;
• legal claims,

Kremage may disclose relevant information to:

• Shopify Payments;
• Stripe or another processor;
• Apple Pay;
• Google Pay;
• Shop Pay;
• Visa;
• Mastercard;
• American Express;
• Discover;
• issuing banks;
• acquiring banks;
• Partner Brands;
• carriers;
• insurers;
• fraud-prevention vendors;
• legal advisers;
• regulators;
• law enforcement.

We limit disclosures to information reasonably relevant to the dispute, claim, investigation, or legal requirement.

15. Sale or Sharing of Personal Information

Kremage does not sell personal information for money in the ordinary sense.

However, certain advertising, analytics, or cross-context behavioral advertising activities may be treated as “sale” or “sharing” under some privacy laws even where no money changes hands.

Where applicable law requires an opt-out mechanism, Kremage will provide one.

We will also honor legally required signals such as Global Privacy Control where applicable.

California law expressly recognizes a right to opt out of sale or sharing and requires businesses subject to the law to honor applicable opt-out mechanisms.

16. Sensitive Personal Information

Kremage does not intentionally seek sensitive personal information unless reasonably necessary for a transaction, legal requirement, security purpose, or feature requested by the user.

Sensitive information may include certain:

• payment information;
• account credentials;
• precise geolocation;
• government identifiers;
• other information treated as sensitive under applicable law.

Where applicable law provides a right to limit use of sensitive personal information, Kremage will honor that right where required.

Residents of Washington, Nevada and Connecticut: see our Consumer Health Data Privacy Policy.

17. International Data Transfers

Kremage operates from the United States and serves customers in selected international markets.

Personal information may therefore be transferred to, stored in, or processed in:

• the United States;
• the country where the customer lives;
• countries where Shopify operates;
• countries where payment providers operate;
• countries where Partner Brands or carriers operate;
• countries where other service providers operate.

Where GDPR, UK GDPR, or another law requires safeguards for international transfers, Kremage relies on appropriate transfer mechanisms where applicable, such as:

• adequacy decisions;
• standard contractual clauses;
• approved contractual safeguards;
• other lawful transfer mechanisms.

You may contact afterglow@kremage.com for more information about applicable transfer safeguards.

UK privacy guidance requires transparency regarding international transfers and, where relevant, the safeguards used.

18. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy.

Retention may depend on:

• whether you maintain an account;
• whether an order remains active;
• legal obligations;
• accounting and tax requirements;
• warranty obligations;
• consumer-protection obligations;
• payment-network dispute windows;
• fraud-prevention needs;
• chargeback defense;
• insurance requirements;
• legal claims;
• litigation holds;
• contractual obligations.

For example, transaction and fulfillment records may be retained longer than ordinary app-usage data because they may be necessary for:

• tax compliance;
• accounting;
• dispute defense;
• fraud prevention;
• warranty claims;
• consumer-law compliance.

Where continued retention is unnecessary, information may be:

• deleted;
• anonymized;
• de-identified.

19. Security

Kremage uses reasonable administrative, technical, and organizational safeguards designed to protect personal information.

These may include:

• access controls;
• authentication;
• encryption provided by relevant platforms;
• payment tokenization;
• fraud monitoring;
• secure service providers;
• restricted access to customer information.

No internet, mobile-app, payment, or storage system can be guaranteed to be completely secure.

20. Account Security

Customers are responsible for maintaining the confidentiality of their account credentials.

You should notify Kremage promptly if you believe:

• your account has been compromised;
• an order was placed without authorization;
• your login credentials have been exposed.

Kremage may temporarily restrict an account or order while investigating suspected account takeover.

21. Account and Data Deletion

You may request deletion of your Kremage account and associated eligible personal information by:

• using any account-deletion feature made available in the Kremage iOS app or account settings; or
• contacting afterglow@kremage.com.

We will delete or de-identify eligible personal information subject to applicable law and lawful retention requirements.

We may retain information reasonably necessary for:

• completed transactions;
• accounting;
• taxes;
• fraud prevention;
• chargeback defense;
• warranties;
• consumer-law compliance;
• legal claims;
• regulatory obligations;
• security.

Deleting an account does not require Kremage to delete information we are legally required or otherwise lawfully permitted to retain.

22. Your Privacy Rights

Depending on where you live, you may have rights concerning personal information.

These may include the right to:

• access personal information;
• obtain information about processing;
• correct inaccurate information;
• request deletion;
• restrict certain processing;
• object to certain processing;
• receive certain information in portable form;
• withdraw consent;
• opt out of certain advertising;
• opt out of sale or sharing;
• limit certain uses of sensitive information;
• lodge a complaint with a data-protection authority.

Rights vary by jurisdiction and may be subject to legal exceptions.

23. EEA and UK Rights

If GDPR or UK GDPR applies, you may have rights to:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• data portability;
• withdraw consent where processing relies on consent.

You also have the right to lodge a complaint with the competent supervisory authority.

UK users may contact the Information Commissioner’s Office (ICO).

The ICO specifically expects privacy notices to explain applicable individual rights and complaint rights.

Right to Object

Where Kremage relies on legitimate interests, you may have the right to object to processing based on your particular circumstances.

You may object at any time to processing of personal data for direct marketing.

24. California Privacy Rights

If the California Consumer Privacy Act, as amended, applies to Kremage and your information, California residents may have the right to:

• know categories of personal information collected;
• obtain specific pieces of personal information;
• know categories of sources;
• know business or commercial purposes;
• know categories of third parties receiving personal information;
• request deletion;
• request correction;
• opt out of sale or sharing;
• limit certain uses of sensitive personal information;
• receive equal service and pricing when exercising privacy rights.

California law also requires notice at or before collection concerning the categories collected and their purposes.

To submit a request, email:

afterglow@kremage.com

Subject line:

California Privacy Request

Where required, Kremage will verify the request before providing or deleting information.

An authorized agent may submit a request where permitted by law and where sufficient proof of authorization is provided.

25. Global Privacy Control

Where applicable law requires recognition of a supported browser or device-based opt-out preference signal, such as Global Privacy Control, Kremage will process that signal as required by law.

26. Automated Fraud and Risk Analysis

Kremage and its service providers may use automated systems to evaluate transaction and security risk.

These systems may consider factors such as:

• order value;
• billing/shipping consistency;
• IP location;
• device information;
• transaction velocity;
• payment-verification results;
• customer/order history;
• other fraud signals.

Automated analysis may cause an order to be:

• flagged for review;
• temporarily held;
• subjected to additional verification.

Where required by law, significant decisions will not be based solely on automated processing without the safeguards or rights required by applicable law.

27. Children

Kremage is not intended for children who lack legal capacity to purchase goods or create a binding account.

We do not knowingly seek to collect personal information from children in violation of applicable law.

If you believe a child has provided personal information improperly, contact:

afterglow@kremage.com

28. Third-Party Websites and Services

Kremage may contain links to or interact with services operated by third parties.

These may include:

• Partner Brand websites;
• payment providers;
• carriers;
• social networks;
• analytics providers;
• external content.

Their privacy practices are governed by their own policies.

Kremage is not responsible for the independent privacy practices of third parties.

29. Third-Party SDKs in the iOS App

The Kremage iOS app may use third-party software development kits or services for functions such as:

• ecommerce;
• authentication;
• payments;
• analytics;
• crash reporting;
• fraud prevention;
• push notifications;
• customer support;
• app performance.

Such providers may process data on Kremage’s behalf or, where disclosed, under their own terms.

Kremage’s App Store privacy disclosures are intended to reflect both Kremage’s practices and relevant practices of third-party code integrated into the app.

Apple requires App Store privacy disclosures to account for data practices of third-party code and SDKs used by the app.

30. The Kremage iOS App

This section explains how the Kremage app for iPhone (version 2.0 and later) handles your information. It adds to the rest of this Privacy Policy, which covers kremage.com and orders placed through it.

No account, no tracking
The app does not require an account. It contains no advertising, analytics, crash-reporting or tracking tools, and it does not track you across other companies' apps or websites.

Kept only on your iPhone
The following stays on your device and is never sent to us or anyone else:
• Your body details: height, weight, build and any tape measurements you enter. They shape a 3D body that is drawn on your phone.
• Your outfit diary and its notes and photos, saved boards, the people you shop for and their sizes, your bag, week plans, style preferences and settings.
• Your calendar, if you allow access. Today's events are read on your phone to suggest an outfit.
• The camera, if you allow access. It is used on your phone to measure your height and to match outfits you point it at. Nothing is recorded or uploaded.
• Your photo library, if you allow access. The app looks through your screenshots on your phone to find outfits to shop. Photos are never uploaded.
• Morning notes, which are scheduled on your phone.
Your diary and its photos are also excluded from iCloud backups.

Sent only when you use a feature that needs it
• Product catalogue: product details and images are loaded from kremage.com (operated on Shopify).
• Checkout: when you check out or tap Buy now, your bag opens in kremage.com's own Shopify checkout. Purchases there are covered by the rest of this Privacy Policy and by Shopify's terms. The app never sees your payment details.
• Weather: if you turn on "Use today's weather", your approximate location (about 11 km) is sent to Open-Meteo (open-meteo.com) to get the forecast. It is not sent to us.
• Sharing: if you share a video or poster of a look, it goes only where you choose to send it.

The 3D preview
The 3D preview is for illustration only. Fit, drape, colour and detail are approximate. Please check each product's size guide before you buy.

Deleting your data
You can erase everything the app keeps on your iPhone in the app, under Your data › Erase everything, or by deleting the app. Because this information stays on your device, we do not hold a copy.

Children
The app is not directed to children under 13, and we do not knowingly collect personal information from children.

Changes
If a future version of the app adds a feature that sends information off your device, we will update this section before that version is released.

Contact
Questions about this section: afterglow@kremage.com

 

31. Changes to This Privacy Policy

Kremage may update this Privacy Policy when:

• our services change;
• our data practices change;
• our app changes;
• service providers change;
• legal requirements change.

The updated version will identify a new effective date.

Where required by law, we will provide additional notice before materially changing how we use personal information.

32. Contact Us

For privacy questions, requests, or complaints:

Star Thing LLC d/b/a Kremage
Website: kremage.com
Email: afterglow@kremage.com
Phone: (718) 501-9424

Support hours:

Monday–Friday, 11:00 AM–8:00 PM Eastern Time

Mailing address:

447 Broadway
New York, NY 10013
United States

For privacy-rights requests, include enough information for us to understand and verify your request.