Política de privacidade

Last updated: 7 August 2026

This Privacy Policy explains how we handle your personal data when you visit nobrainrot.com, buy something from us, or otherwise interact with our store and website (the "Services").

The Shift mobile app has its own privacy policy, which covers everything the app does with your data: Shift App Privacy Policy.

Who we are

The data controller is Wojciech Filipowicz, Kraków, Poland, NIP: 6772475901 ("we", "us"). You can reach us at hello@nobrainrot.com.

What we collect

Contact and shipping details — name, email address, shipping and billing address, phone number.
Order and transaction data — what you bought, when, for how much, and your order history.
Payment information — processed by Shopify and its payment providers. We never see or store your card number.
Account data — if you create a store account: your login email and preferences.
Communications — emails you send us, support requests, and reviews you post.
Device and usage data — IP address, browser and device information, and how you navigate the site, collected through cookies and similar technologies.

We collect this information directly from you, automatically through your use of the Services, and from the service providers who operate parts of the store on our behalf.

How we use it

Orders — processing payment, shipping your order, handling returns and exchanges, and sending you order updates.
Support — answering your questions and resolving problems.
Marketing — sending you emails about products and drops if you signed up for them, and showing you ads. You can unsubscribe from marketing emails at any time via the link in every email. If you unsubscribe, we may still send you non-promotional emails, such as order confirmations and messages about your account.
Reviews — inviting you to review products you bought and publishing reviews you choose to submit.
Improving the site — understanding what works and what doesn't, through analytics.
Security and fraud prevention — keeping the store and your account safe.
Legal obligations — tax records, responding to valid legal requests, enforcing our terms.

Legal bases (GDPR)

Where the GDPR applies, we process personal data on these bases:

Performance of a contract (Art. 6.1(b) GDPR) — fulfilling your orders, managing your account, and providing support.
Consent (Art. 6.1(a) GDPR) — marketing emails and non-essential cookies. You can withdraw consent at any time.
Legitimate interests (Art. 6.1(f) GDPR) — site analytics, fraud prevention, and defending our legal rights. You can object at any time (see Your rights).
Legal obligation (Art. 6.1(c) GDPR) — accounting and tax record-keeping.

Who receives your data

We don't sell your personal data. We share it only with the services that run this store:

Shopify — hosts the store and processes payments. Shopify also processes some data as its own controller to provide and improve its services; see the Shopify Consumer Privacy Policy and the Shopify Privacy Portal for your rights over that processing.
Klaviyo — sends our emails (order-related and, with your consent, marketing).
Judge.me — powers product reviews and review-request emails.
Google (Analytics, Tag Manager, Ads) — site analytics and advertising measurement.
Meta (Meta Pixel, Facebook and Instagram ads) — advertising and ad measurement.
Shipping carriers — your name and address, to deliver your order.
Authorities — where the law requires it (e.g. tax authorities, valid legal requests).

If our business is ever transferred through a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction; we will provide notice as required by law.

Cookies and advertising

We use cookies and similar technologies for essential site functions, analytics, and advertising. Advertising cookies (Google, Meta) let us show ads based on your visits to our site. Where required by law, we ask for your consent before setting non-essential cookies, and you can change your choices at any time. You can also opt out of personalized ads via Google Ads Settings and your Meta ad preferences.

How long we keep data

Order records — as long as required by Polish accounting and tax law (generally 5 years from the end of the relevant tax year).
Account data — for as long as your account exists.
Marketing data — until you unsubscribe or ask us to delete it.
Support emails — up to 24 months after the issue is resolved.

International transfers

Some of our providers (Shopify, Klaviyo, Judge.me, Google, Meta) process data in the United States and other countries outside the EEA. These transfers are protected by the European Commission's Standard Contractual Clauses and, where applicable, the provider's certification under the EU-U.S. Data Privacy Framework.

Your rights

Depending on where you live, you may have some or all of the rights below. These rights are not absolute — they may apply only in certain circumstances, and we may decline a request where applicable law permits.

If you are in the EU/EEA or UK, you have the right to access, correct, delete, restrict, or port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. Email hello@nobrainrot.com to exercise any of these rights. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO), or your local authority — and, depending on where you live, to appeal a decision we make about your request by contacting us again.

We may need to verify your identity before acting on a request, as permitted or required by applicable law. Where local law allows, you may use an authorized agent to submit a request on your behalf; we will require proof of the agent's authorization and may still need to verify your identity directly with you. We will respond within the timelines required by applicable law.

If you are a California resident: you have the right to know, delete, and correct personal information we hold about you, and to opt out of the "sharing" of personal information for cross-context behavioral advertising (which is what advertising tools like the Meta Pixel do). To opt out, email hello@nobrainrot.com or adjust your cookie choices on our site. We do not sell personal information for money, and we do not knowingly sell or share personal information of anyone under 16. We will not discriminate against you for exercising any of these rights.

Children

The Services are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Security

We use commercially reasonable measures to protect your data, and payments are handled by Shopify's PCI-compliant infrastructure. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security — but we take it seriously. If you create a store account, keep your login credentials safe and don't share them; you are responsible for activity under your account.

Third-party links

Our site links to third-party sites and platforms we don't operate (including social media). Their privacy practices are their own — review their policies before sharing data with them.

Changes to this policy

We may update this policy to reflect changes in our practices or the law. We'll post the revised version here and update the date at the top.

Governing law

This Privacy Policy is governed by the laws of Poland, without regard to conflict of law principles, and without limiting any mandatory rights you have under the law of the country where you live.

Contact

Wojciech Filipowicz
Kraków, Poland
NIP: 6772475901
hello@nobrainrot.com