Your data.
Kept plainly.
This page says what we collect when you use corropt.com, why, who processes it for us, how long we keep it, and how to get it back or have it deleted. No legal fog. Last updated 10 September 2026.
The controller.
Corropt & Chroma is a clothing brand based in Harare, Zimbabwe. We run corropt.com and decide what happens to the personal data collected through it. For anything on this page, write to hello@corropt.com or message +263 78 244 9738 on WhatsApp.
We ship worldwide. If you are in the UK or the European Economic Area, the UK GDPR and the EU GDPR apply to how we treat your data. In Zimbabwe, the Cyber and Data Protection Act applies. We hold ourselves to the same standard everywhere.
Only what the action needs.
Page views and load times are measured with Vercel Analytics and Speed Insights, which are cookieless and do not build a profile of you. If you arrive from a link with campaign tags (utm_*) or a referring site, we keep those tags in your browser for the visit so a later checkout can be attributed to the post that sent you. That is about the link, not you.
When you subscribe to Notes from the studio or join a drop waitlist we store your email address, the time you signed up, your browser's user-agent string and the page you were on. We also create a customer record in Shopify flagged as accepting marketing, and send you a welcome email. Joining the list is your consent to receive our emails. Every one carries an unsubscribe link.
Accounts are Shopify customer accounts. Shopify holds your password; we never see it. Your name, delivery addresses, order history and wishlist are shown to you when you sign in. Your wishlist, cart and currency choice live in your own browser storage, not on our servers.
Checkout runs on Shopify. Shopify and its payment providers collect your payment details, billing and delivery address and contact details. We never receive or store card numbers. We receive your order, contact and delivery details so we can make, pack and ship the piece and answer questions about it.
The returns form sends your order number, email address and the reason you give straight to the studio inbox so we can send a label and process the refund. Nothing from that form is stored anywhere else.
Email, WhatsApp and Instagram messages are kept for as long as the conversation is useful, then deleted. WhatsApp and Instagram are run by Meta and their own privacy policies apply to messages sent through them.
The reasons.
- To fulfil your order — making, shipping, tracking, returns and repairs. Legal basis: performance of a contract.
- To run your account — sign-in, order history, saved addresses. Legal basis: performance of a contract.
- To send drop news and studio notes — only to people who joined the list. Legal basis: your consent, which you can withdraw at any time.
- To answer you when you get in touch. Legal basis: our legitimate interest in running the studio.
- To understand what works — which posts bring people to the site, which pages load slowly. Legal basis: legitimate interest, using cookieless measurement.
- To meet legal obligations — tax, accounting, fraud prevention and responding to lawful requests.
We do not sell your data. We do not use automated decision-making or profiling that has a legal or similarly significant effect on you. We do not use AI systems to process your personal data.
Named, not “trusted partners.”
- Shopify (Shopify International Ltd / Shopify Inc.) — customer accounts, checkout, payments, order records, and the marketing list. Checkout domain pay.corropt.com.
- Vercel (Vercel Inc.) — hosts corropt.com, stores list signups in Vercel Blob storage, and provides cookieless analytics and speed measurement.
- Resend (Resend Inc.) — sends our welcome, drop and return-request emails.
- Payment providers selected inside Shopify checkout — they process your payment under their own policies. We never see card details.
- Couriers — receive your name, address and phone number to deliver the piece.
- Meta (WhatsApp, Instagram) — only if you choose to message us there.
Each of these acts on our instructions under a data processing agreement or their published terms. Several are based in the United States, so your data leaves Zimbabwe, the UK and the EEA. Transfers rely on the providers' standard contractual clauses and equivalent safeguards.
Two cookies, both ours.
- cc-session — set only when you sign in. Holds your Shopify account token so you stay signed in. Server-only, lasts 30 days or until you sign out.
- cc-authed — set alongside it. A yes/no flag so the page knows to show your account menu. Lasts 30 days or until you sign out.
- Browser storage (not cookies) — your cart, wishlist, currency choice, whether you have already joined the list, and this visit's campaign tags. Stored on your device, never sent to us as a profile, cleared when you clear site data.
We do not currently run Google Analytics, the Meta Pixel or any other third-party tracking cookies. If we ever switch them on, they will stay off for you until you say yes in a consent banner, and this page will be updated first.
Then it goes.
- Marketing list — until you unsubscribe or ask us to delete you. Unsubscribing removes you from sends immediately.
- Account — until you ask us to close it. Closing deletes the Shopify customer record except for order history we must keep.
- Orders and invoices — 6 years from the order, to meet tax and accounting rules.
- Return requests and correspondence — 12 months after the matter is closed.
- Server logs — held by Vercel for a short rolling window, then dropped.
Ask, and we do it.
- Access — a copy of everything we hold about you.
- Correction — fix anything wrong. You can edit addresses yourself in your account.
- Deletion — we delete you from the list, our storage and Shopify, except records the law makes us keep.
- Withdraw consent — unsubscribe from any email, or write to us.
- Object or restrict — tell us to stop or limit a particular use.
- Portability — your data in a machine-readable file.
- Complain — to the ICO (UK), your local data protection authority (EEA), or POTRAZ (Zimbabwe). We would rather you told us first.
Email hello@corropt.com from the address you used with us and say what you want. We answer within 30 days and never charge for it. If we cannot verify it is you, we will ask for something that proves it before we act.
Security, children, changes.
- Security — the site is served over HTTPS only, sign-in tokens are server-only cookies, and access to our storage and Shopify admin is limited to the studio. No system is perfect; if something goes wrong with your data we will tell you and the relevant authority as the law requires.
- Children — corropt.com is not aimed at anyone under 16 and we do not knowingly collect their data. If a child has given us theirs, write to us and we will delete it.
- Changes — when we change how we handle data, we update this page and the date at the top before the change goes live. Material changes are also announced to the list.
One inbox.
Corropt & Chroma · Harare, Zimbabwe
hello@corropt.com · +263 78 244 9738 (WhatsApp)