Privacy policy
Effective Date: [October 11, 2026]
Last Updated: [October 11, 2026]
Goodai Global USA Inc. (“Goodai USA,” “Depthiskin,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and otherwise process personal information when you visit or interact with the Depthiskin website, purchase products, communicate with us, participate in promotions or programs, receive marketing, or otherwise interact with our services (collectively, the “Services”).
For purposes of purchases through the Depthiskin online store and the processing activities described in this Policy, the principal business responsible for the processing is:
Goodai Global USA Inc.
101 Progress, STE 200
Irvine, CA 92618
United States
Telephone: +1 (949) 418-8592
Customer Service and Privacy Requests: customer@depthiskin.com
General Contact: info@goodai-global.us
This online store is powered by Shopify. Shopify may process information on our behalf as a service provider or processor in many merchant-related contexts and may also process information under its own policies where applicable. Shopify itself explains that customers of a merchant should generally address privacy requests concerning merchant-controlled data to the merchant, with Shopify assisting merchants where appropriate.
Scope
This Policy applies to personal information we process through the Depthiskin website, online store, orders, customer support, email and other marketing, promotions, reviews, surveys, loyalty or referral programs if introduced, and related online and offline interactions.
It does not necessarily govern a third party's independent privacy practices where you interact directly with that third party.
Personal Information We Collect
Depending on how you interact with Depthiskin, we may collect the following categories of information.
Contact and identity information may include your name, email address, telephone number, billing address, shipping address, country or region, and related contact details.
Account information, where customer accounts are enabled, may include account identifiers, login information handled through our platform, preferences, order history, saved information, and account settings.
Order and commercial information may include products viewed, searched for, added to cart, purchased, returned, or reviewed; order number; quantities; prices; discounts; promotion usage; order history; delivery status; and related transaction information.
Payment and transaction information may include payment method, payment status, transaction identifiers, billing information, fraud-screening results, and limited payment information made available to us by the payment provider. Complete payment-card credentials may instead be processed directly by Shopify Payments, PayPal, card networks, financial institutions, digital-wallet providers, or other payment processors.
Shipping and fulfillment information may include recipient name, shipping address, email address, telephone number, purchased products, SKU, quantity, package information, delivery instructions, order value where necessary, tracking information, return information, and, for international shipments in the future, information reasonably required for customs, tax, import, or delivery formalities.
Customer-support information may include your name, email address, telephone number, order number, order history, correspondence, chat messages, emails, call-related information, requested support, return or refund information, delivery issues, photographs or videos you voluntarily provide to document damaged or incorrect goods, and other information necessary to investigate and resolve your request.
If telephone or chat recording, transcription, AI assistance, or quality-monitoring tools are introduced, we will provide additional notices or obtain consent where required by applicable law.
Marketing and communication information may include your email address, marketing preferences, consent status, unsubscribe history, campaign engagement, email opens or clicks where permitted, product interests, coupon usage, source of sign-up, and communication history.
Review, survey, loyalty, rewards, referral, and community information may include reviews, ratings, survey responses, photographs, videos, testimonials, referral identifiers, points or rewards activity, membership information, and other information you choose to submit through such programs if and when they are offered.
Device and usage information may include IP address, browser type, device type, operating system, device or advertising identifiers, approximate geographic location derived from IP, referring page, pages visited, searches, clicks, session information, cart activity, purchase events, timestamps, and interactions with the Services.
Cookie and tracking information may include identifiers and events collected through cookies, pixels, tags, software development kits, local storage, APIs, server-side event tools, analytics services, or comparable technologies.
Advertising and audience information may include advertising identifiers, inferred interests, audience membership, campaign attribution, conversion information, and data used to measure advertisements or create or exclude audiences, subject to consent and opt-out requirements.
Information from other sources may include information received from Shopify, payment processors, shipping providers, advertising platforms, referral partners, social platforms, fraud-prevention services, or other providers in connection with the Services.
Sensitive Information
We do not intend to ask customers to provide sensitive personal information unless reasonably necessary for a specific feature or transaction.
In particular, customers should avoid providing detailed medical or health information through ordinary reviews or support communications unless it is necessary to address a specific concern.
If Depthiskin later introduces a skin diagnostic quiz, personalized skin assessment, AI skin analysis, dermatology-related feature, biometric feature, or another service that intentionally processes health or other sensitive information, this Privacy Policy and the relevant consent flow must be reviewed before launch. Health information is treated as a special category of personal data under the GDPR.
How We Use Personal Information
We may process information to operate and provide the Services; accept, verify, process, and fulfill orders; receive and confirm payments; manage customer accounts; provide order confirmations and transactional notifications; provide processing, shipping, tracking, delivery, return, and refund updates; provide customer support; authenticate customers; detect and prevent fraud, security incidents, and abuse; maintain and improve the website; perform analytics; measure business and marketing performance; personalize customer experiences; administer promotions; request reviews or customer feedback; administer future loyalty, rewards, referral, or community programs; comply with law; establish or defend legal claims; and carry out other purposes disclosed at the time of collection.
Why We Collect Email Addresses
We may collect and use an email address for operational and transactional purposes, including order confirmation, payment confirmation, order processing, fraud or identity verification where appropriate, shipping and delivery updates, tracking notifications, return and refund communications, customer-support responses, security notices, account notices, product-safety or recall information if applicable, changes materially affecting a transaction, and other non-promotional communications reasonably necessary to provide a service you requested.
Subject to applicable law and your choices, we may also use your email address for newsletters; general brand and product news; new-product announcements; promotions; sales; discount codes; coupons; gifts-with-purchase; early-access offers; product education; how-to-use information; skincare routines and tips; customer feedback or satisfaction surveys; Voice-of-Customer programs; review or testimonial requests; replenishment or reorder reminders; back-in-stock notifications; waitlist notifications; price or availability alerts; cart or checkout reminders where legally permitted; browsing-related recommendations where legally permitted; loyalty or rewards communications; referral programs; community registration campaigns; promotional-credit offers; contests or sweepstakes where offered; events; campaigns; product recommendations; personalized content; and other substantially similar marketing or customer-engagement communications introduced in the future.
Where consent is required, we will use an email address for those marketing purposes only in accordance with the applicable consent.
You may unsubscribe from marketing email at any time using the link in the message or by contacting us. We may retain a limited suppression record so that we can respect an unsubscribe request.
Opting out of promotional communications does not prevent necessary transactional communications concerning an order or another service you requested.
Klaviyo is expected to be our primary email marketing and customer-engagement platform. Under Klaviyo's current data-processing terms, the customer using Klaviyo is generally the controller/business and Klaviyo acts as a processor/service provider for covered customer personal data; Klaviyo also provides contractual mechanisms concerning subprocessors, security, data-subject requests, and international data transfers.
Email Marketing Compliance
We may maintain records of the source, time, method, and status of marketing consent and unsubscribe requests where appropriate.
For U.S. commercial email, we will operate our program in accordance with applicable CAN-SPAM requirements.
For Canada, our practices will be adjusted as necessary to comply with Canada's anti-spam legislation and applicable Canadian privacy requirements.
For the EEA and UK, we will obtain consent or rely on another specifically permitted electronic-marketing basis only when applicable requirements are satisfied. UK PECR operates alongside the UK GDPR for electronic marketing.
Cookies and Similar Technologies
We and providers acting for us may use cookies, pixels, tags, APIs, server-side events, local storage, and similar technologies for essential website functions, security, shopping-cart functionality, analytics, personalization, advertising, attribution, conversion measurement, fraud prevention, and other permitted purposes.
These technologies may process device or browser identifiers, IP address, approximate location, pages viewed, products viewed, searches, cart events, purchases, referral information, ad interactions, and related online activity.
Where applicable law requires prior consent for non-essential technologies, we will seek that consent before enabling them for the applicable user.
Shopify provides customer-privacy controls and APIs that can communicate whether analytics, marketing, preference, or sale-of-data permissions have been granted, allowing integrated pixels to respond to applicable privacy choices.
Analytics
We may use analytics services, including Google Analytics 4 and Shopify's analytics capabilities, to understand how customers use the Services, evaluate website performance, troubleshoot issues, understand customer journeys, measure conversions, and improve our products and Services.
Future analytics may include additional first-party or third-party services. Any materially different technology should be evaluated before installation.
Advertising and Retargeting
Subject to applicable consent and opt-out choices, we expect to use advertising and measurement services from Meta, Google, and TikTok.
These services may include technologies such as Google advertising or conversion tags, Meta Pixel and related Meta business tools, TikTok Pixel and related TikTok business tools, and other browser- or server-based measurement technologies where enabled.
Advertising technologies may enable us to measure whether an ad led to a visit or purchase; understand campaign performance; limit repetitive advertising; create audiences; exclude existing purchasers from particular campaigns; show advertisements to people who previously visited Depthiskin, viewed a product, added an item to cart, or otherwise interacted with the Services; or, where permitted, create similar or modeled audiences.
This practice is commonly referred to as retargeting or targeted/behavioral advertising.
Where enabled and permitted, conversion services may transmit limited identifiers, including pseudonymous identifiers or appropriately transformed contact information such as hashed contact data, to an advertising provider so it can attempt to match a transaction or website event to an advertising account. Such functionality must be configured in accordance with applicable consent and opt-out requirements.
We do not intend to use sensitive health information submitted to customer support for advertising targeting.
Future Advertising Channels
Our advertising mix may change over time. Advertising categories we may use in the future include search advertising, social-media advertising, video advertising, display advertising, programmatic advertising, retail-media advertising, marketplace advertising, connected-TV advertising, affiliate marketing, creator or influencer campaigns, sponsorships, and other digital or offline channels.
Potential providers in the industry may include platforms such as Microsoft/Bing, Pinterest, Snapchat, Reddit, X, LinkedIn, Amazon or other marketplaces, affiliate networks, programmatic platforms, and other advertising or measurement providers.
This does not mean all of those providers are currently installed or receiving Depthiskin data. The active cookie/vendor inventory and consent interface should identify the providers actually enabled on the site.
That distinction is legally important. In particular, UK ICO guidance requires prior consent for non-exempt storage/access technologies and directs businesses to give users clear information about the technologies and third parties involved rather than treating a generic privacy-policy sentence as unlimited consent.
How We Disclose Personal Information
We may disclose personal information to the following categories of recipients as reasonably necessary for the purposes described in this Policy.
Shopify and e-commerce providers. Shopify provides our commerce platform and related infrastructure. Shopify applications and integrations may receive data based on their permissions and functions. Shopify notes that installed apps can receive customer personal information such as names, contact information, addresses, location-related information, IP/device information, and order information depending on the permissions granted to the app.
Payment and financial-service providers. Current or expected providers may include Shopify Payments, Shop Pay where enabled, PayPal, card networks, financial institutions, digital wallets, fraud-screening providers, and other checkout providers. Airwallex may be added in the future but should be added to the active vendor documentation only once implemented.
Email and customer-engagement providers. This includes Klaviyo and any replacement or supplemental marketing automation provider we lawfully use.
Advertising and measurement providers. These currently or initially may include Meta, Google, and TikTok and their associated advertising, analytics, conversion, and measurement services.
Fulfillment, logistics, and delivery providers. We may provide warehouses, 3PL providers, fulfillment centers, carriers, postal services, delivery providers, customs brokers, freight providers, shipping software providers, and return-logistics providers with information needed to fulfill an order.
Information ordinarily necessary for fulfillment may include the recipient's name, shipping address, email or phone contact information, order number, products/SKUs and quantities, package details, delivery instructions, tracking information, declared value where needed, and customs or import information for future international shipments.
Fulfillment and carrier providers ordinarily do not need a customer's full payment-card number to deliver a package.
Your current U.S. fulfillment operation is located at:
219 W Gardena Blvd, Bldg 2
Carson, CA 90248
I do not recommend publishing this as a consumer return address unless the fulfillment provider has expressly approved direct customer returns there and the returns workflow is configured accordingly.
Customer-support providers. We may use helpdesk, CRM, chat, email-ticketing, telephone, AI-assisted support, returns-management, or other customer-support providers. Such providers may access customer contact information, order details, correspondence, photographs submitted for claims, return information, and related information to respond to requests.
Review, loyalty, rewards, referral, and community providers. If we implement these programs, relevant providers may process contact information, order information, review content, participation information, points, referral identifiers, rewards, or related information needed to operate the program.
Shipping tracking and returns providers. If separate applications are installed for shipment visibility, post-purchase notifications, package protection, return portals, or exchanges, those providers may receive order and logistics information.
Security and fraud providers. We may share information with providers that detect fraudulent payments, account abuse, automated attacks, chargeback risk, malicious activity, or security threats.
Cloud, hosting, IT, and business-service providers. We may use providers for data storage, content delivery, security, databases, communications, accounting, tax, business intelligence, auditing, legal services, and other operational functions.
Professional advisors. We may disclose information to legal counsel, accountants, auditors, insurers, financial advisors, or other professionals when reasonably necessary.
Affiliates and corporate group companies. We may disclose information to affiliated companies where reasonably necessary for internal administration, brand operations, legal compliance, finance, security, product operations, or another purpose consistent with this Policy.
If the Korean owner of the Depthiskin brand receives identifiable customer information for its own marketing or other independent purposes, this section must be updated to identify the actual relationship and purpose rather than relying only on the generic “affiliate” language.
Corporate transactions. Information may be disclosed as part of a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, subject to applicable law.
Legal and safety disclosures. We may disclose information when reasonably necessary to comply with law, legal process, valid governmental requests, protect rights or safety, investigate fraud, or enforce our agreements.
At your direction. We may disclose information when you direct or authorize us to do so.
Shopify Apps and Future Service Providers
We may change third-party providers as the business develops. We may engage new Shopify applications or service providers for functions already described in this Policy, such as customer support, reviews, loyalty, referral programs, marketing, fraud prevention, shipping, returns, analytics, or consent management.
This language is intended to avoid having to rewrite the entire Privacy Policy every time one processor is replaced by another.
It is not intended to authorize undisclosed material new uses of personal information. When a provider introduces a materially different purpose, sensitive-data processing, a new targeted-advertising relationship, or a new cookie/pixel requiring specific transparency or consent, we will update the applicable notice, consent interface, vendor inventory, or this Policy as required.
Shopify itself recommends reviewing application permissions and developer privacy practices because installed apps can access personal information according to their granted permissions.
Sale, Sharing, and Targeted Advertising
We do not intend to sell personal information for money.
However, certain advertising, analytics, retargeting, or conversion-measurement activities involving cookies, pixels, device identifiers, browsing activity, or advertising partners may be considered a “sale,” “sharing,” or processing for targeted advertising under certain U.S. privacy laws even where no money is paid for the information.
Where applicable law gives you a right to opt out of such processing, we will provide an appropriate mechanism, such as a Your Privacy Choices or Do Not Sell or Share My Personal Information control and/or cookie preference interface.
Where required, we will also process recognized opt-out preference signals such as Global Privacy Control. California's current CCPA guidance expressly identifies rights to opt out of sale or sharing and recognizes GPC in the applicable framework.
International Processing and Transfers
Goodai Global USA Inc. is located in the United States. Our providers and affiliates may process information in the United States and other countries.
Where personal information governed by EEA, UK, Canadian, or other cross-border data-protection rules is transferred internationally, we and our providers will use applicable legal mechanisms and safeguards where required.
The European Commission recognizes mechanisms including adequacy decisions, Standard Contractual Clauses, and Binding Corporate Rules in the applicable circumstances. Klaviyo's current DPA addresses international-transfer mechanisms including applicable Standard Contractual Clauses and UK mechanisms for covered customer data.
Data Retention
We retain personal information for as long as reasonably necessary for the purposes for which it was collected and thereafter as necessary to meet legitimate operational or legal needs.
For example, transaction and order records may be retained as needed for accounting, tax, fraud, chargeback, product, warranty, dispute, and legal obligations; customer-support records may be retained for issue resolution and appropriate business records; marketing information may be retained while you are subscribed or while reasonably relevant, with a limited suppression record retained as needed to honor an opt-out; and cookie or advertising information may be retained according to the applicable technology and consent settings.
We may delete, anonymize, or aggregate information when it is no longer reasonably necessary, subject to backup cycles and legal retention obligations.
Canadian PIPEDA principles expressly include limiting use, disclosure, and retention, while GDPR transparency requirements likewise make retention periods or applicable criteria relevant to privacy notices.
Data Security
We use reasonable administrative, organizational, technical, and physical safeguards appropriate to the nature of the information and our operations.
No method of electronic transmission, processing, or storage can be guaranteed to be completely secure.
Our provider due diligence should include contractual privacy obligations, access controls, incident responsibilities, deletion/return procedures, and appropriate safeguards. Canada's Office of the Privacy Commissioner currently recommends mapping third-party data flows, confirming purposes and subprocessors, reviewing security, assessing cross-border processing, and addressing data deletion at the end of a provider relationship.
Your Privacy Rights
Depending on where you live and which law applies to our processing, you may have rights to request access to personal information; receive information about its collection, use, or disclosure; correct inaccurate information; delete information; obtain a portable copy; withdraw consent; object to certain processing; restrict certain processing; opt out of sale, sharing, or targeted advertising; limit certain uses of sensitive information; or appeal a decision regarding a privacy request.
These rights are not identical in every jurisdiction and may be subject to legal exceptions.
We may take reasonable steps to verify a request before responding.
You may submit a request at:
or by contacting:
Goodai Global USA Inc.
101 Progress, STE 200
Irvine, CA 92618
United States
+1 (949) 418-8592
A dedicated address such as privacy@depthiskin.com would be preferable once the business is operational, but the existing customer-service address can be used at launch if requests are properly routed and tracked.
California and Other U.S. State Privacy Rights
To the extent applicable U.S. state privacy laws apply to us, residents may have additional rights regarding personal information and targeted advertising.
As of October 1, 2026, the California Attorney General describes CCPA coverage for qualifying for-profit businesses doing business in California that meet an applicable threshold, including the gross-annual-revenue threshold, the 100,000-consumer/household personal-information threshold, or the threshold based on deriving at least half of annual revenue from selling California residents' personal information. Importantly for Depthiskin, therefore, CCPA readiness should not be monitored solely by revenue.
Where applicable, California residents may have rights to know/access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive non-discriminatory treatment for exercising rights.
We will not unlawfully discriminate against a customer because the customer exercises an applicable privacy right.
If we offer a loyalty, rewards, referral, discount, or other program that constitutes a financial incentive or price/service difference governed by California law, we will provide any additional program disclosure required before implementing that program.
EEA Privacy Information
If our processing becomes subject to the EU GDPR, our processing may rely, depending on the activity, on performance of a contract, compliance with legal obligations, legitimate interests that are not overridden by the individual's rights, or consent.
For example, order processing and requested fulfillment generally relate to performance of the purchase contract; legal or tax recordkeeping may be required by law; security and fraud-prevention activities may support legitimate interests or legal obligations; and non-essential advertising tracking and certain electronic marketing will rely on consent where required.
When processing is based on consent, applicable GDPR rules require that withdrawal of consent be possible and that consent be demonstrable.
Individuals may also have the right to lodge a complaint with an applicable data-protection supervisory authority.
Important EEA launch requirement: before Depthiskin actively targets EEA consumers, ships to the EEA, or deliberately monitors EEA users for advertising/retargeting in a manner that brings Goodai Global USA Inc. within the GDPR's territorial scope, the business should assess whether an EU representative must be appointed and, if so, add the representative's identity and contact information here. GDPR obligations can arise based on offering goods/services to individuals in the EU or monitoring relevant behavior; they are not dependent on reaching a U.S.-style revenue threshold.
UK Privacy Information
Where UK data-protection law applies, individuals may have corresponding rights under UK data-protection law.
Non-essential storage/access technologies and electronic marketing must be configured in accordance with the applicable UK GDPR and PECR rules. ICO guidance states that non-exempt cookies and similar storage/access technologies generally require prior UK GDPR-standard consent, and refusal must be made as accessible as acceptance.
Important UK launch requirement: if Goodai Global USA Inc. becomes subject to an obligation to appoint a UK representative because it offers products to or monitors individuals in the UK, the representative information must be added to this notice before the applicable operation begins.
Canada Privacy Information
Where Canadian privacy law applies, we process personal information in accordance with applicable federal or provincial requirements.
PIPEDA's fair-information principles include accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and mechanisms to challenge compliance.
Canadian marketing communications will also be configured to meet applicable CASL requirements when Depthiskin begins directing commercial electronic messages to Canada.
Children's Privacy
Our Services are not directed to children under 13, and we do not knowingly seek to collect personal information online directly from children under 13.
If we learn that information has been collected in circumstances requiring parental authorization and the applicable requirements were not met, we will take appropriate steps.
COPPA specifically applies in circumstances including child-directed services collecting personal information and general-audience services with actual knowledge that personal information is being collected from children under 13.
Where a jurisdiction imposes additional protections for teenagers, including restrictions on targeted advertising, sale/sharing, or consent, we will implement those protections as applicable.
Changes to This Privacy Policy
We may update this Policy as our Services, providers, technology, legal obligations, or data practices change.
We will update the “Last Updated” date and provide additional notice or obtain consent where required for a material change.
Shopify likewise advises merchants to review their privacy settings and policy regularly and notes that merchants remain responsible for ensuring that the policy matches actual integrated services and data practices.
Contact Us
For privacy questions or requests:
Depthiskin / Goodai Global USA Inc.
101 Progress, STE 200
Irvine, CA 92618
United States
Privacy / Customer Service: customer@depthiskin.com
General Contact: info@goodai-global.us
Telephone: +1 (949) 418-8592