Privacy Policy

Notice at collection

Didi Plums is operated by AF10 S.r.l. We collect the categories below to run the store, fulfill purchases, understand site performance, prevent abuse, and—only where permitted by your choice and applicable law—measure and personalize advertising.

We do not collect payment card details on the Didi Plums storefront. Fourthwall and its payment providers collect and process the information needed to complete payment.

1. Storefront and checkout

www.didiplums.com is our custom storefront. It manages product pages, the local cart, privacy choices, and the handoff to checkout. checkout.didiplums.comis a Fourthwall-hosted checkout. Fourthwall processes the order, payment, taxes where applicable, and returns order information needed for digital delivery and support.

Your privacy choice is attached to the checkout cart as minimal metadata. Advertising identifiers and campaign parameters are passed to checkout only when advertising measurement is allowed. We do not place access tokens, payment data, or other secrets in cart metadata or checkout URLs.

2. Analytics and advertising tools

Fathom Analytics

We use Fathom to understand aggregate website traffic. Fathom states that its embed script does not use cookies or similar technologies and does not build advertising profiles. We send page paths and campaign UTM values, but intentionally exclude advertising click and cookie IDs. Learn more in Fathom's cookie documentation and data journey.

Meta Pixel and Conversions API

Where enabled, Meta Pixel operates in the browser and Meta Conversions API sends a matching server copy for page views, product views, and add-to-cart actions. Matching copies use the same random event ID so Meta can deduplicate them. The permitted data can include the source URL without query parameters, event time and name, product IDs, value, currency, browser/user agent, network address, and Meta identifiers such as _fbp and _fbc. We do not send email or phone for these pre-checkout events.

Fourthwall may send checkout events and one purchase event through its native Meta integration after that integration passes our privacy and deduplication checks. This may include order value, currency, product/variant IDs, quantities, and permitted matching identifiers. Meta may use the information for attribution, ad measurement, reporting, and retargeting under its own terms. See Meta's Privacy Policy.

3. Your privacy choices

In the United States, advertising measurement may be active unless you opt out or your browser sends a recognized Global Privacy Control signal. In regions that require prior consent, advertising measurement remains off until you affirmatively accept it. A refusal never prevents you from shopping, paying, or downloading a purchase.

Your Privacy Choices

The control above also serves as our “Do Not Sell or Share My Personal Information” mechanism where that wording is required. We treat an enabled Global Privacy Control (GPC) signal as an opt-out from advertising sharing for this browser. After opt-out or GPC, we block Meta browser/server events, clear our available Meta advertising cookies and attribution record, and omit advertising identifiers from the Fourthwall checkout handoff.

4. Why we process information

We process information as needed to provide products and fulfill our contract with purchasers; to meet legal, accounting and security obligations; and for legitimate interests such as protecting the service and understanding aggregate site performance. Where consent is required for advertising technologies, consent is the basis and can be withdrawn at any time from Your Privacy Choices.

5. Providers and disclosures

We use service providers including Fourthwall for checkout/order processing, payment providers made available through Fourthwall, Vercel for website hosting, Cloudflare for digital-delivery infrastructure, Firebase for application data, Resend for transactional email, and Fathom for aggregate analytics. They process information to provide services to us under their respective terms.

When allowed, we disclose identifiers, internet activity and commercial information to Meta for advertising measurement and cross-context behavioral advertising. Some US privacy laws may describe this as “sharing” even when no money is exchanged. Use Your Privacy Choices to opt out. We do not knowingly sell personal information for money.

6. Retention

• US privacy choices are stored in our first-party cookie for up to 12 months.
• Privacy choices in consent-first regions are stored for up to 6 months.
• Permitted campaign attribution is stored first-party for up to 90 days.
• Cart data may remain in your browser until you clear it or the site clears the cart.
• Order, delivery, security and accounting records are retained only as long as reasonably needed for fulfillment, legal obligations, disputes and fraud prevention.

Fourthwall, Meta, Fathom and other providers apply their own documented retention periods to data they control. Changing your choice stops future advertising processing by our implementation but does not automatically erase records another provider lawfully received earlier; contact us to request assistance where applicable.

7. Privacy rights and requests

Depending on where you live and whether a law applies to our processing, you may have rights to know or access, correct, delete, or receive a copy of personal information; to opt out of certain advertising disclosures; to withdraw consent; or to appeal a denied request. We will not discriminate against you for exercising an applicable right.

Send requests to didi@didiplums.com. Describe the request and the email used for an order if relevant. We may need to verify your identity before acting and will explain if a requested right does not apply.

8. Children

The Didi Plums store and checkout are intended for adult purchasers and are not directed to children under 13. Although coloring products may be enjoyed by families, we do not knowingly use Meta advertising tools to collect personal information from children under 13. If you believe a child provided personal information, contact us so we can investigate.

9. Transfers and security

Providers may process information in the United States, European Union, Canada and other countries. Where required, contractual and technical transfer safeguards should be confirmed during legal review. We use access controls, encryption in transit, signed webhooks, limited data collection and secret-management practices, but no system can guarantee absolute security.

10. Updates and contact

We may update this policy when our practices or legal requirements change. The date at the top shows the latest revision. Material changes may be presented through an additional notice or renewed choice where appropriate.

Privacy questions: didi@didiplums.com.