THEA BY K Privacy Policy

Versioni shqip →

This website, THEA BY K (theashop.al), is operated by Kezjana Dardha, sole trader (natural person), Albanian tax ID (NUIS) M31731026C (“THEA BY K”, “we”, “us”). Protecting your data matters to us. Here we explain what we collect, why, where it stays, and how you can control it.

1. Who we are and how to contact us

Email: theabyk@gmail.com · WhatsApp: +355 69 565 7347.

2. What we collect and why

• Orders: your name, phone number, delivery address and city. We use them to process and deliver your order and to contact you about it.
• Account (optional): your email and name. An account can be created with an email address, or with a Google, Facebook, LinkedIn or TikTok account. From these networks we only receive what you approve on their consent screen (from TikTok: your TikTok ID and display name only; see section 6), and we only take your email when that network has verified it.
• WhatsApp verification: when you verify your number, we send you a code on WhatsApp. Verification is used for your account and the points programme.
• Newsletter: your email, only if you confirm it with the link we send you. You can unsubscribe at any time.
• Virtual try-on: if you use it, you upload a photo. It is processed only to generate your try-on image and is deleted right after generation. We do not keep it or use it for anything else.
• Reviews and customer photos: your rating, text and, if you send one, a photo. Photos are published only after we have reviewed them and only with your permission.
• Style assistant: the conversations you have with our AI style assistant about style and sizes. These messages are sent to the AI provider (see section 4). The shop owner can also read the conversations, in order to help you directly or to improve the assistant.
• Location: only if you press “Use my location” on the order form. The point is used to fill in the address and is stored with the order so the courier can find you; it is not used for anything else and you can remove it before ordering.
• Site visits: general statistics (number of visits, most viewed products). They do not identify you.

3. Cookies and browser storage

We use these types:

• Strictly necessary: your sign-in session, your cart, and protection against duplicate requests. The site does not work without them.
• For convenience: your saved contact for the next order, the last size you chose, recently viewed products, and visit counting. They are stored only in your browser.
• Statistics and advertising: Google Analytics (GA4) and the Meta pixel. They load only after you accept cookies with the button on the cookie banner. You can change this at any time by clearing the site data in your browser.
• Notifications: if you enable them, a token for browser notifications.

4. Who we share data with

We do not sell your data and we do not give it to anyone for other advertising. The providers that process it for us are:

• Courier (ADEX): name, phone and address, only to deliver the parcel.
• Meta (WhatsApp, Instagram, Facebook, pixel): messages and advertising statistics.
• Google: sign-in with a Google account, and Google Analytics.
• Google, Facebook, LinkedIn, TikTok: only for signing in with their account, when you choose it.
• Anthropic: conversations with our AI style assistant.
• Cloudflare: processing of the virtual try-on (temporary photo) and other technical services.
• Telegram: internal order notifications for our team.
• Email provider: sending confirmation and order emails.

Some of these providers are outside Albania and data may be processed in other countries. We only use services that offer recognised data protection.

5. Data from Google and YouTube (the shop's channel)

To publish our product videos on the shop's YouTube channel (“Thea By Kezjana”), our website connects to that channel through Google OAuth. Only the channel owner makes the connection, with her own Google account. It is separate from the customer sign-in with a Google account described in section 2.

• Permissions we request: (1) uploading videos to our channel (youtube.upload); (2) managing our channel so the site can post a comment under our own videos (youtube.force-ssl, the smallest permission YouTube offers for comments).
• What we do with them: we only publish our product videos (title, description, tags) and post, from our channel, a question as a comment under each video. We do not delete videos or comments.
• What we do not do: we do not read, collect or store data of other YouTube or Google users (viewers, commenters, subscribers). We do not use these permissions for advertising, we do not sell them and we do not give them to anyone.
• How it is stored: the sign-in tokens issued by Google are stored on our server, accessible only to administrators. They are used only by our website, for those two actions.
• Revoking access: the owner can remove the connection at any time at myaccount.google.com/permissions, or with the “Disconnect channel” button in the administrator panel, which deletes the tokens from the server.

THEA BY K's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data from TikTok

THEA BY K uses two TikTok for Developers products: Login Kit and Content Posting API.

• Sign-in with TikTok (customers): if you choose “Continue with TikTok”, TikTok gives us only your TikTok ID (open_id) and your display name (permission user.info.basic). We do not receive your email, phone number, videos, followers or messages. We use them only to recognise you when you sign in and to link your account to your orders. We do not share them or use them for advertising.
• The shop's own TikTok account (owner only): to publish THEA BY K's own product videos, the shop owner connects the shop's TikTok account to our website from the administrator panel. We request user.info.basic, video.upload and video.publish, and use them only to upload and publish our own videos with their captions to our own account.
• What we do not do: we do not read, collect or store data of other TikTok users (viewers, commenters, followers). We do not sell TikTok data or give it to anyone.
• How it is stored: the access tokens issued by TikTok are stored on our server, accessible only to administrators.
• Revoking access: you can remove THEA BY K's access at any time in your TikTok app settings (connected apps / permissions) or by writing to us; the shop owner can disconnect the shop's TikTok account in the administrator panel, which deletes the tokens from the server.

7. How long we keep data

We keep order data for as long as the law requires for sales records. An account stays active until you delete it. Try-on photos are deleted immediately. WhatsApp messages and conversations with the assistant are kept for the period needed for the service, then deleted.

8. How we protect it

The site uses HTTPS. Access to the admin panel is restricted, and requests sent from the site are checked to protect against unauthorised changes. No system is 100% secure, so please tell us if you suspect any problem.

9. Your rights

You can ask us at any time to:

• show you what data we hold about you;
• correct or update it;
• delete it (your account and any data we are not required by law to keep);
• withdraw from the newsletter or from your consent for photos, at any time;
• object to its use for advertising.

Write to theabyk@gmail.com or on WhatsApp. We will reply as soon as possible, and no later than the law requires.

If you believe your data is not being handled properly, you can complain to the Albanian authority for personal data protection.

10. Changes

We may update this policy. Important changes will appear here, with the new date.

Updated: October 2026.