Privacy policy

Privacy Policy

Effective date: 01/07/2026 · Last updated: 01/07/2026

This Privacy Policy explains how KB Beauty Inc, a company incorporated in Delaware, USA (registered office 651 N Broad Street, Suite 206, Middletown, DE 19709, USA), trading as "Phantom Towels" ("we," "us," "our"), collects, uses, shares and protects your personal information when you use our websites phantom-towels.com and the-phantom-universe.com (the "Site"), our social media accounts and messaging services, or otherwise interact with us.

We are the data controller of your personal information. For purchases, this Policy should be read alongside our [Terms of Sale] and [Terms of Service].

How to contact us about privacy: info@phantom-towels.com.

Representatives (UK & EU) — Article 27 GDPR. As we are based outside the UK and EU but offer goods to UK and EU residents, we have appointed representatives under Article 27 of the UK and EU GDPR. If you are in the EU/EEA or the UK, you may contact the relevant representative on any matter relating to our processing of your personal data:

  • UK Representative: Euverify Ltd (UK), 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom — gdpr@euverify.com
  • EU Representative: Euverify Ltd (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland — gdpr@euverify.com

To submit a Data Subject Access Request (DSAR), a deletion request, or any other GDPR request, you can use the secure portal at https://gdpr.euverify.com/verify/a7494fe7-c195-4cdd-8f53-d92d5f389954, where you can also verify our appointed representative. Requests submitted through the portal are logged and tracked to ensure a timely response.

1. The information we collect

Depending on how you interact with us, we may collect:

  • Identity and contact data — your name, business name, billing and delivery address, email address and phone number.
  • Order and transaction data — products purchased, order value, delivery details, returns and correspondence.
  • Payment data — processed by our payment providers; we do not store full card numbers (card data is encrypted in transit).
  • Marketing and communications data — your marketing preferences, sign-ups (e.g. giveaways, sample requests, newsletter), and messages you send us.
  • Technical and usage data — IP address, device and browser information, and Site usage collected via cookies and similar technologies (see Section 6).
  • Location data — approximate geographic location derived from your IP address or provided by you.

We collect this directly from you, automatically as you use the Site, and from third parties such as our e-commerce, advertising and analytics providers.

2. How we use your information, and our lawful bases

Under UK/EU GDPR we must have a lawful basis for each use:

  • To fulfil your order, process payment, deliver, handle returns and provide customer support — performance of a contract.
  • To send you marketing about our products and offers — your consent (or the "soft opt-in" for existing customers, where permitted); you can opt out at any time.
  • To operate, secure and improve the Site, understand how it is used, prevent fraud and protect our rights — our legitimate interests.
  • To keep tax, accounting and other legally required records — compliance with a legal obligation.
  • For any other purpose we explain to you at the time — your consent.

3. Marketing

We send marketing only where we are permitted to. You can withdraw consent or opt out at any time using the unsubscribe link in any marketing email or by contacting info@phantom-towels.com. Opting out of marketing does not stop service messages about your orders.

4. Sharing your information

We share personal information only as described here, and we do not sell your personal information for money. We may share it with:

  • Service providers (processors) who act on our instructions — for example our e-commerce platform (Shopify), email/marketing platform (Klaviyo), payment processors, fulfilment and shipping providers (e.g. ShipBob and carriers), and analytics providers. They may only use it to perform services for us.
  • Advertising partners — see Section 5.
  • Authorities or others where required by law or to protect our rights, and in connection with a merger, acquisition or asset sale (with notice to you).

5. Advertising

We use advertising tools, including the Meta (Facebook/Instagram) pixel and custom/lookalike audiences, which may share online identifiers (such as a hashed email or device data) with advertising platforms so we can show you relevant ads and reach similar audiences. Because these rely on non-essential cookies and similar technologies, we use them only with your consent, which you give — and can withdraw — through our cookie banner and settings (see Section 6). You can also manage ad personalisation directly with the relevant platform (for example, in your Facebook or Instagram ad settings).

6. Cookies and similar technologies

We use cookies and similar technologies for essential Site functions, to remember your preferences, for analytics, and for advertising. Non-essential cookies are used only with your consent, which you give (and can change) through our cookie banner/settings. [Link to a separate Cookie Policy if you publish one.] You can also control cookies through your browser. Blocking some cookies may affect how the Site works.

7. International transfers

We are based in the USA and some of our service providers and staff are located outside the UK/EU (including in the United States and the Philippines). Where we transfer personal data of UK or EU residents outside the UK/EU, we use an approved safeguard, such as the UK International Data Transfer Agreement (IDTA) / Addendum, the EU Standard Contractual Clauses, or reliance on the UK Extension to the EU-US Data Privacy Framework / EU-US Data Privacy Framework where the recipient is certified. You can ask us for details using the contact above.

8. How long we keep your information

We keep personal information only as long as necessary for the purposes above:

  • Order and transaction records — for 6 years to meet tax and accounting obligations.
  • Account data — while your account is active and for a reasonable period afterwards.
  • Marketing data — until you opt out or withdraw consent, then suppressed from marketing.
  • Other data — for no longer than needed, after which it is deleted or anonymised.

9. Security

We use appropriate technical and organisational measures to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights — UK and EU (GDPR)

If you are in the UK or EU, you have the right to: access your data; have it corrected; have it erased; restrict or object to processing (including objecting to direct marketing and to profiling for marketing); data portability; and to withdraw consent at any time (without affecting prior processing). We will not discriminate against you for exercising these rights.

To exercise them, contact info@phantom-towels.com, use our GDPR portal at https://gdpr.euverify.com/verify/a7494fe7-c195-4cdd-8f53-d92d5f389954, or contact our UK/EU representative (above). You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO), ico.org.uk — though we'd appreciate the chance to address your concern first.

11. Your rights — United States

We are a small business and we do not sell your personal information for money. We do not meet the thresholds that make the California Consumer Privacy Act (CCPA/CPRA) or similar US state privacy laws mandatory for us, so we do not operate the formal opt-out and verified-request mechanisms those laws require.

Even so, if you are a US resident — including in California — and would like to see a copy of the personal information we hold about you, or ask us to correct or delete it, you are welcome to contact us at info@phantom-towels.com and we will help where we reasonably can. We will not discriminate against you for making such a request.

12. Children's privacy

The Site is not intended for, and we do not knowingly collect personal information from, anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on this page, update the "Last updated" date, and — where the changes are significant — give a prominent notice on the Site before they take effect. Please review this page periodically.

14. Contact us

KB Beauty Inc (trading as Phantom Towels) 651 N Broad Street, Suite 206, Middletown, DE 19709, USA Email: info@phantom-towels.com Contact page: https://phantom-towels.com/pages/contact

UK Representative (Article 27): Euverify Ltd (UK), 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom — gdpr@euverify.com EU Representative (Article 27): Euverify Ltd (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland — gdpr@euverify.com GDPR request portal: https://gdpr.euverify.com/verify/a7494fe7-c195-4cdd-8f53-d92d5f389954