Privacy policy

Last updated: 2026-09-16

This policy explains what personal data Meriklo collects when you visit this store or place an order, why we collect it, the legal basis we rely on, who sees it, where it goes, how long we keep it, and what rights you have.

1. Who is responsible

Meriklo is operated by Yahel Dimnik, in Israel. That business is the "controller" of your data under the EU GDPR and the UK GDPR, the "business" under the California Consumer Privacy Act, and the "database owner" under the Israeli Privacy Protection Law, 5741-1981. Privacy questions go to support.vapora@gmail.com.

2. What we collect

  • Order details: your name, shipping address, billing address, email address, a phone number if you enter one, what you ordered, the price, the order date and the order number.
  • Payment: your card or wallet details are entered on a checkout page run by Shopify and are handled by our payment processor. We never see or store your full card number. We receive a confirmation that payment succeeded and the last four digits of the card.
  • Support email: when you write to us, we keep your email and our reply.
  • Contact form: your name if you give it, your email address, an order number if you give one, the topic you pick, your message and the record that you ticked the consent box.
  • Device and log data: Shopify, which hosts this store, records technical data when you visit: IP address, browser and device type, the pages you view, the time of your visit and the site that sent you here. Shopify uses this to run the store, keep it secure and prevent fraud.
  • Cookies: Shopify sets the cookies needed for the cart and checkout, and its own store-analytics cookies. We have installed no analytics or advertising tools of our own. The cookie policy lists every cookie by name.

We do not collect data we do not need. We do not ask for your date of birth or government ID numbers, and we do not ask about your health; if you send us a safety report that describes an injury, we keep what you tell us only as part of that report (sections 3 and 7). Giving us your data is voluntary, but we cannot ship an order without a name, a delivery address and an email address.

Purpose Data Legal basis (GDPR / UK GDPR Article 6)
Taking your order, charging you and shipping it Order details, payment confirmation 6(1)(b) performance of a contract
Sending the order confirmation, shipping confirmation and any delay notice Email address, order details 6(1)(b) performance of a contract; a delay notice is also a legal duty under the US FTC Mail, Internet, or Telephone Order Merchandise Rule
Replying to your emails; handling returns, warranty claims and safety reports Order details, support emails 6(1)(b) performance of a contract; 6(1)(c) legal obligation for product-safety records
Replying to contact-form messages Name, email address, order number, message 6(1)(a) consent (the box you tick), which you can withdraw at any time
Keeping accounting and tax records Order details 6(1)(c) legal obligation
Preventing fraud and keeping the store secure Device and log data, order details 6(1)(f) legitimate interests, ours and other customers'
Recalling or warning about a product if a safety issue is found Order details, email address 6(1)(c) legal obligation and 6(1)(f) legitimate interests, yours and ours

We do not send marketing email at launch. If we start, it will be only with your consent, with an unsubscribe link in every message, and this policy will be updated first.

We do not make automated decisions about you that have legal or similar effects. Fraud screening at checkout is run by Shopify and our payment processor as part of taking payment.

Notice under section 11 of the Israeli Privacy Protection Law: you are not legally required to give us your data; the purpose of collecting it is to fulfil and support your order as described in this section; it is passed only to the recipients in section 4 and for the purposes stated there.

4. Who we share it with

We share data only with the companies that help us run the store. No one else receives it, and we do not sell it.

  • Shopify (Shopify International Limited and its affiliates, including Shopify Inc. in Canada and Shopify's data centers in the United States) hosts the store and the checkout, stores order data on our behalf, and sends the order and shipping emails. Shopify's privacy policy describes how it handles that data.
  • Our payment processor receives your payment details to take the payment and to screen for fraud.
  • The warehouse in the United States that packs and ships your order, and the carrier, receive your name, delivery address, phone number if you gave one, and the contents of the parcel.
  • Our email provider, Google (Gmail), carries support correspondence.
  • hCaptcha (Intuition Machines, Inc.), the CAPTCHA service Shopify uses to protect the contact form and the opt-out control on the Your Privacy Choices page, receives technical data about your browser and connection and how you interact with the CAPTCHA while it runs, to tell a person from a bot.

We disclose data to public authorities only when the law requires it, for example a product-safety authority investigating an incident, or a tax authority.

We do not share your data with advertisers or data brokers, and we do not use it for cross-context behavioral advertising.

5. Where your data goes

We are in Israel. Shopify and the other providers process data in the United States, Canada and the European Union. If you are in the European Economic Area or the United Kingdom, transfers of your data to us rely on the European Commission's adequacy decision for Israel (Decision 2011/61/EU) and the UK's adequacy regulations for Israel; transfers by Shopify and our other providers rely on the safeguards those providers offer, such as the EU standard contractual clauses or a data privacy framework certification. You can ask us for a copy of the safeguard that applies.

6. Security

Checkout runs on Shopify, which is certified to PCI DSS Level 1 (see Shopify's PCI compliance page). Data travels over encrypted connections. We limit access to order data to the people who need it to fulfil and support orders.

7. How long we keep it

  • Order records: for as long as Israeli accounting and tax law requires us to keep them, then deleted.
  • Support emails and contact-form messages: until the matter is closed and any return, warranty or legal period tied to it has passed, then deleted.
  • Product-safety reports: for the period required by product-safety law in the markets sold to, because they may be needed for a recall or an investigation.
  • Device and log data: kept by Shopify for the periods set out in Shopify's privacy policy.
  • Cookies: see the cookie policy.

8. Your rights

Wherever you live, you can email support.vapora@gmail.com to ask what data we hold about you, to correct it, or to have it deleted. We reply by email and may ask you to confirm your identity first, for example by writing from the email address on the order.

If you are in the European Economic Area or the United Kingdom (GDPR / UK GDPR), you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted, where we no longer need it;
  • receive the data you gave us in a portable, machine-readable format;
  • restrict or object to processing that rests on legitimate interests;
  • withdraw consent at any time, where processing rests on consent, without affecting what was done before;
  • complain to your data protection authority. In the UK that is the Information Commissioner's Office. In the EU it is the authority of the member state where you live; the list is on the European Data Protection Board's site.

If you are in Israel, you have the right under the Privacy Protection Law to inspect the data held about you and to ask for it to be corrected or deleted, and you can complain to the Privacy Protection Authority.

We do not charge for these requests, and we act on them within the time the applicable law allows.

9. California and other US states

If you are a California resident (CCPA / CPRA), you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of the sale or sharing of your personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.

We do not sell your personal information and we do not share it for cross-context behavioral advertising. Because of that there is nothing to opt out of today, and this section is our notice of that. If we ever add an advertising pixel, we will add a "Do Not Sell or Share My Personal Information" link to every page before it goes live, and Shopify's opt-out page honors the Global Privacy Control browser signal as an opt-out. Shopify's opt-out control on our Your Privacy Choices page already lets you record an opt-out preference for your browser, although nothing is sold or shared today. Apart from what you choose to tell us in a safety report, we do not collect sensitive personal information as the CPRA defines it.

In the last 12 months we have collected the categories listed in section 2 (identifiers, commercial information, internet activity) for the purposes in section 3, and disclosed them to the service providers in section 4. We have not sold or shared personal information.

Residents of other US states with privacy laws have similar rights. Email us and we will apply them.

10. Children

This store sells an appliance that produces hot steam. It is for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, email us and we will delete it.

11. Do Not Track and Global Privacy Control

We run no analytics or advertising tools of our own, so at launch a browser "Do Not Track" or Global Privacy Control signal changes nothing on this site beyond Shopify recording the preference for your browser. Shopify's own store-analytics cookies are set when you visit; no consent banner is shown today because the store sells to the United States only (see the cookie policy, section 7). If we ever add such tools, the banner will let you refuse them and the Global Privacy Control signal will be honored as an opt-out.

12. Changes to this policy

When we change how we handle data, we update this page and the date at the top. If we install analytics, advertising or email-marketing tools, we update this policy and the cookie policy before they go live.

13. Contact

Email: support.vapora@gmail.com Yahel Dimnik