Privacy Policy

Last updated: September 22, 2026

TUSSORA (“we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what personal data we collect when you visit tussora.com (the “Site”) or place an order with us, how we use it, who we share it with, and the rights you have over it. We have written this Policy so it is clear, complete, and works for both our United States customers (CCPA / CPRA) and our European Union / United Kingdom customers (GDPR).

At a glance

  • What we collect — contact, shipping, and payment data you give us at checkout; basic browsing data via cookies.
  • Why we use it — to take and fulfil your order, prevent fraud, and reply to your support requests.
  • Who we share it with — payment processors, our drop-ship fulfilment partner, carriers, and a small list of trusted service providers (see Section 7).
  • How long we keep it — for as long as your account is active, plus the periods required by tax, warranty, or law.
  • Your rights — access, deletion, correction, opt-out of sale, portability, and complaint to a supervisory authority.

1. Who is the data controller

TUSSORA is the data controller for the personal information collected through this Site. Our mailing address and the contact details for our Data Protection Officer are listed at the bottom of this Policy. If you are in the European Economic Area, the United Kingdom, or Switzerland, TUSSORA is also the controller under the GDPR.

2. Information we collect

We collect information in three ways:

  1. Information you give us. When you place an order, create an account, write to customer support, or sign up for emails, you provide your name, email, phone number, billing and shipping addresses, payment confirmation details, and any message you send us.
  2. Information collected automatically. When you browse the Site we log your IP address, device type, browser, referrer, pages viewed, and approximate location derived from your IP. We do this through cookies and similar technologies (see Section 6).
  3. Information from third parties. Payment processors notify us of payment status; carriers notify us of delivery status. We do not buy marketing lists.

3. How and why we use your information

We rely on the following legal bases under GDPR, and on the equivalent “business purposes” under U.S. state privacy laws:

  • Performance of a contract — to take payment, ship your order, handle returns, and provide customer support.
  • Legitimate interests — to keep the Site secure, prevent fraud, improve our products, and run basic analytics.
  • Your consent — for marketing emails and for any non-essential cookies.
  • Legal obligation — to keep records required by tax, accounting, and consumer-protection law.

We do not sell your personal information to third parties for money. We also do not share it for “cross-context behavioural advertising” as that term is defined under CPRA.

4. How long we keep your information

  • Order records — 7 years from the order date, for tax and warranty purposes.
  • Customer support emails — 24 months after the case is closed.
  • Marketing email subscriptions — until you unsubscribe.
  • Cookies (analytics, preferences) — between 30 days and 12 months, depending on the cookie.
  • Server access logs — 90 days, then deleted.

5. Your rights and how to exercise them

Depending on where you live, you have some or all of the following rights:

  • Right to know what personal data we hold about you.
  • Right to access a copy of that data in a portable format.
  • Right to correct inaccurate data.
  • Right to delete data we no longer need.
  • Right to opt out of any sale or sharing of personal information (we do not sell, but you can still tell us).
  • Right to limit the use of sensitive personal information.
  • Right to non-discrimination for exercising any of the above.
  • Right to withdraw consent at any time, where we rely on consent.
  • Right to lodge a complaint with your local data-protection authority.

To exercise any of these rights, email us at [email protected] from the address you originally used, or write to us at the postal address at the bottom of this page. We will respond within 30 days. We may ask you to verify your identity before disclosing data, to protect you from someone else pretending to be you.

6. Cookies and similar technologies

We use a small number of cookies and local-storage items:

  • Essential — keep your shopping cart, login, and checkout working. These cannot be disabled.
  • Analytics — count visits and measure performance. You can opt out from these.
  • Preferences — remember your shipping country and currency.

You can change your cookie preferences any time using the “Cookie settings” link in the footer of the Site, or by clearing cookies in your browser.

7. Who we share your information with

We share your information only with the following categories of recipients, and only the minimum they need to do their job:

  • Payment processors — PayPal and any future processor we add.
  • Drop-ship fulfilment partners — the warehouse operators we work with (currently a U.S.-based supply-chain partner) to pick, pack, and ship your order.
  • Carriers — UPS, USPS, FedEx, and regional freight carriers for LTL furniture shipments.
  • Custom-print production partners — for made-to-order items, only the data needed to print and ship your order.
  • Hosting and infrastructure — Cloudways (hosting), Zoho Mail (transactional email), and any future equivalent provider.
  • Analytics — a privacy-respecting analytics tool we use to count visits (we do not use Google Analytics in a way that sells your data).
  • Legal and tax authorities — when we are legally required to disclose.

We require every recipient by contract to treat your data at least as carefully as we do. We do not authorise them to use it for their own marketing.

8. International transfers

Our Site is operated from the United States. If you visit us from the European Economic Area, the United Kingdom, or Switzerland, your data will be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses (SCCs) to protect your data on that transfer.

9. Children’s privacy

The Site is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Security

We use HTTPS encryption across the Site, restrict employee access to personal data on a need-to-know basis, and review our security practices regularly. No method of transmission over the Internet, however, is 100% secure. If a security incident affects your data, we will notify you and the relevant authorities as required by law.

11. Automated decision-making

We do not make automated decisions about you that produce legal or similarly significant effects. Fraud-screening performed by our payment processor is the only automated processing that touches your data, and you can ask a human to review any outcome.

12. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date at the top tells you when it last changed. If the change is material, we will give you reasonable notice by email or by a banner on the Site before it takes effect.

Contact us

Questions about this Policy, or about your personal data? Write to [email protected]. We aim to reply within two business days.