Pre-orderLumen the Anglerpup — Tidewrack Bay

Draft — 11 details still to supply

These pages are not indexed and are left out of the sitemap until every value below has a real one. Fill them in at lib/legal-details.ts; this banner disappears on its own.

Legal entity name — The registered company name including its legal form, e.g. "Example Works SIA" or "Example Works Ltd". Not the trading name "RoPlush".
Registered address — The full registered office address on one line, street through to country.
Company register — The register the company is entered in, e.g. "Register of Enterprises of the Republic of Latvia" or "Companies House".
Registration number — The company registration number exactly as it appears on the register.
VAT number — The VAT identification number, e.g. "LV40000000000". If the company is not VAT-registered, write "Not VAT-registered" rather than leaving this blank.
Represented by — The name(s) of the director or board member(s) authorised to represent the company.
Governing law — The country whose law governs the contract, e.g. "Latvia". This does not remove a consumer's right to the protections of their own country of residence, and the terms say so.
Complaint response window — How long RoPlush takes to answer a written complaint, e.g. "14 days". Promise something reachable — it is a term of the contract.
Refund initiation window — How long after a campaign closes below its floor before refunds are issued, e.g. "5 business days". This is the load-bearing number on the refund page.
Refund arrival window — How long the buyer's bank then takes to post it, e.g. "5 to 10 business days". Check this against what your payment provider actually states.
Data protection authority — The supervisory authority a buyer may complain to, with its country, e.g. "Data State Inspectorate (Latvia)".

Privacy policy

What RoPlush collects when you pre-order, who processes it, how long it is kept, and the rights you have over it under the GDPR.

Last updated 26 August 2026

This policy explains what we do with your personal data when you visit roplush.com or pre-order a plush. It is written to be read, not to be survivable.

Who is responsible

The controller of your personal data is To supplyLegal entity name, To supplyRegistered address, registered under number To supplyRegistration number.

For anything about your data, write to support@roplush.com.

The short version

We do not run analytics, advertising or tracking of any kind on this site.
We set one cookie, and only when you put something in your basket.
If you order, we hold your order and delivery details for as long as tax law requires.
We never sell your data, and we do not share it for anyone else's marketing.

Browsing the site

Reading roplush.com sets no cookies and runs no analytics. There is no Google Analytics, no advertising pixel, no session recording and no fingerprinting, so there is nothing to consent to and no banner asking you to.

Our host, Vercel, keeps short-lived server logs — including IP addresses — to serve the site and to defend it against attack and abuse. That is our legitimate interest in keeping the site up (Article 6(1)(f) GDPR). These logs are kept briefly and are not used to build any profile of you.

The one cookie

When you add a plush to your basket, we store a basket identifier in a cookie.

It is httpOnly, so no script on the page can read it.
It holds an identifier for a Shopify basket. It does not hold your name, your address or anything about your payment.
Its only job is to keep your basket when you reload the page or come back later.

It is a strictly necessary cookie: without it a basket cannot work at all. That is why it does not require consent, and why it is the only one we set.

Pre-ordering

Checkout happens on Shopify, which is our platform and our processor. When you order, the following is processed:

What	Why	Legal basis
Name, delivery address, email	To manufacture, ship and support your order	Performance of a contract, Art. 6(1)(b)
Order contents, price, currency	Same, plus the tax invoice	Contract, and legal obligation Art. 6(1)(c)
Payment result and card fingerprint	To take payment, refund it, and stop fraud	Contract, and legitimate interest Art. 6(1)(f)
Country and tax status	To charge the right VAT and issue the right invoice	Legal obligation, Art. 6(1)(c)

We never see your card number. Card details go from your browser to Shopify's payment providers. We receive only whether a payment succeeded, the amount, and the last four digits.

Who else processes your data

Who	What they do	Where
Shopify	Checkout, payments, tax invoicing, order records	EU/US, standard contractual clauses
Vercel	Hosting and delivering this website	EU/US, standard contractual clauses
Payment providers	Taking and refunding payment	Set by Shopify at checkout
Fulfilment and carriers	Packing and delivering your parcel	Depends on your delivery address

Each is a processor acting on our instructions under a data processing agreement, except the payment providers, which are independent controllers for fraud prevention and their own regulatory obligations. Where data goes outside the EEA, it is covered by the European Commission's standard contractual clauses.

We do not sell your personal data, and we do not share it for anyone else's marketing — including our game-studio partners. A partner receives sales figures, never buyers.

Email

We email you about your own order: confirmation, whether the campaign cleared its floor, refunds, and dispatch. That is part of performing the contract, and you cannot unsubscribe from it while an order is open.

We do not currently send marketing email and have no mailing list. If that changes, it will be opt-in, and asking will be a separate, obvious choice — never a pre-ticked box at checkout.

How long we keep it

Order and invoice records: as long as tax and accounting law requires, which is commonly seven to ten years depending on the country. We cannot delete these earlier, and a deletion request does not override it.
Support email: three years from the last message, so we can pick up a thread about a plush that shipped a long time ago.
Basket cookie: until it expires or you clear it. A basket that is never checked out is dropped by Shopify after a period of inactivity.
Server logs: short-lived, as set by our host.

Your rights

Under the GDPR you can ask us to:

give you a copy of the data we hold about you
correct it if it is wrong
delete it, where we are not required to keep it
restrict or object to how we use it
send it to you, or to someone else, in a portable format

Write to support@roplush.com. We answer within one month, and we do not charge for it. We may need to confirm who you are first — usually by writing from the address you ordered with.

If you think we have handled your data badly, please tell us so we can fix it. You also have the right to complain to a supervisory authority, which for us is the To supplyData protection authority, or to the authority in the EU country where you live.

Children

RoPlush sells to adults. Roblox games are played by a lot of people under 18, so to be clear: you must be 18 or older to place an order, or have a parent or guardian place it for you. We do not knowingly collect data from children. If you believe a child has ordered without permission, write to us and we will cancel the order and delete the data.

Changes

If we change this policy we will change the date at the top of the page. If a change is significant and affects an order you have already placed, we will email you rather than rely on you re-reading this page.