Phone cases & tablet covers Free UK delivery Dispatched from the UK
Account Basket 0

Privacy Policy

Last updated: 24 October 2026

Who is responsible for your information

MaxPro Cases Ltd trading as FoneZilla is responsible for the personal information described in this notice. Our business and returns address is Unit 1, 300 Swanston Street, Lairds Business Complex, Glasgow, G41 4HW, United Kingdom. Email fonezillastore@gmail.com for customer service or privacy enquiries.

MaxPro Cases Ltd is registered in Scotland, company number SC689363. Registered office: 0/2 18 Plantation Park Gardens, Glasgow, Scotland, G51 1NW.

Information we collect

We collect the details you provide when you order, create an account, request a return or contact us: your name, email address, billing and delivery addresses, telephone number where supplied, order details and correspondence. We receive payment status and transaction references from payment providers. Account passwords are stored as hashes.

We also process technical information such as IP addresses, browser and device information, session identifiers and security logs. Payment and fraud-protection services may process information about your device and interaction with checkout to assess whether a request is genuine.

For destinations requiring a carrier availability check, we use the delivery address you provide to check whether delivery can be arranged. We keep a hashed address reference, the verification date and an evidence reference for an address-specific approval. Approval expires after seven days; expired approval records are removed by our daily cleanup task after expiry, or during subsequent operator review. These records are used to arrange the delivery you request.

Why we use your information

  • To process orders, arrange delivery, handle returns and provide requested account services: performance of a contract or steps you request before a contract.
  • To keep records required by accounting, tax and other laws: legal obligations.
  • To secure the website, prevent fraud, investigate problems and handle routine enquiries: our legitimate interests in operating and protecting the store, balanced against your rights.

We need contact and delivery details to supply goods. Guest checkout does not require you to create an account. With your consent, we use Google Analytics to understand visits and shopping activity and improve our store. We do not currently operate an optional marketing programme.

Product reviews and optional review emails

When you send a product review, you choose to submit your display name, star rating and review text for public display after moderation. Your email address is kept private and is used to check purchases and manage the review. Please avoid including addresses, order numbers or other private details in your review. We check for spam, personal information and content unrelated to the product; positive and negative feedback are equally welcome. We use purchase records for verified-owner labels and do not load external profile pictures on reviews.

You can separately choose one review-request email on your paid order receipt. This is optional, is based on your consent and does not sign you up for offers. The email is scheduled seven days after we confirm delivery. We record the wording and time of your request, an email reference, delivery confirmation and whether sending was attempted or completed. You can cancel the request on the receipt before it is sent, use the email’s cancellation link or contact us. Changing the order email address does not transfer your consent to another address.

Reviews remain displayed while relevant to the product; contact us to request correction or removal. Review-email choice and sending records are kept with the order under the order-retention schedule below. If a review or its moderation record is no longer needed, it is removed or anonymised after considering any unresolved dispute. Our legitimate interests support review moderation and preventing abuse; public submission and optional email requests are your choices and can be withdrawn by contacting us.

Who receives information

We share only the information needed for the relevant service with delivery providers, payment services, technical providers and, where required, accountants, advisers and public authorities. Authorised staff may access information needed for their work.

  • Royal Mail receives delivery information for suitable UK accessories and eligible international parcels. Evri receives delivery information for UK table orders.
  • Stripe and PayPal process information needed for the payment methods offered at checkout, including transaction, contact and device information and fraud checks. We do not store full card numbers or card security codes in our store database. Their own notices explain processing they perform for their separate purposes: Stripe privacy notice and PayPal privacy statement.
  • Google reCAPTCHA supports PayPal checkout security and prevention of automated payment abuse. It may process technical and interaction information for these checks. Stripe can also load hCaptcha to support its fraud checks.
  • Resend delivers transactional and explicitly requested review emails, which may include contact, delivery and order details. Gmail is used for customer-service correspondence.
  • Krystal hosts the website and our domain mailboxes. Restricted-access recovery copies remain with SiteGround during the hosting migration. Encrypted backups and a private staging copy are kept on our Ubuntu server for recovery and testing.

Available payment methods are displayed at checkout. We use Stripe for card payments and PayPal for PayPal payments. Store-side express wallet buttons, saved-payment features, Link and Pay Later promotions are not part of our initial store configuration. PayPal may offer funding choices within its own checkout, under its own terms and privacy settings.

Payment and fraud providers may use automated assessments to approve, challenge or reject a transaction. If a genuine purchase is blocked, contact us so we can investigate available options. The relevant payment provider explains its own decision-making and rights in its privacy information.

Cookies and similar technologies

Basket, login and request-security functions use cookies and browser storage. Guest basket sessions normally last two days; logged-in basket sessions can last seven days. Basket-count and basket-hash cookies last for the browser session. Login cookies normally last two days, or two weeks when Remember Me is selected. Some browser storage remains until cleared by the website or your browser. Referral and campaign attribution is disabled.

WooCommerce also keeps basket/cache and request-security data in browser storage, including storeApiCartData, storeApiCartHash and storeApiNonce. Local browser storage can remain until replaced or cleared by the website or your browser.

Stripe fraud checks and Google reCAPTCHA security checks can load at checkout before you choose a payment method. Their browser storage may remain when you switch between card and PayPal.

Payment and fraud-protection services can also use cookies and similar technologies. Optional Google Analytics storage is used only after you select Accept analytics in our cookie panel. Rejecting analytics does not prevent you from shopping. You can reopen Cookie settings to change your choice. You can clear browser storage, although removing necessary storage may interrupt basket or login functions.

Optional Google Analytics

If you accept analytics, Google Analytics 4 receives page views and shopping events, such as products viewed, basket changes, checkout starts and paid purchases. These help us understand which products and pages are useful. Google also processes technical information such as browser/device characteristics and connection information to provide the service. We do not deliberately send names, email addresses, delivery addresses, telephone numbers, payment details or order access keys to Analytics. Shopping events include product identifiers, quantities, prices and, for purchases, a transaction reference. Google signals and advertising personalisation are disabled in our website configuration.

The Google analytics tag is blocked until you accept. Your analytics choice is stored in your browser under fz_analytics_choice_v1 for up to 180 days. A necessary fz_analytics_denied cookie also remembers rejection for up to 180 days, including when local storage cannot be written. If browser storage is unavailable, the choice may not be remembered. Analytics cookies _ga and _ga_WNB18E3T1B distinguish visits and sessions; we configure a maximum lifetime of 180 days without extending it on each visit. A session-storage entry fz_ga_purchases helps avoid counting the same purchase repeatedly within a browser session. On withdrawal, we disable collection, remove applicable first-party analytics cookies and reload the page to unload the tag. Withdrawal does not erase information already received by Google.

Our legal basis for optional analytics is your consent. Google provides Analytics and may process information outside the UK, including in the United States. See Google’s privacy policy, Google’s data processing terms and UK transfer terms. You can use Cookie settings on any store page to accept or reject future analytics. Contact us for privacy requests or questions about information already collected.

Payment and security storage

The following is a guide to storage used by our payment and security services. Browser restrictions and provider changes can affect lifetimes.

  • __stripe_mid: a Stripe fraud-prevention identifier, normally up to one year.
  • __stripe_sid: a Stripe fraud-prevention session identifier, normally 30 minutes.
  • m on Stripe’s domain: fraud detection; our browser check showed about 400 days. Stripe’s published list describes a lifetime of up to two years.
  • Stripe fraud-check session storage, including _ab, _mf and id: for the browser session.
  • __cf_bm on hCaptcha’s domain: security and automated-abuse checks, about 30 minutes in our check.
  • _GRECAPTCHA on Google’s domain: reCAPTCHA risk analysis, about six months in our check. reCAPTCHA also uses local storage, including _grecaptcha and rc::a, which can remain until cleared.

These services assess technical signals and activity to distinguish genuine requests from automated abuse. Optional saved-payment, wallet or cross-site convenience features may use additional storage; they require a separate purpose and consent assessment where applicable. No blanket consent exemption is claimed for every payment-provider technology. When you choose PayPal, its own payment pages may use additional cookies for security, account login, functionality and other purposes described in PayPal’s cookie statement. Its applicable choices and notices are provided on those pages. See Stripe’s privacy centre and cookie list for its explanations.

How long we keep information

Required accounting records are retained for six years after the end of the company financial year they relate to, with longer retention where the law or a specific dispute requires it. Paid and refunded order records are assessed with those obligations in mind.

Our retention schedule calls for review of unpaid abandoned orders and routine troubleshooting logs after 30 days, routine support correspondence two years after closure, and inactive accounts after two years, with notice before account closure. Store-side transactional-email logs are removed by a separate daily cleanup task once they are older than 30 days. This runs on our Ubuntu server for our store and recovery copies and depends on the server and connection being available; missed or failed runs are checked and retried. Abandoned orders, support correspondence and inactive accounts are reviewed manually under the schedule above. Information needed for an unresolved dispute or investigation is assessed separately. Recovery backups are encrypted and restricted to authorised access. Our automatic backup rotation retains copies for the seven most recent daily dates and four most recent weeks, with the latest successful copy retained if a source cannot be backed up. Provider retention is separate from our store cleanup. Resend publishes 30-day email and log retention for its Free, Pro and Scale plans, with different Enterprise arrangements, seven-day backups and deletion of remaining customer data within 90 days of account termination. Stripe and PayPal can retain payment records for their own legal, security and financial obligations; our store cleanup does not erase their records. Gmail correspondence is reviewed manually. Hosting and security providers retain operational records under their own published terms and legal or security requirements; our store cleanup does not remove those provider records.

Processing outside the United Kingdom

Payment, email, hosting and security providers may process information outside the UK, including in the United States and European countries. Resend stores customer email data in the United States; selecting its Irish sending region changes where email is sent from, not where the data is stored.

Providers describe their processing and international transfer safeguards in their published notices and agreements. Resend’s data processing terms include standard contractual clauses and a UK Addendum for applicable UK transfers. Relevant documents include Stripe’s data processing agreement, Resend’s data processing addendum, Resend’s subprocessor list, Krystal’s data processing agreement, Google’s privacy policy and PayPal’s privacy statement above. Contact us to ask about the safeguards applicable to your information.

Your rights

Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your information. Where processing is based on consent, you can withdraw consent without affecting earlier lawful processing. Rights have limits, including where records must be retained by law.

You have the right to object to processing based on legitimate interests, including our fraud-prevention and security interests. We will consider your request and any compelling grounds or legal claims that require continued processing.

Contact us at fonezillastore@gmail.com. We may reasonably verify your identity. You can complain to the Information Commissioner’s Office; contacting us first is welcome but is not required.

Updates

We will update this notice when our processing changes and show the revision date. Material changes will be communicated where appropriate.