Effective Date: February 11, 2025
This Privacy Policy completely supersedes any previous privacy policies. Changes include:
Updates to address recent changes in U.S. state privacy laws;
Updates regarding the types of personal data we collect and our disclosure practices; and
Changes to our advertising, marketing, and tracking technology practices to reflect market changes and provide opt-out options. We take your privacy very seriously. Please read this Privacy Policy to understand how we handle your personal data. By using or accessing our Services in any manner, you acknowledge and accept the practices and policies described herein, and you agree that we may collect, use, and share your information in the manner described in this Privacy Policy.
Please note that your use of the Services is always subject to our Terms of Service, which incorporates this Privacy Policy. Any terms not defined in this Policy shall have the meanings set forth in the Terms of Service.
Categories of Personal Data Sources
We collect your personal data from the following categories of sources:
You
When you provide such information directly to us.
When you create an account or use our interactive tools and services.
When you voluntarily provide information in free-text fields through the Services or in questionnaires.
When you purchase items from our online store, as part of the buying and selling process.
When you voluntarily sign up for our subscription or rewards programs, or respond to surveys.
When you send us emails or otherwise contact us.
When you use the Services, such information is collected automatically.
Through Cookies (defined below in the “Tracking Tools, Advertising, and Opt-Out” section).
If you browse our online store or use a browser with location-enabled features, we may receive information about your browser, operating system, location, and mobile device (where applicable).
When you voluntarily choose to interact with various types of technologies and applications—including, but not limited to, Artificial Intelligence services (as defined in the Terms of Service)—or when you use online coupons or mobile scan-and-shop features.
Third Parties
Vendors
We may use analytics service providers to analyze how you interact with and engage with the Services, or third parties may assist us in providing customer support to you.
We may utilize vendors to obtain information for the purposes of generating sales leads, enriching data, and creating user profiles.
Advertising Partners
We receive information about you from certain vendors who assist us with marketing or promotional services related to how you interact with our websites, applications, products, services, advertisements, or communications.
Social Networks
If you provide us with your social network account credentials, or log in to the Services through a third-party website or service, certain content and/or information from those accounts may be transferred to your account with us.
Business or Commercial Purposes for Which We Collect or Disclose Personal Data
Providing, Customizing, and Improving the Services
Creating and managing your account or other user profiles.
Processing orders or other transactions; billing.
Providing you with the products, services, or information you have requested.
Fulfilling or meeting the reason for which you provided the information to us.
Providing support and assistance across various departments.
Allowing you to access and manage your current and past orders through the Services.
Improving the Services, including through testing, research, internal analytics, product development, and the development and improvement of statistical, analytical, or predictive models. Provide you with personalized services, website content, and communications based on your preferences, interests, and inferred characteristics.
Create and utilize consumer profiles and insights derived from your interactions with the Services to improve the Services and enable personalization.
Conduct fraud prevention, security measures, and debugging.
Fulfill other business purposes as described at the time your personal data is collected, or as otherwise provided for under applicable data privacy laws (e.g., the California Consumer Privacy Act as amended by the California Privacy Rights Act of 2020, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Delaware Personal Data Privacy Act, the Indiana Consumer Data Protection Act, the Iowa Consumer Data Protection Act, the Kentucky Consumer Data Protection Act, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, the Montana Consumer Data Privacy Act, the Nebraska Data Privacy Act, the Oregon Consumer Privacy Act, the Rhode Island Data Transparency and Privacy Protection Act, the Tennessee Information Protection Act, the Texas Data Privacy and Security Act, the New Hampshire Privacy Act, the New Jersey Privacy Act, the Utah Consumer Privacy Act, or the Virginia Consumer Data Protection Act (collectively, “U.S. State Privacy Laws”)).
Service Marketing
Promote and sell our Services, as well as our online store offerings, new products, and other updates (including checkout reminders).
Utilize market insights, segmentation, and user profiles derived from analytics and modeling to personalize marketing communications and products.
Display advertisements to you, including interest-based advertising or online behavioral advertising.
Communicate with You
Respond to correspondence we receive from you, contact you when necessary or at your request, and send you information regarding the Services.
Send emails and other communications, or display content that we believe may be of interest to you, based on your preferences. Other Permissible Purposes for Processing Personal Data
Additionally, the various categories of personal data described above may be collected, used, and potentially disclosed to government entities (including law enforcement) or other parties to satisfy certain legal requirements and to enforce legal terms, including: fulfilling our legal obligations under applicable laws, regulations, court orders, or other legal processes—such as preventing, detecting, and investigating security incidents and potential illegal or prohibited activities; protecting the rights, property, or safety of you or other parties; enforcing any agreements entered into with you; responding to claims that any post or other content violates the rights of third parties; and resolving disputes.
We will not collect additional categories of personal data, nor will we use the personal data we collect for purposes that are materially different, unrelated, or incompatible with the original purposes, without providing you with prior notice.
How We Disclose Your Personal Data
We disclose your personal data to the various categories of service providers and other parties listed in this section. Depending on the applicable laws in your state, some of these disclosures may constitute a “sale” of your personal data. For more information, please refer to the “U.S. State Privacy Rights” section below.
Service Providers. These partners assist us in providing our services or perform business functions on our behalf. These include:
Hosting, technology, and communications service providers—including, but not limited to, SMS service providers.
Security and fraud prevention consultants.
Analytics, conversion tracking, and data enrichment providers.
Support and customer service providers.
Product fulfillment and shipping service providers.
Payment processors.
Our payment processing partners (including Shopify, its first-party payment processor Recharge, and Braintree) collect the payment card information you voluntarily provide in order to process your payments. For information on how these partners use and store your personal data, please refer to the respective payment processing partners’ Terms of Service and Privacy Policies.
Please refer to Shopify’s Terms of Service and Privacy Policy to understand how it uses and stores your personal data.
Please refer to Recharge’s Terms of Service and Privacy Policy to understand how it uses and stores your personal data.
Please refer to Braintree’s Payment Services Agreement and Privacy Policy for information regarding how it uses and stores your personal data.
Advertising Partners. These partners help us promote our services and provide you with other offers that may be of interest to you. These include:
Advertising networks.
Data brokers.
Marketing service providers.
Data cooperatives. Analytics service providers that support targeted advertising.
Business Partners. These partners collaborate with us to provide various services. They include:
Businesses with which you have a business relationship.
Companies with which we partner to offer joint promotional offers or opportunities.
Parties you have authorized, accessed, or verified.
Third parties you access through the Services.
Social media services.
Other parties you have authorized.
Legal Obligations
We may disclose any personal data we collect to third parties for any of the activities described in the “Other Permitted Purposes for Processing Personal Data” section above.
Business Transfers
All personal data we collect may be transferred to third parties in the following circumstances: if we undergo a merger, acquisition, bankruptcy, or other transaction that results in a third party (wholly or partially) assuming control of our business.
Non-Personal Data
We may aggregate, de-identify, or anonymize the personal data we collect, including by removing information that identifies specific users. We may use such aggregated, de-identified, or anonymized data for legitimate business purposes—including for analytics, building and improving the Services, and promoting our business—and may disclose it to third parties; however, we will not disclose such data in any manner that could identify you personally.
Session Replay Technology
We may use session replay technology to identify and resolve customer issues, monitor and analyze how you use our Services, better understand user behavior, and improve our Services. By continuing to use our Services, you consent to the use of session replay technology. If you wish to change your settings regarding session replay technology, you may access your Cookie management settings via the “Your Privacy Choices” link located at the bottom of our website.
Cookies and Targeted Advertising
We may serve advertisements and allow third-party advertising networks—including third-party ad servers, ad agencies, ad technology providers, and research firms—to serve advertisements through the Services. These advertisements may be targeted to users who fit specific demographic categories or who demonstrate specific preferences or behaviors (“Targeted Advertising”). The information (including personal data) used for Targeted Advertising may be provided by you or derived from a specific user’s usage patterns on the Services and/or on third-party services. Such information may be collected by tracking user activity across different time periods and unrelated platforms (including your activity after you leave the Services). To this end, we or our service providers may send Cookies to you through this Service, including “web beacon” files from advertising networks. Web beacons enable advertising networks to provide us and advertisers with modeled, anonymized, or aggregated auditing, research, and reporting. Web beacons also allow advertising networks to serve targeted advertisements to you when you visit other websites. Web beacons permit advertising networks to view, edit, or set their own browser Cookies, just as if you were requesting a webpage directly from their websites.
Data Security and Retention
We are committed to protecting your personal data from unauthorized access, use, and disclosure, and we implement appropriate physical, technical, organizational, and administrative security measures based on the type of personal data and the manner in which we process it. You should also help protect your data by properly selecting and safeguarding your password and/or other login mechanisms, limiting access to your computer, device, or browser by others, and logging out of your account after you have finished accessing it. Although we strive to protect the security of your account and other data stored in our records, please note that no method of transmitting or storing data over the Internet is absolutely secure.
We retain your personal data for as long as is necessary to provide services to you or to fulfill the business or commercial purposes for which we collected your personal data. When determining the retention period for specific categories of data, we consider the source of the data, our need for the personal data, and the sensitivity of the personal data. In certain circumstances, we may retain personal data for longer periods if necessary to fulfill our legal obligations, resolve disputes, or collect fees owed, or if permitted or required by applicable laws, regulations, or rules. Furthermore, we may retain information in an anonymized or aggregated form if such information does not identify you personally.
For example:
We retain your profile information and credentials for as long as you maintain an account with us.
We retain your device/IP data until we no longer require it to ensure that our systems operate properly, effectively, and efficiently.
Personal Data of Children
As stated in our Terms of Use, we do not knowingly collect or solicit personal data from children under the age of 18; if you are under 18, please do not attempt to register for or otherwise use the Services, or send us any personal data. If we discover that we have collected personal data from a child under the age of 18, we will delete that information as soon as possible. U.S. State Privacy Rights
If you reside in certain U.S. states—such as California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia—you may be entitled to certain rights granted by applicable U.S. privacy laws. Unless otherwise specified below, please refer to the “Exercising Your Rights Under U.S. State Privacy Laws” section below to learn how to exercise these rights. Please note that we may process the personal data of our customers’ end users or employees in order to provide certain services to our customers. If we process your personal data in our capacity as a service provider, you should first contact the entity that originally collected your personal data to understand your rights regarding such data. Please be aware that, under applicable U.S. state privacy laws, your rights may be subject to certain conditions or exceptions.
Access/Summary: You have the right to request confirmation of, or access to, certain personal data. If you are a resident of Oregon or Minnesota, you also have the right to request a list of certain third parties to whom we have disclosed your personal data.
Deletion: You have the right to request that we delete the personal data we have collected about you.
Correction: You have the right to request that we correct any inaccurate personal data we have collected about you.
Portability/Transfer: Subject to applicable U.S. state privacy laws, and to the extent technically feasible, you may have the right to request a copy of your personal data in a machine-readable format.
Opt-out of Profiling/Automated Decision-Making: Subject to applicable U.S. state privacy laws, you may have the right to opt out of profiling used for advertising or analytics purposes; we do not use profiling for decisions that produce legal effects or have similarly significant impacts.
“Sale,” “Sharing,” or “Targeted Advertising”
Depending on the laws of the state, province, or territory in which you reside, you may have the right to opt out of the “sale,” “sharing,” or disclosure of your personal data for targeted advertising purposes. The definitions of these or similar terms may vary depending on the applicable U.S. state, provincial, or territorial privacy laws. As described in the “Tracking Tools, Advertising, and Opt-Out” section above, certain cookies placed by third parties on our Services may allow those third parties to collect your Personal Data for targeted advertising purposes. Under the privacy laws of certain U.S. states, this may constitute a “sale” and/or “sharing” of your Personal Data; you have the right to opt out of such sales or sharing, as detailed in the “Exercising Your Rights Under U.S. State Privacy Laws” section below. For the avoidance of doubt, when we use the term “sale,” we refer to an exchange for valuable consideration, rather than for any monetary value.
We may sell or share your Personal Data with the following categories of third parties for marketing, sales, and targeted advertising purposes:
Advertising Partners
In the past 12 months, we may have sold or shared the following categories of your Personal Data with the aforementioned categories of third parties:
Contact or Profile Data
Commercial Data
Device/IP Data
Web Analytics Data
Social Network Data
Consumer Demographic Data
Inferences drawn from other collected Personal Data
To our knowledge, we do not sell or share the Personal Data of minors under the age of 18.
Sensitive Personal Data
We do not collect Personal Data that is considered “sensitive” under U.S. state privacy laws.
Non-Discrimination
We will not discriminate against you for exercising the rights granted to you under applicable privacy laws. If you exercise your rights under applicable privacy laws, we will not deny you goods or services, charge you different prices or rates, or provide you with a different quality of goods or services. However, in accordance with applicable data privacy laws, we may offer different levels of service—where the prices, rates, or quality of goods or services vary—based on the value of the Personal Data we receive from you.
Other State-Specific Privacy Rights
If you reside in Oregon or Minnesota, and we have verified your identity and residency, you may request a list of the third parties to whom we have disclosed your Personal Data. Additionally, pursuant to California Civil Code Sections 1798.83–1798.84, California residents have the right to contact us to prevent the disclosure of their Personal Data to third parties for those third parties’ direct marketing purposes. Once your identity has been verified, we will endeavor to respond to your request within the timeframe prescribed by the applicable laws of your state. If you are a resident of Nevada, you have the right to opt out of the sale of certain personal data to third parties. Please note that, as of now, we do not sell your personal data as defined by Chapter 603A of the Nevada Revised Statutes.
Exercising Your Rights Under U.S. State Privacy Laws
To exercise the rights described in this Privacy Policy, you—or your authorized agent (as applicable and defined below)—must submit a request to us that: (1) provides sufficient information to allow us to verify that you are the individual about whom we have collected personal data (for example, your contact details or profile information); and (2) describes your request in sufficient detail to allow us to understand, evaluate, and respond to it. A request that meets both of the above criteria will be considered a “Valid Request.” We may not be able to respond to requests that do not meet these criteria. We will use the personal data provided in a Valid Request solely to verify your identity and fulfill your request. You do not need to register an account to submit a Valid Request.
We will endeavor to respond to your Valid Request within the timeframes prescribed by applicable privacy laws. We will not charge you a fee for a Valid Request unless it is excessive, repetitive, or manifestly unfounded. If we determine that your Valid Request warrants a fee, we will inform you of the fee amount and explain the reasons for the charge before fulfilling your request.
Implement a Global Privacy Control (GPC)—or a similar universal privacy control recognized by a government agency or industry standard—that complies with applicable U.S. state privacy laws. The signal generated by such a control must originate from your browser and applies only to the specific device and browser you are using at the time the signal is sent. Please note that this does not include “Do Not Track” signals.
Changes to the Privacy Policy
We are constantly working to improve our services; therefore, we may need to modify this Privacy Policy from time to time. If we make any material changes, we will notify you by posting a notice on our website, sending you an email, and/or through other means. Please note that if you choose not to receive legal notice emails from us (or if you have not provided us with your email address), such legal notices will still govern your use of the Services, and you remain responsible for reading and understanding them. Your continued use of the Services following the posting of changes to the Privacy Policy constitutes your acceptance of all such changes. The use of information we collect is subject to the Privacy Policy in effect at the time such information is collected.