Privacy Policy
Template. This page is a starting point, not legal advice. Fill in the bracketed details in the store config and have a lawyer review it for your business and every country you sell to before you launch.
This Privacy Policy explains how [Company Name LLC] (“Morrow,” “we,” “us”) collects, uses and shares personal information when you visit this website or buy from us, and the rights and choices you have.
Information we collect
Information you give us
- Contact details: your name, email address and, if you provide it, phone number.
- Order details: shipping and billing address, the products you buy, and messages you send us.
- Payment information is entered on Stripe’s secure checkout page and handled by Stripe. We never see or store your full card number.
Information collected automatically
- Device and usage data: IP address, browser and device type, pages viewed, and the site that referred you.
- Approximate location derived from your IP address.
- Cookies and similar technologies, including advertising pixels from Meta (Facebook and Instagram) and TikTok, which record visits and purchases so we can measure and improve our ads.
How we use information
- To process, ship and support your orders, including returns and refunds.
- To answer your questions and send messages about your order.
- To prevent fraud and keep the site secure.
- To measure and improve our advertising and website.
- To comply with law, enforce our terms and protect our rights.
We only send marketing emails if you sign up for them, and every one has an unsubscribe link.
How we share information
- Service providers that work on our behalf: Stripe (payments), Cloudflare (website hosting and security), our email provider, and shipping carriers. They may use the information only to provide their services to us.
- Advertising partners: Meta and TikTok receive information about your visit and purchase through their pixels and our server, so we can measure ads and show them to relevant people. You can opt out at any time (see below).
- Legal and safety: when required by law or to protect rights, property or safety.
- Business transfers: as part of a merger, acquisition or sale of assets.
Cookies, pixels and your choices
If you visit from the European Economic Area, the United Kingdom, and Switzerland, advertising pixels only load after you accept them in the cookie banner. You can change your choice at any time with “Cookie settings” at the bottom of every page.
Everywhere else, you can turn off advertising pixels with the “Do Not Sell or Share My Personal Information” link at the bottom of every page. Your choice is saved in that browser. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out automatically, wherever you are.
We use one cookie of our own that you don’t need to agree to: when you pick the country you’re shipping to, we remember it so prices and delivery match it on every page. We work out your likely country from your IP address for the same purpose, without storing it.
You can also block or delete cookies in your browser settings, and limit ad personalization in your Meta and TikTok account settings. Some browsers offer “Do Not Track”; because there is no common standard for it, we respond to GPC instead.
Data retention
We keep order records for as long as needed to fulfill orders and meet tax, accounting and legal obligations, usually seven years. Other information is kept only as long as it is useful for the purposes above.
Security
We use reasonable safeguards, including encrypted connections and trusted providers, to protect personal information. No method of transmission or storage is completely secure.
Children
This site is not directed to children under 13, and we do not knowingly collect their personal information. We do not sell or share the personal information of consumers we know are under 16.
If you’re in the EEA, the UK or Switzerland
Data protection law where you are (the GDPR, the UK GDPR or Switzerland’s Federal Act on Data Protection) applies to how we use your information.
Why we use it
- To take, ship and support your order, because we need to for our contract with you.
- To keep tax and accounting records, because the law requires it.
- To keep the site secure and prevent fraud, in our legitimate interest.
- For advertising pixels, only with your consent, which you can withdraw at any time with “Cookie settings”.
Your rights
You can ask to see the information we hold about you, correct it, delete it, limit or object to how we use it, or get a copy to take elsewhere. You can also complain to the data protection authority where you live.
International transfers
We are based in United States, so your information is handled there and by the providers named above, in the United States and other countries. Where the law requires it, these transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
To use your rights, email hello@example.com with “Privacy request” in the subject. We answer within one month.
Your California privacy rights
If you live in California, the California Consumer Privacy Act as amended by the CPRA (“CCPA”) gives you these rights:
- Right to know what personal information we collected about you, where it came from, why, and who we disclosed it to.
- Right to delete personal information we collected from you, subject to exceptions (for example, records we must keep).
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing. We do not sell personal information for money. Our use of advertising pixels may count as “sharing” for cross-context behavioral advertising. Opt out with the link at the bottom of any page or with a GPC signal.
- Right to limit the use of sensitive personal information. We do not use sensitive personal information for that purpose.
- Right to non-discrimination for exercising any of these rights.
What we collected in the last 12 months
| Category | Examples | Disclosed to |
|---|---|---|
| Identifiers | Name, email, postal address, IP address, cookie IDs | Service providers, advertising partners |
| Customer records | Phone number, billing address | Service providers |
| Commercial information | Products purchased, order history | Service providers, advertising partners |
| Internet activity | Pages viewed, interactions with our site and ads | Service providers, advertising partners |
| Geolocation | Approximate location from IP address | Service providers, advertising partners |
We collect this information from you, from your device, and from our service and advertising partners, for the purposes described above.
How to make a request
Email hello@example.com with “Privacy request” in the subject. We will confirm your request within 10 business days and respond within 45 days. To protect you, we verify requests by matching the details you give with our records (for example, your email and an order number). You may use an authorized agent; we may ask for proof that they act for you.
Other US states
Residents of other states with consumer privacy laws (such as Colorado, Connecticut, Oregon, Texas, Utah and Virginia) may have similar rights to access, correct, delete and opt out of targeted advertising. Use the same email to make a request. If we deny it, you can appeal by replying to our decision, and we will respond within the time your state’s law requires.
Changes
We may update this policy. The date at the top shows when it last changed; significant changes will be highlighted on this page.
Contact
[Company Name LLC]
[Street address]
[City, State ZIP]
United States
hello@example.com