Privacy Policy

Draft v1 — 2026-07-28 — [BRAND] token, counsel review pending

Effective date: [EFFECTIVE_DATE]

This Privacy Policy describes how [BRAND] LLC, a Florida limited liability company ("[BRAND]," "we," "us," or "our"), collects, uses, and shares information when you visit or make a purchase from our website (the "Site"). By using the Site, you agree to the practices described here.

Our products are smoking accessories intended for adults 21 and over, for legal use only. We do not knowingly collect information from anyone under 21.

Information We Collect

Information you provide. When you place an order or create an account, we collect your name, email address, shipping and billing address, phone number, and payment details. Payment card data is processed by our payment processor and is never stored on our servers.

Information collected automatically. When you browse the Site, we automatically collect device information: browser type, IP address, time zone, pages viewed, referring pages, and how you interact with the Site. We collect this using cookies and similar technologies.

Marketing information. If you sign up for our email list, we collect your email address and, where you choose to provide it, your phone number.

How We Use Your Information

We use your information to:

• Process, fulfill, and ship your orders, and send order confirmations and shipping updates.
• Verify eligibility, screen orders for fraud, and enforce our 21+ policy.
• Respond to support requests.
• Send marketing emails, if you opted in. You can unsubscribe at any time using the link in any email.
• Understand how visitors use the Site so we can improve it.
• Comply with legal obligations.

We do not use your information to make automated decisions with legal or similarly significant effects.

Service Providers

We share information only with service providers who help us run the store:

• Shopify — hosts our store and processes orders. See Shopify's privacy policy at shopify.com/legal/privacy.
• Klaviyo — sends our marketing and transactional emails to subscribers.
• Google Analytics 4 (GA4) — helps us understand Site traffic and usage. GA4 is configured for analytics only; IP addresses are not logged or stored by Google Analytics 4 by default.
• Shipping carriers (USPS, UPS) — receive your name and address to deliver your order.
• Payment processors — process your payment securely.

We do not run advertising pixels (no Meta pixel, no TikTok pixel, no ad-network trackers) on the Site.

We may also disclose information to comply with applicable laws, respond to lawful requests, or protect our rights.

Cookies

We use cookies that are necessary for the Site to function (cart, checkout, session) and analytics cookies (GA4). You can control cookies through your browser settings. Blocking necessary cookies may prevent checkout from working.

Do Not Sell or Share My Personal Information

We do not sell your personal information for money. We also do not share your personal information with third parties for cross-context behavioral advertising.

Although [BRAND] LLC is below the thresholds that trigger the California Consumer Privacy Act (CCPA/CPRA), we voluntarily honor its core principles:

• Global Privacy Control (GPC): If your browser sends a GPC signal, we honor it as a valid opt-out of any sale or sharing of personal information.
• Right to know: You may request a copy of the personal information we hold about you.
• Right to delete: You may request deletion of your personal information, subject to legal retention requirements (for example, order records we must keep for tax purposes).
• Right to correct: You may ask us to correct inaccurate personal information.
• No discrimination: We will never penalize you for exercising these rights.

To exercise any of these rights, email support@[BRAND-DOMAIN] with the subject line "Privacy Request." We will respond within 1 business day to confirm receipt and complete verified requests within 45 days.

Data Retention

We keep order records as long as needed for tax, accounting, and legal purposes. Marketing data is kept until you unsubscribe or request deletion. Analytics data is retained per GA4's standard retention settings.

Security

We use industry-standard safeguards, including TLS encryption on all Site traffic and PCI-compliant payment processing. No method of transmission is 100% secure, but we work to protect your information.

Age Restriction

The Site is intended solely for adults 21 years of age or older. We do not knowingly collect personal information from anyone under 21. If we learn we have collected such information, we will delete it.

Changes to This Policy

We may update this policy from time to time. The effective date above reflects the latest revision. Material changes will be posted on this page.

Contact Us

[BRAND] LLC Email: support@[BRAND-DOMAIN] Phone: [SUPPORT_PHONE]

We respond within 1 business day.