Privacy Policy

1 Personal information we collect

"Personal information" means information that identifies, relates to, or can reasonably be linked to you. It does not include aggregated or de-identified information that cannot reasonably be used to identify you.

Information you provide directly

We may collect personal information when you make a purchase, create an account, subscribe to our emails, enter a giveaway, or contact us, including:

• Name
• Billing and shipping address
• Email address and (if provided) phone number
• Order history and customer-service communications
• Payment-related information (processed securely through Shopify)

We do not directly store or process full payment card numbers. All payment data is handled by Shopify and its authorized processors.

Information collected automatically

When you visit our site, we may automatically collect your IP address, browser and device identifiers, approximate location, pages viewed, products viewed, and referring URLs. This helps us operate, secure, and improve our services.

Sensitive personal information

We do not seek to collect sensitive personal information, such as government ID numbers, precise geolocation, race or religion, or account log-in credentials beyond what is needed to run your account. Payment card details are entered directly with Shopify and its payment processors, not stored by us. We only use any limited sensitive information for the everyday purposes allowed under the CCPA, such as providing the products you ask for, processing payments, securing our site, and preventing fraud. Because we do not use it beyond those purposes, we are not required to offer, and do not offer, a separate "right to limit" the use of sensitive personal information.

2 Sources of personal information

We collect personal information directly from you, automatically through cookies and similar technologies, and from service providers such as Shopify, payment processors, analytics providers, shipping carriers, and marketing or advertising partners, as permitted by law.

3 How we use your personal information

We use personal information to fulfill orders, process payments, arrange shipping, manage returns, provide customer support, operate and improve our services, send order and (where permitted) marketing communications, personalize your experience, detect and prevent fraud, and comply with our legal obligations.

4 Marketing, email & SMS communications

• Marketing emails: sent only to people who opt in (for example, by joining our email list or checking the marketing box at checkout). You can unsubscribe at any time using the link in any email.
• Order & transactional messages: sent as needed to process and update you about your orders. These are not marketing and may be sent regardless of marketing preferences.
• Abandoned-cart reminders: may be sent if you provide your email during checkout.
• SMS marketing: we do not currently run an SMS marketing program. If we launch one, it will be strictly opt-in and never a condition of purchase, and you'll be able to reply STOP to opt out.

5 Shopify platform & payments

Our store is hosted by Shopify Inc. Payments are processed through Shopify's payment gateways, which may include Shop Pay, Apple Pay, Google Pay, PayPal, and major credit and debit cards, in compliance with applicable PCI-DSS standards.

Your data is stored on Shopify's secure servers using industry-standard safeguards. Payment card data is transmitted over encrypted SSL connections and handled in accordance with PCI-DSS as managed by the PCI Security Standards Council. For more on how Shopify processes data, see Shopify's Privacy Policy.

6 Disclosure of personal information

We may disclose personal information:

• To Shopify and other service providers that support our business (payments, analytics, shipping, and customer support);
• To marketing and advertising partners to deliver and measure advertising, where permitted;
• At your direction or with your consent;
• To affiliates or as part of a merger, sale, or other business transaction; and
• To comply with legal obligations or to protect our rights, property, or the safety of others.

Categories shared in the last 12 months

In the last 12 months we may have disclosed these categories of personal information for the business purposes above: identifiers (such as name, email, and address), commercial information (such as order history), internet or network activity (such as pages and products viewed), and approximate location. We disclose these to the categories of third parties listed above: our platform and service providers (Shopify, payment processors, shipping carriers, customer-support providers, and analytics providers) and our advertising partners.

We do not sell your personal information for money. However, our use of analytics and advertising tools may count as "selling" or "sharing" the identifiers and internet-activity categories under some U.S. state privacy laws. You can opt out at any time, see Section 10.

7 Advertising & analytics

We use Shopify's built-in analytics and Google Analytics (GA4) to understand how our store is used so we can improve it. As we grow, we may also use Meta (Facebook & Instagram) and TikTok advertising tools to deliver and measure ads. These tools may collect information about your activity across websites and apps.

You can opt out of interest-based advertising through platform controls and industry tools such as the Digital Advertising Alliance and Network Advertising Initiative, and you can opt out of Google Analytics using the Google Analytics opt-out add-on.

8 Cookies & tracking technologies

We use cookies and similar technologies to operate the site, remember your preferences, analyze performance, and support advertising. Some cookies are essential for the site to function; others are used for analytics and advertising and require your consent in certain regions.

You can manage non-essential cookies through our cookie-preferences banner (where shown) and your browser settings. For details on Shopify's cookies, see shopify.com/legal/cookies.

9 Data security & retention

We take reasonable measures and follow industry best practices to protect your personal information from loss, misuse, and unauthorized access. Payment information is encrypted in transit using SSL, and Shopify applies further safeguards at rest. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

We retain personal information only as long as necessary to fulfill the purposes described in this policy, including to meet legal, accounting, tax, or reporting requirements, after which it is deleted or de-identified.

How long we keep information depends on the category and why we have it. As a general guide: order, payment, and transaction records are kept for as long as needed to meet tax, accounting, and legal requirements (often several years); account details are kept while your account is active; marketing contact details are kept until you unsubscribe or ask us to remove them; and customer-support messages are kept for a reasonable period after your question is resolved. When we no longer need information, we delete or de-identify it.

10 Your privacy rights (United States)

Depending on where you live, you may have some or all of the following rights over your personal information. Residents of California (CCPA/CPRA) and other states with privacy laws may have additional rights.

• Know and access: ask what personal information we collect, use, and disclose, and request a copy of it.
• Correct: ask us to fix personal information that is wrong.
• Delete: ask us to delete personal information we hold about you.
• Portability: receive a copy of your information in a usable format.
• Opt out of "sale" or "sharing": tell us not to share your information for targeted advertising (see "Do not sell or share" below).
• Limit sensitive information: where it applies. As noted in Section 1, we do not use sensitive information beyond the purposes allowed by law.
• Non-discrimination: we will not deny you service, charge you a different price, or give you a lower quality of service for exercising any of these rights.

How to make a request

Submit your request through our privacy request form. Using the form lets us log your request and route it correctly. To protect your information, we verify your identity before acting on a request to know, correct, or delete: we ask you to submit the request from, or confirm, the email address tied to your orders or account, and we may ask for additional details that match our records (such as a recent order number). We only use information collected for verification to confirm your identity, not for any other purpose. We aim to respond within the timeframes required by law.

Authorized agents

You may use an authorized agent to make a request on your behalf. We may ask the agent for written, signed permission from you, and we may still ask you to verify your own identity directly with us before we act.

Opt-out preference signals

Some browsers and extensions can send a Global Privacy Control (GPC) signal. Where required by law, we treat a GPC signal from your browser as a request to opt out of the "sale" or "sharing" of the personal information tied to that browser, without you needing to fill out anything else.

11 International customers, EU & UK (GDPR)

We are based in the United States and our service providers (including Shopify) may store and process your personal information in the United States and other countries. When you place an order or use our services from outside the U.S., you understand that your information will be transferred to and processed in the U.S., which may have different data-protection laws than your country. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

EU & UK residents

If you are in the European Economic Area or the United Kingdom, the GDPR / UK GDPR gives you the right to access, correct, erase, restrict, or object to our processing of your personal information, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your local data-protection authority.

We process personal data on these lawful bases: to perform our contract with you (to fulfill orders), our legitimate interests (to operate, secure, and improve our store and prevent fraud), your consent (for marketing and non-essential cookies), and to comply with legal obligations.

To exercise any of these rights, please use our privacy request form.

12 Children's data

Our services are intended for individuals who are at least 16 years old and are not directed to children under 16. We do not knowingly collect personal information from children under 16, and we do not knowingly "sell" or "share" the personal information of anyone under 16. If you believe a child has provided us with personal information, please contact us through the form below so we can delete it.

13 Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. Changes take effect when posted on this page, and the "Last Updated" date above will be revised. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

14 Contact us

The best way to reach us about your privacy, including any request to access, correct, delete, or opt out, is through our privacy request form, which ensures your request is logged and routed to the right place.

Fabled Figs LLC