Privacy Policy

Last updated: August 8, 2026

This policy explains what we collect when you visit or buy from this store, why we collect it, who we share it with, and what you can ask us to do about it. It's written to be read, not to be skimmed past.

Questions or requests: cloisteragency@gmail.com.

What we collect

When you place an order: your name, email address, shipping and billing address, phone number if you give one, the items you bought, and your order history. Your card number is entered directly with our payment processor — we never see or store full card details. We only see the last four digits and the card type.

When you contact us: your email address and whatever you write to us, including any photos you attach.

When you browse: your IP address, browser and device type, operating system, the pages you view, how long you stay, what you click, and which site or ad sent you here.

If you subscribe: your email address, and the fact that you opened or clicked our emails.

We do not knowingly collect information from children under 13. If you believe a child has given us information, email us and we'll delete it.

Why we use it

To take payment, ship your order, and email you confirmations and tracking.
To answer your emails and handle returns, refunds and warranty claims.
To detect and prevent fraudulent orders and chargebacks.
To understand which pages and products work, and improve the store.
To show you our ads on other platforms and measure whether they worked.
To send marketing emails, if you asked for them — every one has an unsubscribe link, and unsubscribing takes effect immediately.
To meet our legal, tax and accounting obligations.

We do not sell your personal information for money.

Cookies, pixels and advertising

We use cookies and similar technologies. Some are strictly necessary — they keep your cart working and let you check out. Others are analytics and advertising cookies.

Specifically, this store uses:

Shopify — the platform running this store; sets cookies needed for the cart, checkout and security, plus its own store analytics.
Meta (Facebook/Instagram) pixel — tells us which ads led to visits and purchases, and lets us show ads to people who visited the site or looked at a product. Meta receives event data such as page views, add-to-cart and purchase events, along with identifiers like your IP address and cookie ID.
Google (Google Analytics and Google Ads tags) — measures site traffic and ad performance, and supports remarketing.

You can refuse or delete cookies in your browser settings, though strictly necessary ones are required for checkout to function. You can also limit ad targeting directly with the platforms: Meta ad preferences, Google ad settings, and the DAA opt-out page.

Under some privacy laws, this kind of ad tracking counts as "sharing" or "selling" personal information for cross-context behavioral advertising. See the California section below for how to opt out.

Who we share it with

We share only what each partner needs to do its job:

Shopify — hosts the store and processes orders on our behalf.
Payment processors (such as Shopify Payments, PayPal and card networks) — take payment and screen for fraud.
Our fulfillment partner and carriers (including USPS) — receive your name and shipping address to make and deliver your order.
Email and support tools — send your confirmations and let us reply to you.
Meta and Google — as described in the cookies section above.

We may also disclose information where the law requires it, to respond to a valid legal request, to protect our rights, or as part of a merger or sale of the business.

Some of these providers operate outside the United States, so your information may be processed abroad under contractual safeguards.

How long we keep it

Order records are kept for as long as our tax and accounting obligations require — generally up to 7 years. Support emails are kept for up to 3 years. Marketing contacts are kept until you unsubscribe, plus a short suppression record so we don't email you again by mistake. Analytics and advertising data is kept for the retention period set by each platform, typically up to 26 months.

Security

The site runs over HTTPS and payments go through PCI-compliant processors. We limit who on our side can see order data. No system is perfectly secure, but if a breach ever affects your information, we'll tell you and the relevant authorities as the law requires.

Your rights

Wherever you live, you can email cloisteragency@gmail.com to ask what we hold about you, to correct it, or to have it deleted. We respond within 30 days and we don't charge for it.

California residents (CCPA / CPRA)

If you live in California, you have the right to:

Know what personal information we collect, the categories of sources, why we collect it, and the categories of third parties we disclose it to.
Access a copy of the specific pieces of personal information we hold about you.
Delete your personal information, subject to legal exceptions such as completing your order or keeping tax records.
Correct inaccurate personal information.
Opt out of the sale or sharing of your personal information for cross-context behavioral advertising — that's the ad-pixel activity described above.
Limit the use of sensitive personal information. We don't collect sensitive personal information as the CPRA defines it.
Not be discriminated against for exercising any of these rights. We will never give you worse prices or service because you made a request.

In the past 12 months we have collected the categories of information listed above, and shared identifiers and internet activity with advertising partners for cross-context behavioral advertising.

To opt out of sharing for advertising: use our Your Privacy Choices page, or email us with "Do Not Sell or Share My Personal Information" in the subject line. We also honor Global Privacy Control (GPC) signals sent by your browser.

You can use an authorized agent to make a request on your behalf; we'll ask for proof of their authority and verify your identity before acting.

Other US states

Residents of states with comparable privacy laws — including Virginia, Colorado, Connecticut, Utah and Texas — have similar rights to access, correct, delete and opt out of targeted advertising. Use the same contact address and we'll handle your request the same way.

Changes to this policy

We'll update this page when our practices change and revise the date at the top. If a change is significant, we'll say so clearly on the site.

Contact

BoopNose — privacy requests and questions: cloisteragency@gmail.com. We reply within 24 hours on business days and complete requests within 30 days.