DRAFT — NOT LEGAL ADVICE. This document is a draft template prepared for review. It has not been reviewed by an attorney. Have qualified legal counsel review it before publishing. Items in [SQUARE BRACKETS] must be completed or confirmed.

Soothe & Shine — Privacy Policy

Effective date: October 27, 2026
Last updated: October 27, 2026 (checkout email/phone, marketing opt-in, footer list, cookie banner)

1. Who We Are

This Privacy Policy explains how [LEGAL ENTITY NAME], a [STATE OF FORMATION] limited liability company doing business as Soothe & Shine ("Soothe & Shine," "we," "us," or "our"), collects, uses, and shares personal information when you visit https://sootheandshines.com (the "Site") or buy from us.

Questions? Email support@sootheandshines.com or write to [BUSINESS MAILING ADDRESS].

2. Information We Collect

Information you give us

• Order and contact details: name, email address, phone number, billing address, and shipping address. We ask for email and phone at checkout (and may ask on waitlists, contact forms, or account signup) so we can fulfill your order, send shipping updates, reach you about your purchase, and — only if you opt in — send marketing or brand updates.
• Gift details: recipient name and address, and any gift message you include.
• Customer support: messages you send us, such as return requests and photos of damaged items.
• Marketing and list preferences: whether you have opted in to emails, SMS/text (if offered), or other updates, and any unsubscribe or opt-out choices you make.

Payment information
Payments are processed by Stripe, Inc. At checkout, Stripe collects your email and phone number (when enabled) along with shipping details. Your card details go directly to Stripe. We do not receive or store your full card number or security code. We may receive limited information from Stripe, such as the card type, last four digits, expiration date, billing ZIP code, and transaction and fraud-screening results.

Information collected automatically
When you visit the Site, we and our service providers may automatically collect device and usage information, such as IP address, browser type, device type, pages viewed, referring website, and approximate location derived from IP address. See Section 4 (Cookies and Analytics).

3. How We Use Your Information

We use personal information to:

• Process and fulfill orders, including payment, packing, shipping, and sending order and shipping confirmations;
• Contact you about your order by email and/or phone (for example delivery issues, questions about your address, or support follow-ups);
• Provide customer support, including returns, refunds, replacements, and carrier claims;
• Prevent fraud and protect our business, including verifying transactions and responding to chargebacks;
• Operate and improve the Site, including fixing problems and understanding how visitors use it;
• Build and maintain our customer contact list (email and, where you provide it and consent, phone) so we can communicate with people who have bought from us or signed up;
• Send marketing and promotional messages, only if you opt in. This may include emails (and, if we offer them later, SMS/text messages) about products, offers, or related brands we operate. You can unsubscribe from marketing emails at any time using the link in any marketing email or by contacting us. For SMS, follow the stop instructions in the message or contact us. We will still send transactional messages about your orders (receipts, shipping, support) even if you opt out of marketing; and
• Comply with legal obligations, such as tax and accounting record-keeping, and to enforce our Terms of Service.

We do not require marketing consent to complete a purchase. Checkout always collects the contact details needed to fulfill your order; marketing is separate and optional.

4. Cookies, Consent, and Analytics

Cookie / preference banner. When you visit the Site, we may show a consent banner or preference controls so you can accept, reject, or manage non-essential cookies and similar technologies. Necessary cookies (needed for security, load balancing, remembering basic preferences, and checkout/fraud prevention such as Stripe) may run without optional consent because the Site cannot work without them. Optional cookies (for example analytics or advertising) run only after you consent, where required.

What we may use cookies for

• Keeping the Site and checkout working securely;
• Remembering cookie choices and similar preferences;
• Understanding how visitors use the Site (none currently (we may add privacy-friendly analytics later; optional cookies stay off until you accept));
• [IF ENABLED LATER] measuring ads or retargeting via pixels (e.g., Meta, Google, TikTok) — if we add these, we will update this Policy and offer any opt-out required by law.

You can change your cookie choices later through the Site’s cookie settings link (when available) or through your browser settings. Blocking some cookies may affect how the Site or checkout works.

Do Not Track / Global Privacy Control. [CONFIRM: We honor Global Privacy Control (GPC) browser signals as a request to opt out of any sale or sharing of personal information, where required by law.]

5. How We Share Information

We share personal information only as needed to run our business:

• Payment processing: Stripe, to process payments and prevent fraud.
• Shipping carriers and label services: the U.S. Postal Service (USPS), UPS, and shipping-label platforms (such as Pirate Ship or USPS Click-N-Ship), to deliver your order and provide tracking.
• Service providers: companies that help us operate, such as website hosting ([WEBSITE HOSTING PROVIDER]), email and customer support ([EMAIL / SUPPORT PROVIDER]), and email marketing ([EMAIL MARKETING PROVIDER]). They may use your information only to provide services to us.
• Legal and safety: when required by law, subpoena, or legal process, or when needed to protect our rights, customers, or others, or to prevent fraud.
• Business transfers: if our business is merged, sold, or reorganized, personal information may be transferred as part of that transaction, subject to this Policy.
• With your consent: in other cases where you ask or agree.

6. We Do Not Sell Your Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising, as those terms are defined under the California Consumer Privacy Act (CCPA) and similar state laws. If this changes, we will update this Policy and provide any opt-out required by law.

7. How Long We Keep Information

We keep personal information only as long as reasonably needed for the purposes in this Policy, including:

• Order and transaction records: for [RETENTION PERIOD — e.g., 7 years] to meet tax, accounting, and legal requirements;
• Support communications: as long as needed to resolve your request and for a reasonable period afterward;
• Marketing lists: until you unsubscribe or ask us to delete your information.

When information is no longer needed, we delete it or de-identify it.

8. How We Protect Information

We use reasonable administrative, technical, and physical safeguards to protect personal information, such as relying on Stripe's PCI-compliant payment processing, using HTTPS encryption on the Site, and limiting access to customer information to those who need it to fulfill orders. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your Choices and Rights

All customers. You may contact us at support@sootheandshines.com to:

• ask what personal information we have about you (access);
• correct inaccurate information;
• ask us to delete your information (subject to records we must keep by law, such as tax records);
• unsubscribe from marketing emails at any time; and
• opt out of marketing SMS/text (if we send them), or ask us to stop using your phone number for marketing.

California and other state residents. Depending on where you live (for example, California, Colorado, Connecticut, Virginia, Texas, Oregon, and other states with consumer privacy laws), you may have additional rights, which may include the right to:

• know what categories and specific pieces of personal information we collect, use, and disclose;
• delete or correct personal information;
• obtain a portable copy of your information;
• opt out of the sale or sharing of personal information or its use for targeted advertising (we do not sell or share it for these purposes); and
• not be discriminated against for exercising your privacy rights.

Some of these laws apply only to businesses that meet certain size or revenue thresholds; we will honor reasonable requests regardless. [COUNSEL TO CONFIRM which state laws apply.]

How to make a request. Email support@sootheandshines.com with the subject line "Privacy Request." [OPTIONAL: Phone [PRIVACY CONTACT PHONE — OPTIONAL].] To protect your information, we will verify your request, typically by matching the email address and order details we have on file. You may use an authorized agent where permitted by law; we may ask for proof of authorization. We will respond within the time required by applicable law (generally within 45 days). If we deny your request, you may appeal by replying to our decision with the subject line "Privacy Appeal."

California "Shine the Light." California residents may request information about disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing.

10. Children's Privacy

The Site is not directed to children under 13, and purchases are limited to adults 18 and older. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it. (If you send a gift to a minor, we use the recipient's name and address only to deliver the order.)

11. Customers Outside the United States

We sell and ship only within the United States, and the Site is intended for US visitors. If you access the Site from outside the US, your information will be processed and stored in the United States, where data protection laws may differ from those in your country.

12. Third-Party Links and Services

The Site may link to or use third-party services, such as Stripe and carrier tracking pages. Their privacy practices are governed by their own policies, and we are not responsible for them. We encourage you to review them (for example, Stripe's privacy policy at https://stripe.com/privacy).

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated Policy on the Site and change the "Last updated" date above. If we make material changes, we will provide additional notice where required by law (for example, by email or a notice on the Site).

14. Contact Us

Soothe & Shine ([LEGAL ENTITY NAME])
Email: support@sootheandshines.com
Mail: [BUSINESS MAILING ADDRESS]
Website: https://sootheandshines.com