Privacy Policy Supplement

Last updated: October 21, 2026.

Quick summary

This supplement adds store-specific information to the native Shopify Privacy Policy. Shopify hosts the storefront and provides checkout and privacy features. When you order or contact us, information may be used to process payment, fulfill and deliver the order, provide support, handle returns, secure the service, and meet legal obligations. The privacy options available depend on your location and the services in use.

This supplement does not replace or claim to synchronize with the native policy. Read the full native Privacy Policy and use Your Privacy Choices for the opt-out controls available to you.

Information categories and sources

Depending on how you use the store, information may include contact details such as your name, email, telephone, billing and delivery address; order and transaction information such as items viewed, cart contents, selected options, purchases, returns, and cancellations; payment-related transaction details handled through checkout and payment services; messages you send to customer support; account information if you create or use an account; and device, network, and usage information such as IP address, browser or device details, and interactions with the site.

Information may come directly from you when you browse, place an order, create an account, or contact support; automatically from your browser or device through the site, cookies, and similar technologies; and from Shopify, service providers, or other partners involved in providing store, checkout, payment, delivery, support, or advertising services.

How information is used

Information is used as needed to operate the store; provide product pages and checkout; process payments and orders; arrange shipment and tracking; communicate about orders; answer support requests; handle returns, refunds, or cancellations; maintain accounts and preferences; protect the store and customers from fraud or security issues; improve store functions; and comply with legal obligations or valid requests. Marketing or advertising uses depend on the services enabled, your privacy choices, and applicable law.

Shopify and other service providers

Shopify powers this storefront and provides platform, checkout, and privacy features. A payment provider is identified by the options shown during checkout and by the payment record for your transaction. Delivery and tracking information for an order identifies the shipping service used for that order. Other technical, analytics, advertising, customer-support, fulfillment, or cloud services may process information when they are enabled or needed to provide the service. The relevant provider's own privacy information also applies to its processing.

Information may be disclosed to Shopify and service providers acting for the store; to a payment or delivery service needed to complete an order; to marketing or advertising partners when such services are enabled and permitted; when you direct or consent to a disclosure; or when disclosure is needed for a business transaction, legal obligation, or protection of the store, customers, or others. The native Privacy Policy describes these categories in more detail.

The native Your Privacy Choices page currently loads hCaptcha as part of verification for an opt-out submission. The specific analytics, advertising, payment, delivery, support, fulfillment, and cloud providers used can depend on the services presented for your visit or transaction; this page does not presume that any other named provider or tracking technology is active.

Cookies and similar technologies

Depending on your location, choices, and the services in use, cookies or similar technologies may fall into four general categories: necessary or operational technologies used for site functions such as cart, checkout, security, and preferences needed to provide the service; preference technologies that remember choices; analytics technologies that help measure site use; and advertising technologies that may measure or personalize advertising across services. These categories describe possible functions and do not mean every category or specific cookie is active on every visit. The technologies used can depend on the store configuration, integrations, consent, and location.

Use the privacy controls shown on the store and Your Privacy Choices to review the options available for your location. Where applicable, Shopify's privacy policy describes how a Global Privacy Control (GPC) signal is treated as an opt-out request for the browser or device, and for an associated account when Shopify can make that association. Other browser signals may not be recognized. You may also control cookies through your browser settings.

Embedded Google Maps on Home and Contact

If you open an embedded Google map on the Home or Contact page, your browser connects directly to Google to retrieve it. That request may disclose your IP address, browser or device information, and the map query to Google. You can use the address text without opening the map.

Retention and security

How long personal information is kept depends on factors such as whether it is needed to maintain an account, provide services, complete or document an order, comply with legal obligations, resolve disputes, or enforce agreements and policies. The native policy does not state a single fixed retention period for every category. No security measure is perfect, and information sent over the internet may not be secure in transit. Do not send full payment-card numbers, security codes, passwords, or verification codes by email.

Children and international processing

The native Privacy Policy says the Services are not intended for children and describes how a parent or guardian may contact the store about a child's information. It also explains that Shopify and service providers may process or store information in countries other than the country where you live. Any transfer safeguards described in the native policy apply where relevant.

U.S. privacy rights and requests

Depending on where you live and whether the applicable law covers the business and request, you may have rights to know or access, correct, delete, or obtain a portable copy of personal information, and to opt out of certain sale, sharing, targeted-advertising, or profiling activities. Exceptions and verification requirements may apply. Use Your Privacy Choices for the available browser and account opt-out controls. For another request, email support@zensoe.com with the right you want to exercise and enough information to help locate the relevant account or order. Do not send sensitive credentials or full payment details.

We may ask for information reasonably needed to verify your identity and request. If an applicable law permits an authorized agent to submit a request, we may ask the agent for proof of authority and may ask the consumer to verify their identity directly. We will not ask for a password, security code, or full card number to verify a privacy request.

Response periods, extensions, and appeals

The response period depends on the law that applies to the request. For example, if the Kentucky Consumer Data Protection Act applies, a request is generally answered within 45 days; one extension of up to 45 additional days may be used when reasonably necessary, with notice and the reason within the initial 45-day period. A denial must include the reason and appeal instructions within the applicable response period. An appeal may be submitted within a reasonable period after the decision, and Kentucky law requires a written appeal response within 60 days; if the appeal is denied, the decision must provide an Attorney General complaint method. See KRS 367.3615.

Other state laws may set different timelines. For example, Virginia law generally provides 45 days to respond, permits one 45-day extension with timely notice, and requires an appeal response within 60 days. Colorado law generally provides 45 days to respond and permits a 45-day extension; it provides a 45-day appeal response period and may allow an additional 60 days with notice where reasonably necessary. The law that applies to your request controls. If we decline a request, our decision will explain the reason and, where the law provides an appeal, how to send it. You may reply to the decision email or contact support@zensoe.com with “Privacy Request Appeal” in the subject. Where an applicable law requires a regulator complaint method after an appeal denial, we will include it in the decision.

See the official Virginia Consumer Data Protection Act and Colorado privacy statute for those state-specific procedures. This page describes common statutory timelines; it does not say that any particular state law applies to every customer or that rights are available where statutory coverage requirements are not met.