Privacy Policy
Effective July 22, 2026 · CCPA/CPRA · Virginia CDPA · Colorado CPA · Connecticut CTDPA · Utah UCPA · GDPR where applicable
Template notice. Privacy obligations change by state and by how you configure your analytics and ad stack. Have counsel review this against your actual data flows before launch, and keep a data-processing inventory.
1. What we collect
| Category | Examples | Why |
|---|---|---|
| Identifiers | Name, email, shipping address, phone | Fulfil and support your order |
| Commercial | Order history, cart contents, returns | Service, warranty, fraud prevention |
| Payment | Last 4 digits, card brand, billing ZIP | Processing and chargeback defense. We never store full card numbers. |
| Technical | IP address, device, browser, referrer | Security, performance, fraud scoring |
| Usage | Pages viewed, clicks, session recordings (aggregated) | Improving the store |
We do not knowingly collect data from anyone under 13, and we do not sell the personal information of anyone under 16.
2. Who we share it with
Service providers only, under contract, and only for the purpose we hired them for: payment processors (Stripe, PayPal, Klarna, Afterpay, Affirm), fulfillment and supplier partners, shipping carriers, email and SMS platforms, analytics and advertising platforms, and fraud-prevention vendors. We disclose to law enforcement only under valid legal process.
3. Sale and sharing of personal information
Under the CCPA/CPRA, use of advertising cookies for cross-context behavioral advertising may constitute “sharing.” You can opt out at any time via the Do Not Sell or Share My Personal Information link in the footer, or by sending a Global Privacy Control signal, which we honor.
4. Your rights
- Know what we have collected about you and why
- Delete your personal information, subject to legal retention obligations
- Correct inaccurate information
- Opt out of sale, sharing, and targeted advertising
- Limit use of sensitive personal information
- Non-discrimination for exercising any of these rights
- Portability — receive your data in a machine-readable format
Submit a request at privacy@amerishoppro.us. We verify identity before acting and respond within 45 days, extendable once by another 45 days where permitted. Authorized agents may submit on your behalf with written permission.
5. Retention
Order and tax records: 7 years, as required by the IRS. Marketing contacts: until you unsubscribe plus 30 days. Support tickets: 3 years. Analytics: 26 months. Session logs: 90 days.
6. Security
TLS 1.3 in transit, encryption at rest, least-privilege access, MFA on all administrative accounts, and quarterly access review. No system is perfectly secure; we notify affected users and regulators as required if a breach occurs.
7. International visitors
Our servers are in the United States. If you visit from the EEA, UK or Switzerland, your data is transferred to the U.S. under Standard Contractual Clauses where applicable, and GDPR rights including objection and lodging a complaint with your supervisory authority apply.
8. Changes and contact
Material changes are posted here with a new effective date. Contact privacy@amerishoppro.us.