Privacy Notice for California Residents

This California Privacy Notice supplements our Privacy Policy and applies solely to residents of the State of California (“consumers” or “you”). It is provided in accordance with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Any terms defined in the CCPA/CPRA have the same meaning when used in this Notice.

1. Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories:

Category	Description	Collected
Identifiers	Name, email, address, IP address, account identifiers	Yes
Customer Records	Billing/shipping info, order data (no full payment storage)	Yes
Protected Characteristics	Age, race, religion, health data	No
Commercial Information	Purchase history, returns, preferences	Yes
Internet Activity	Browsing behavior, cookies, analytics data	Yes
Geolocation Data	Approximate location (via IP)	Yes
Sensory Data	Audio/visual recordings	No
Professional Data	Employment info	No
Education Data	Student records	No
Inferences	Preferences and behavior insights	Yes

We do not collect highly sensitive identifiers such as Social Security numbers, biometric data, or passport information.

2. Sources of Personal Information

We collect personal information from:

You directly (orders, account creation, communications)
Automated technologies (cookies, analytics tools)
Service providers acting on our behalf

3. Business & Commercial Purposes

We use personal information to:

Process orders, payments, shipping, and returns
Provide customer service
Operate, improve, and optimize our website
Detect fraud and maintain security
Send marketing communications (where permitted)
Comply with legal obligations and business operations

4. Disclosure of Personal Information

We may disclose personal information to:

Payment processors and fulfillment partners
Technology providers (e.g., Shopify, analytics, email/SMS platforms)
Advertising and measurement partners (e.g., Meta, Google, TikTok) — see Section 5
Legal or regulatory authorities when required

In the past 12 months, we have disclosed:

Identifiers
Customer records
Commercial information
Internet activity
Geolocation data (approximate, derived from IP address)
Inferences

5. Sale or Sharing of Personal Information

We do not sell personal information for monetary consideration
We do share personal information for cross-context behavioral advertising as defined under CPRA. Our website uses advertising and measurement technologies that disclose online identifiers — cookie identifiers, device identifiers, and IP address — together with the pages you view and the purchases you make, to advertising partners including Meta, Google, and TikTok, so that advertising can be targeted and measured across other websites and apps

The categories of personal information shared in the preceding 12 months are Identifiers, Internet Activity, Commercial Information, Geolocation Data (approximate), and Inferences. We do not knowingly sell or share the personal information of consumers under 16 years of age.

5A. Do Not Sell or Share My Personal Information

You have the right to direct us to stop selling or sharing your personal information. Exercising it is free, does not require an account, and has no effect on the price you pay or the service you receive.

To opt out, use any of these:

The Do Not Sell or Share My Personal Information link in the footer of every page on this site, which opens our Your Privacy Choices page, and submit the opt-out form there
Browsing with the Global Privacy Control (GPC) preference signal enabled. Where you are in a jurisdiction that recognises it, we treat a GPC signal as a request to opt out of the sale or sharing of personal information for the browser and device you are using
Emailing info@miracletree.org with the subject line “Do Not Sell or Share My Personal Information,” including the email address associated with your orders so that we can locate your record
Rejecting, blocking, or clearing advertising and non-essential cookies in your browser or device settings, which prevents the identifiers used for this sharing from being set on that browser or device

We will action an opt-out request as soon as feasibly possible and in any event within 15 business days, and we will notify the advertising partners to whom we disclosed your personal information during the 90 days before your request. That 90-day figure is a look-back window — the period we reach back over to contact partners — not a deadline for responding to you. An authorized agent may submit a request on your behalf; we may ask for proof of the agent’s authority and may verify your identity. We will not discriminate against you for exercising this right.

An opt-out applies to the browser or device from which it is made and to the record we hold for you. If you clear your cookies, change browsers, or use a different device, you may need to opt out again.

6. Sensitive Personal Information

We do not seek to collect sensitive personal information as defined by the CPRA, and we do not use or disclose it for any of the purposes that would give rise to the right to limit — that is, we do not use it to infer characteristics about you, for cross-context behavioral advertising, or for profiling.

Some information we necessarily handle in order to run the store — for example payment card details processed by our payment provider, or account log-in credentials — can fall within the statutory definition. Where it does, it is used strictly for:

Providing requested services
Processing transactions
Security and fraud prevention
Legal compliance

These are purposes the CPRA expressly permits without triggering the right to limit. Because we do not use sensitive personal information beyond them, the “Limit the Use of My Sensitive Personal Information” right is not engaged here — but if you submit such a request anyway, we will honour it rather than turn it away.

7. Your California Privacy Rights

California residents have the right to:

Know what personal information is collected and how it is used
Access specific pieces of personal information
Correct inaccurate information
Delete personal information (subject to exceptions)
Limit the use of sensitive personal information (where applicable)
Opt out of the sale or sharing of personal information for cross-context behavioral advertising — see Section 5A
Non-discrimination for exercising rights

8. Exercising Your Rights

To submit a request:
📧 info@miracletree.org

We will verify your identity before processing
You may designate an authorized agent
We respond within 45 days (extendable to 90 days where permitted, in which case we will tell you before the first 45 days are up)

This 45-day timeframe applies to requests to know, access, correct, or delete. It is separate from — and does not delay — the opt-out timeframe in Section 5A, where a request to stop the sale or sharing of your personal information is actioned within 15 business days. The 90-day period named in Section 5A is a different thing again: a look-back window for notifying our advertising partners, not a response deadline.