Privacy

October 02, 2020 7 min read

Privacy Policy

This Privacy Policy describes how Miracle Tree (“we,” “us,” or “our”) collects, uses, discloses, and safeguards your personal information when you visit or make a purchase from www.miracletree.org. It forms part of our Terms of Service and related policies.

1. Information We Collect

Information You Provide

We may collect:

Name, billing, and shipping address
Email address and phone number
Payment information (processed securely by third-party providers; we do not store full payment details)
Account credentials
Communications (email, SMS, contact forms)

Automatically Collected Information

We may collect:

IP address
Device, browser, and operating system details
Pages visited, referring URLs, and interaction data
Cookies and similar tracking technologies

2. How We Use Your Information

We use personal information to:

Process orders, payments, subscriptions, and returns
Provide customer support
Send transactional and marketing communications (where permitted)
Improve website performance and user experience
Detect fraud, abuse, and security risks
Comply with legal obligations

3. Cookies & Tracking Technologies

We use cookies and similar technologies for:

Essential website functionality
Analytics and performance monitoring
Marketing and advertising (subject to consent where required)

You may control cookies through your browser settings. Disabling cookies may affect site functionality.

3A. Cookie Consent & EU Compliance

For users in the European Economic Area (EEA), United Kingdom, and similar jurisdictions:

We display a cookie consent banner prior to placing non-essential cookies
You may accept, reject, or customize preferences at any time
Essential cookies remain active as required for site operation

3B. Do Not Track Signals

Some browsers provide a legacy “Do Not Track” (DNT) signal. There is still no universally accepted technical standard for how a site should interpret DNT, so our website does not respond to the DNT header specifically. We may update this if a standard emerges.

This does not apply to the Global Privacy Control (GPC). GPC is a different and standardised signal, and we do honour it as an opt-out of the sale or sharing of personal information wherever the law recognises it — see Section 4A. If you want to opt out using a browser signal, use GPC rather than DNT.

4. Sharing Your Information

We share personal information with trusted service providers, including:

E-commerce platforms (e.g., Shopify)
Payment processors (e.g., Stripe, Shopify Payments)
Shipping and fulfillment providers
Email and SMS platforms
Analytics and advertising partners

Service providers and processors may only use your information to perform services on our behalf. Advertising partners are different: as described in Section 4A, they also use the online identifiers we disclose to them for their own advertising and measurement purposes.

We do not sell personal information for monetary consideration.

4A. Sale and Sharing (CPRA Disclosure)

Under CPRA, “sale” and “sharing” are defined broadly and include disclosing personal information for cross-context behavioral advertising, whether or not money changes hands.

We do not sell personal information for monetary value
We do share online identifiers — such as cookie identifiers, device identifiers, and IP address, together with the pages you view and the purchases you make on our site — with advertising and measurement partners including Meta, Google, and TikTok, so that advertising can be targeted and measured across other websites and apps
Under CCPA/CPRA this is a “sale” and/or “sharing” of personal information; comparable laws in other US states treat it as targeted advertising

Your right to opt out

You may direct us to stop this sharing at any time, free of charge and without any effect on the price or quality of anything you buy from us.

To opt out, use any of these:

The Your Privacy Choices page, linked from the footer of every page on this site, and submit the opt-out form there
Browsing with the Global Privacy Control (GPC) preference signal enabled. Where you are in a jurisdiction that recognises it, we treat a GPC signal as a request to opt out of the sale or sharing of personal information for the browser and device you are using
Emailing info@miracletree.org with the subject line “Do Not Sell or Share My Personal Information,” including the email address associated with your orders so that we can locate your record
Rejecting, blocking, or clearing advertising and non-essential cookies in your browser or device settings, which prevents the identifiers used for this sharing from being set on that browser or device

We do not require an account to submit an opt-out request, we do not charge for it, and we will not discriminate against you for making one. An authorized agent may submit a request on your behalf.

California residents may:

Opt out of the “sale” or “sharing” of personal information
Request access, correction, or deletion
Exercise rights without discrimination

Requests can be submitted to info@miracletree.org.

5. Email & SMS Marketing

By opting in, you agree to receive communications:

Message frequency varies
Message/data rates may apply
Unsubscribe anytime via link or by replying STOP

Consent is not required for purchase.

6. Data Retention

We retain personal data only as long as necessary.

Typical Retention Periods:

Orders & transactions: up to 7 years
Customer accounts: duration of account + reasonable period
Support communications: 2–3 years
Marketing data: until opt-out or withdrawal of consent
Analytics data: 12–26 months

6A. Data Minimization

We retain only the data necessary for defined purposes and securely delete or anonymize data when no longer required.

7. Data Security

We implement reasonable administrative, technical, and physical safeguards.
No system is completely secure.

8. Your Privacy Rights (GDPR & International)

Depending on your location, you may have rights to:

Access, correct, or delete your data
Restrict or object to processing
Data portability
Withdraw consent

Requests: info@miracletree.org

8A. Legal Basis for Processing (GDPR)

We process data under:

Contractual necessity (orders, payments)
Legitimate interests (security, analytics, improvement)
Consent (marketing, cookies where required)
Legal obligations

8B. Automated Decision-Making & Profiling (GDPR)

We may use automated processing (including profiling) for:

Fraud detection and prevention
Marketing personalization and advertising optimization

These processes do not produce legal or similarly significant effects on individuals.
You may object to such processing by contacting us.

9. California Privacy Rights (CCPA / CPRA)

California residents have the right to:

Know what data we collect and how it is used
Request access, correction, or deletion
Opt out of the sale or sharing of personal information for cross-context behavioral advertising — see Section 4A for how to do this
Limit the use of sensitive personal information, where applicable
Non-discrimination

We may verify identity before fulfilling requests, and we respond within 45 days (extendable to 90 days where permitted). Our full Privacy Notice for California Residents sets out these rights in more detail.