Privacy Policy

Privacy Policy

Effective date: [EFFECTIVE DATE]

This policy explains what personal information Mumbies, Inc. ("Mumbies," "we," "us") collects, how we use and share it, and the choices you have. It covers mumbies.com, partners.mumbies.com, our wholesale portal, our emails, and any other service that links to it (the "Services").

1. What we collect

Information you give us

• Contact and account details: name, email, phone number (if you add one), and shipping and billing addresses.
• Orders and subscriptions: what you buy, your Subscribe & save and Mumbies Box items, cadence, your Mumbies Day, skips and changes. Payment card details are collected and processed by Shopify; we don't store full card numbers.
• Your dogs: dog profiles you create, such as name, birthday, photo, breed, weight, chew strength and favorite products.
• Reviews and content: ratings, reviews, photos and videos, questions, "helpful" votes, and messages you send us (including attachments).
• Marketing preferences: whether you've agreed to marketing email.
• Giveaways: your email address, and if you win, your shipping address.
• Partners (creators, businesses and organizations): application details (name, contact details, country, business or organization name, website and social media profile links, dog name, answers to application questions), referral activity, commissions and Mumbies Cash, sample requests and shipping address, content you submit and your consent choices for it.
• Partner payouts and tax: payouts are handled by Stripe through Stripe Connect. Stripe collects your bank details and tax information (such as a Form W-9 and taxpayer identification number); we receive status information (for example, whether a W-9 is on file) and payout amounts, which we use for tax reporting such as Form 1099.
• Wholesale accounts: business name and type, contacts and buyer details, business addresses and locations, website and social links, orders, and resale or tax-exemption certificates (including any tax ID on them).

Information we collect automatically (subject to your cookie choices — see Section 5)

• Device and usage data: pages viewed, links clicked, referring page, browser and device type, approximate location derived from IP address, and identifiers stored in cookies or local storage.
• Analytics: with your consent, we use PostHog to understand how the Services are used. This can include session recordings of how pages are used, with form inputs masked and recording paused on personal pages such as account areas.
• Error and performance data: when something breaks, Sentry receives technical details about the error. On partners.mumbies.com, Sentry may also capture a session replay of the moments around an error and of a sample of sessions. [CONFIRM: whether partner-site Sentry replay stays on.]
• Referral and attribution data: if you arrive through a partner's or friend's referral link, we store the referral code in a cookie or your browser's storage so we can credit the right person when you order. At checkout, a Shopify pixel sends your email address and the stored referral code to our partner platform to record that credit.

Information from others

• Shopify: order, customer account and subscription details.
• Appstle: details of subscriptions created with our previous subscription app.
• Partners and friends who refer you: that you were referred and by whom.
• Social media: if you tag or mention @getmumbies on Instagram, we can see that post (username, caption and media) through Instagram's tools. If a partner connects a Facebook or Instagram account, we receive page names and follower counts.
• Public business directories: for wholesale stockists, business listing details from Google Places.

2. How we use it

• To run the store: process orders, ship products, manage subscriptions and Mumbies Box, provide customer accounts and support.
• To run the partner, referral and wholesale programs: review applications, track referrals, pay commissions and Mumbies Cash, send samples and lead gifts, and meet tax reporting obligations.
• To publish and moderate reviews and to give review rewards.
• To run giveaways: verify entries, pick and contact winners, and ship prizes.
• To send transactional emails (orders, subscriptions, account, payouts) and, with your permission, marketing emails.
• To understand and improve the Services, fix errors, and keep them secure.
• With your consent, to measure and improve our advertising on the partner site.
• To prevent fraud and abuse (for example, of referral links, giveaways and Mumbies Cash) and to comply with law.

3. Who we share it with

We don't sell your personal information for money. We share it with:

Service providers that process it on our behalf:

Advertising and analytics partners (marketing cookies, only with your consent): on partners.mumbies.com we use Google Tag Manager to load Meta (Facebook) Pixel and Google Analytics 4. These companies may combine data from our site with data from other sites.

Partners who referred you. If you came to Mumbies through a partner's link, landing page or giveaway, that partner can see in their dashboard your name and email address, that you were referred by them, and the number and total value of your purchases while the referral is active, so they can follow their commissions. [COUNSEL: confirm this disclosure model and whether it is a "sale"/"share" under state law; consider masking.]

Other people, when you choose: your published reviews, photos and videos (with the name you provide on the review) are public, along with a "verified buyer" badge when we can match the review to an order. Giveaway winners may be announced as described in the Official Rules.

Legal and safety: to comply with law, respond to lawful requests, enforce our terms, or protect rights and safety.

Business transfers: in a merger, acquisition or sale of assets, subject to this policy.

4. "Sale," "sharing" and targeted advertising

Some state laws treat letting advertising partners (like Meta and Google) collect data through cookies on our site for cross-context behavioral advertising as a "sale" or "sharing" of personal information, or as "targeted advertising." We do this only through marketing cookies, and only after you opt in.

You can opt out at any time by turning off marketing cookies in Cookie settings (in the site footer). We also honor Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a request to opt out of sale, sharing and targeted advertising for that browser, and we won't load marketing cookies.

We don't knowingly sell or share personal information of anyone under 16.

5. Cookies and your choices

We use cookies and similar technologies in three categories: necessary, analytics and marketing. Analytics and marketing are off until you opt in. See our Cookie Policy for the details and how to change your choices.

Marketing email: use the unsubscribe link in any marketing email or update your email preferences in My Account. We'll still send transactional emails about your orders, subscriptions and account.

6. Your privacy rights

Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws), you may have the right to:

• Know / access the personal information we have about you, and get a copy in a portable format;
• Correct inaccurate information;
• Delete your information;
• Opt out of the sale or sharing of personal information and of targeted advertising;
• Limit the use of sensitive personal information (we don't use sensitive information for purposes that require this right) [CONFIRM: tax IDs on wholesale certificates and W-9 data held by Stripe — counsel to assess];
• Appeal a decision we make about your request.

We won't discriminate against you for using these rights. Some loyalty-style benefits (for example, Mumbies Cash) depend on information we need to run them. [COUNSEL: assess whether a California "notice of financial incentive" is needed for review rewards, referral rewards and giveaways.]

California "Shine the Light": California residents may ask once a year about disclosures to third parties for their direct marketing. We don't share personal information with third parties for their own direct marketing. [CONFIRM.]

7. How to make a request

Email support@mumbies.com with the subject "Privacy request," and tell us which right you want to use. [CONFIRM: whether a second method (e.g. web form or toll-free number) is required.] We'll verify your request by confirming details we already hold, such as access to the email address on your account. You can use an authorized agent; we may ask for proof of their authority and to verify your identity directly. We'll respond within the time the law requires (generally 45 days). If we deny your request, you can appeal by replying to our response; if your appeal is denied, you may contact your state attorney general.

8. How long we keep it

We keep personal information only as long as we need it for the purposes above, then delete or de-identify it:

• Customer account and order records: [RETENTION PERIOD]
• Subscription records: [RETENTION PERIOD]
• Reviews and media: while published, and [RETENTION PERIOD] after removal
• Giveaway entries and winner records: [RETENTION PERIOD]
• Partner records, commissions and payout records: [RETENTION PERIOD — note tax record requirements]
• Wholesale accounts and tax certificates: [RETENTION PERIOD — note sales-tax audit periods]
• Analytics data: [RETENTION PERIOD]
• Error-monitoring data: [RETENTION PERIOD]
• Support messages: [RETENTION PERIOD]
• Marketing preferences and unsubscribes: kept as long as needed to honor them.

9. Children

The Services are not directed to children under 13, and we don't knowingly collect personal information from them. If you think a child has given us information, email support@mumbies.com and we'll delete it.

10. Security

We use reasonable safeguards, including encryption in transit, access controls and limiting staff access, to protect personal information. No system is perfectly secure, so we can't guarantee security.

11. Where we process data

We're based in the United States, and our service providers process data in the United States. [CONFIRM: any non-US processing.] If you use the Services from outside the US, your information will be transferred to the US.

12. Changes to this policy

We'll post any changes here with a new effective date. If we make material changes, we'll tell you by email (if we have your address) and/or a notice on the site before they take effect.

13. Contact us

Mumbies, Inc. 9924 Monarch Drive, Unit 5202 Franklin, WI 53132 support@mumbies.com