1. Overview

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you visit the Site, purchase products, create an account, participate in marketing programs, or otherwise interact with us, and describes the rights available to you under applicable law.

By using the Site, you acknowledge that you have read and agree to this Policy. If you do not agree, please discontinue use of the Site.

2. Information We Collect

2.1 Information You Provide Directly

• Name, email address, phone number, billing/shipping address
• Payment information (full card numbers are processed by third‑party payment processors such as Stripe, PayPal, or Shopify Payments; we do not store complete card numbers ourselves)
• Account credentials (username, hashed password)
• Order history, product preferences, and voluntarily submitted personal care preference data (e.g., skin type or hair type from a skin‑quiz feature)
• Customer service communications, reviews, and other user‑generated content (UGC)
• Information submitted for giveaways, surveys, or loyalty programs

2.2 Information Collected Automatically

• Device information (IP address, browser type, operating system)
• Cookies, pixel tags, and SDK‑collected behavioral data (browsing history, click‑stream, cart activity)
• Approximate geolocation (based on IP address); precise geolocation is collected only with your permission
• Data collected through third‑party analytics/advertising tools such as Google Analytics, Meta Pixel, and TikTok Pixel

2.3 Sensitive Personal Information

Under the CCPA/CPRA and similar state laws, the following may qualify as “sensitive personal information,” which we collect and use only as necessary and for which we provide a right to limit use:

• Precise geolocation
• Account login credentials
• Health‑related inferences (for example, information submitted through skin/body‑condition consultation features)

2.4 Information We Do Not Knowingly Collect

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (see Section 9).

3. How We Use Your Information

4. Cookies & Tracking Technologies

We use the following categories of cookies:

1. Strictly necessary cookies — cart and login‑session functionality; cannot be disabled via settings
2. Functional cookies — remember language, region, and preference settings
3. Analytics cookies — e.g., Google Analytics, used for traffic measurement
4. Advertising cookies — retargeting pixels from Meta, TikTok, Google Ads

You may manage non‑essential cookies through our Cookie Preference Center [link], or by adjusting your browser settings to reject cookies.

Universal Opt‑Out Mechanism (UOOM): As of 2026, twelve states require covered businesses to recognize and honor Global Privacy Control (GPC) signals. This Site is configured to detect and honor GPC signals as a valid request to opt out of the sale/sharing of your personal information.

5. Sharing of Information & “Sale”/”Share” Disclosure

5.1 We may share your information with the following categories of third parties

• Logistics and fulfillment providers (for shipping)
• Payment processors (Stripe, PayPal, Shopify Payments, etc.)
• Cloud hosting and data storage providers (e.g., AWS, Google Cloud)
• Marketing and analytics providers (Klaviyo, Meta, Google, TikTok)
• Customer service/help‑desk platforms
• Law enforcement or regulators, where legally required

5.2 Regarding “Sale” and “Share”

We do not sell or share your personal information for cross‑context behavioral advertising.

5.3 We Will Not

• Sell children’s personal information
• Sell your precise geolocation or health‑inference data to data brokers for purposes beyond their primary business function

6. State Consumer Privacy Rights

6.1 General Consumer Rights (subject to the specific law of your state)

• Right to know what categories of personal information we collect, use, and share
• Right to access a copy of the personal information we hold about you
• Right to delete your personal information (subject to legal retention requirements)
• Right to correct inaccurate personal information
• Right to data portability
• Right to opt out of: (a) sale of personal information, (b) sharing for targeted advertising, and (c) profiling/automated decision‑making with legal or similarly significant effects
• Right to non‑discrimination for exercising the above rights
• Right to appeal (in certain states, e.g., Virginia, Colorado) our decision to deny your request

6.2 How to Exercise Your Rights

Submit requests via:

• Email: admin.vastfloat@gmail.com
• An authorized agent may submit a request on your behalf (proof of authorization required)

We will respond to a verifiable request within 45 days (extendable by an additional 45 days with notice). Identity verification may include matching order information or a confirmation email.

7. Consumer Health Data — Special Notice

Our specific commitments regarding information you voluntarily provide through a skin quiz or health questionnaire:

• We will not share or sell this information to advertising platforms for targeted advertising
• We will not transfer this information to third parties for data‑brokering purposes
• We use it only to provide product recommendations, customer support, and other purposes you’ve explicitly agreed to
• You may request deletion of this information specifically at any time via [privacy@shturl.cc/8GfH]

8. Marketing Communications (Email/SMS) Compliance

• CAN‑SPAM Act: All marketing emails must include accurate sender information and a clear unsubscribe mechanism; unsubscribe requests must be honored within 10 business days
• TCPA (Telephone Consumer Protection Act): SMS marketing requires prior express written consent, must provide a “reply STOP to opt out” mechanism, and consent records must be retained
• Subscribing to marketing communications is voluntary and is not a condition of purchase

9. Children’s Privacy (COPPA)

The Site is not directed to children under 13, and we do not knowingly collect personal information from them. If we discover we have inadvertently collected such information, we will delete it promptly. If you believe your child has provided us with personal information, please contact us at admin.vastfloat@gmail.com.

10. Data Security

We maintain reasonable administrative, technical, and organizational safeguards (e.g., TLS encryption in transit, access controls, PCI‑DSS‑compliant payment handling) to protect your personal information. However, no method of internet transmission is 100% secure, and we cannot guarantee absolute security.

In the event of a data breach involving your personal information, we will notify you in accordance with applicable state data breach notification laws.

11. Data Retention

We retain your personal information only as long as necessary for the purposes described in this Policy, after which it is deleted or de‑identified, unless a longer retention period is required by law. Reference retention periods:

12. International Users & Data Transfers

The Site is primarily directed at the U.S. market. If you access the Site from outside the United States, your information may be transferred to and processed on servers located in the United States. By using the Site, you consent to this transfer.

13. Third‑Party Links

The Site may contain links to third‑party websites (e.g., social media, payment platforms). This Policy does not apply to those third‑party sites; please review their respective privacy policies.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be announced via a prominent notice on the Site or by email. Continued use of the Site after changes take effect constitutes acceptance of the updated Policy.

15. Contact Us

VASTFLOAT VASTFLOAT LIMITED

Email: admin.vastfloat@gmail.com

Appendix: Cookie Preference Center

[Insert cookie management component/link here]