Privacy Policy

1. Information We Collect

Information you provide

• Account information, such as your name, email address, password or authentication credentials, and communication preferences.
• Order and delivery information, such as the recipient name, shipping address, telephone number, publication ordered, quantity, and order history.
• Saved addresses and address corrections or confirmations that you choose to keep in your account.
• Communications you send to us, including customer-service and privacy requests.

Payment information

Payments are processed by PayPal. PayPal collects and processes payment credentials under its own terms and privacy statement. We do not receive or store your full payment-card number or security code. We may receive limited transaction information, such as your name, email address, billing or shipping details, payment status, transaction identifier, amount, and fraud or dispute information needed to complete and administer the order.

Information collected automatically

When you use the Site, we and our service providers may collect IP address, browser and device information, operating system, referring pages, pages viewed, interactions, approximate location derived from IP address, cookie identifiers, session information, and diagnostic or security logs.

Sensitive information

Account log-in and authentication credentials may be treated as sensitive personal information under some laws. We collect them only to authenticate and secure accounts, and we do not use or disclose them to infer characteristics about a person. PayPal, rather than the Company, collects full payment credentials. We do not intentionally collect precise geolocation, government identification numbers, biometric identifiers used to identify a person, health diagnoses, racial or ethnic origin, religious beliefs, sexuality, citizenship or immigration status, or similar sensitive information through the Site.

We configure the Site, server logs, analytics, and support processes to exclude passwords and authentication secrets, full payment-card data, government identification numbers, precise geolocation, health information, and other sensitive content that is not needed for the service. We also prohibit names, email addresses, full street addresses, PayPal transaction identifiers, and fraud or dispute details from being sent to analytics. If prohibited or unnecessary sensitive information is received accidentally, we will restrict access, stop any incompatible use or disclosure, and delete or securely dispose of it promptly, subject only to a documented legal, security, fraud-prevention, or dispute-related retention need. We do not sell sensitive personal information. Children's information is addressed in Section 11.

2. Google Address Validation

We use Google Maps Platform Address Validation API to help standardize, correct, and confirm shipping addresses. When you request validation, the address you entered and related technical information are sent to Google. For U.S. addresses, Google may use United States Postal Service data. Google processes information under the Google Privacy Policy and applicable Google Maps terms.

Google references: Google Privacy Policy | Google Maps End User Additional Terms | Address Validation policies

We may temporarily retain Google-provided address-validation content for no longer than Google permits. At the end of the applicable period, we delete it or replace it with address information that you confirmed or corrected. Your confirmed shipping address may then be retained as part of your account or order record as described below.

3. Google Analytics and Cookies

We use Google Analytics to understand how visitors use the Site, diagnose performance, and improve content and navigation. Google Analytics uses cookies or similar technologies and may receive online identifiers, IP address, device and browser information, and Site interaction data. We do not intentionally send names, email addresses, street addresses, payment information, or other directly identifying customer information to Google Analytics.

Learn more: How Google uses information from sites or apps that use its services | Google Analytics Opt-out Browser Add-on

We do not use Google Analytics advertising features, sell personal information, process personal information for targeted advertising, or use profiling to make decisions that produce legal or similarly significant effects. Because we do not engage in those activities, no targeted-advertising, sale, or qualifying-profiling opt-out is presently necessary. You may nevertheless submit an opt-out request using Section 7, and we will honor it if the relevant activity begins or applicable law requires us to do so.

Browser controls can block or delete cookies, but some Site functions may then work differently.

Because there is no uniform standard for browser "Do Not Track" signals, the Site does not respond to them. Other parties, including Google, may collect information about online activity over time and across different websites when their technologies operate on the Site. We honor legally required opt- out preference signals to the extent they apply to our practices.

4. How We Use Information

• Create and administer accounts and saved addresses.
• Validate addresses, process orders, arrange shipment, provide order notices, and handle cancellations, returns, refunds, disputes, and support.
• Send transactional email through Twilio SendGrid and, when permitted, marketing email. Transactional messages may continue even after you unsubscribe from marketing.
• Operate, secure, troubleshoot, measure, and improve the Site.
• Prevent fraud, abuse, and security incidents and enforce our terms.
• Comply with tax, accounting, legal, and regulatory obligations and protect legal rights.

5. How We Disclose Information

We may disclose personal information to the following categories of recipients for the purposes described above:

• PayPal, as an independent payment-services provider and controller of payment data.
• Google, for Address Validation and Google Analytics.
• Twilio SendGrid, to send and monitor transactional or marketing email.
• Render and other hosting, database, security, backup, and technical-service providers.
• Shipping carriers, fulfillment personnel, and authorized customer-support staff.
• Professional advisers, governmental authorities, courts, or law enforcement when reasonably necessary or legally required.
• A buyer, successor, or adviser in connection with a merger, financing, reorganization, or sale of all or part of the business, subject to appropriate protections.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising or use it for targeted advertising.

Provider privacy information: PayPal Privacy Statement | Twilio Privacy Notice | Google Privacy Policy

6. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including to provide accounts and fulfill orders, meet legal and accounting requirements, resolve disputes, prevent fraud, and enforce agreements. In particular:

• Google Address Validation content is retained only for the period Google permits, generally no more than 30 consecutive calendar days unless it has been replaced by an address the customer confirmed or corrected.
• Saved addresses remain until the account holder deletes them, closes the account, or asks us to delete them, subject to lawful exceptions and backup cycling.
• An address captured in a completed order may remain in the order record for tax, accounting, fulfillment, fraud-prevention, dispute, and legal-compliance purposes even if the same address is removed from the account.
• Google Analytics data is retained according to the configured Analytics retention period. Email delivery, suppression, and unsubscribe records are retained as needed to deliver messages, honor opt-outs, prevent abuse, and meet legal requirements.
• At launch, Render database point-in-time recovery copies roll off within no more than seven days, and Render-generated logical backup exports are retained by Render for seven days. Any separately downloaded or self-managed backup containing personal information will be retained for no more than 30 days unless a documented legal, accounting, security, or dispute- related need requires a longer period.
• Deleted personal information in a backup is access-restricted, is not used for ordinary business purposes, and is deleted or overwritten within the applicable period above. If a backup is restored, deletion requests and applicable retention limits will be reapplied. We do not retain deleted information indefinitely.

7. Your Privacy Rights, Requests, and Appeals

Depending on where you live and the law that applies, you may have the right to:

• confirm whether we process personal information about you and obtain access to it;
• correct inaccurate personal information;
• delete personal information provided by or obtained about you, subject to lawful exceptions;
• obtain a portable copy of personal information you previously provided to us;
• opt out of a sale of personal information, targeted advertising, or profiling used for decisions that produce legal or similarly significant effects; and
• exercise privacy rights without unlawful discrimination or retaliation.

You may update account information and saved addresses through your account when those controls are available. We may verify your identity and authority to make a request. We may retain or decline to delete information when reasonably necessary to complete a transaction, maintain legally required records, detect security incidents or fraud, exercise or defend legal claims, or comply with law. If a law does not grant a particular right in your circumstances, we may choose to provide assistance voluntarily.

To make a privacy request, email pauline.serice@ealdliving.com with the subject line "Privacy Request" and describe the request and the email address associated with your account. Do not send payment- card numbers, passwords, or identification documents unless we specifically request an appropriate secure verification method. We do not require you to create a new account to submit a request.

We use the following timetable for authenticated privacy requests unless applicable law requires a faster response: we will respond without undue delay and no later than 45 days after receiving the request. We may extend the response period once by up to 45 additional days when reasonably necessary because of the complexity or number of requests, but we will notify you of the extension and its reason within the initial 45-day period. We provide responses without charge up to twice in a 12- month period, except that we may charge a reasonable administrative cost or decline to act when a request is manifestly unfounded, excessive, or repetitive, as permitted by law. This timetable is intended to satisfy the Texas Data Privacy and Security Act when that law applies.

If we decline to act on a request, you may appeal by replying to our decision or emailing pauline.serice@ealdliving.com with the subject line "Privacy Appeal" within a reasonable time after receiving the decision. Describe why you believe the decision should be reconsidered. We will provide a written appeal decision no later than 60 days after receiving the appeal. If we deny an appeal governed by the Texas Data Privacy and Security Act, our response will explain how to submit a complaint to the Texas Attorney General and provide the available online or other mechanism for doing so. Marketing email includes an unsubscribe link. We will honor valid unsubscribe requests, although we may continue to send non-marketing messages concerning accounts, orders, security, or legal matters.

8. California Privacy Notice

This section supplements the rest of this policy for California residents. During the preceding 12 months, we may have collected the following California categories of personal information: identifiers; customer- record information; commercial information; Internet or other electronic-network activity; approximate geolocation derived from IP address; and sensitive personal information limited to account log-in or authentication credentials. We obtain this information directly from you, automatically from your browser or device, and from service providers such as PayPal and Google Address Validation. We use and disclose it for the purposes and to the recipients described in Sections 4 and 5, and retain it as described in Section 6. During the preceding 12 months, we may have disclosed those categories for business purposes to payment, address-validation, analytics, email, hosting, database, security, backup, fulfillment, shipping, customer-support, and professional-service providers. We have not sold personal information or shared it for cross-context behavioral advertising. We do not offer a financial incentive for personal information, and we do not use or disclose sensitive personal information to infer characteristics about a person.

If the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to us or to a particular processing activity, a California resident may exercise the applicable rights to know or access, correct, delete, obtain a portable copy, opt out of sale or sharing, limit certain uses or disclosures of sensitive personal information, and receive equal service and pricing. Requests may be submitted under Section 7. An authorized agent may submit a request if the agent provides legally sufficient proof of authority and we can verify the consumer as required. While our no-sale and no- sharing practices remain unchanged, a sale- or sharing-opt-out link is not necessary; if those practices change, we will provide the notices and controls required by law before the change begins.

9. Security and Third-Party Data Protection

We establish, implement, and maintain reasonable administrative, technical, and physical safeguards appropriate to the volume and nature of the personal information we process. These safeguards are designed to protect confidentiality, integrity, and availability and include measures such as limiting access to authorized personnel, protecting credentials and secrets, using protections for data in transit, maintaining systems and backups, reviewing service providers, and responding to suspected security incidents. No Internet transmission, system, or storage method can be guaranteed completely secure.

We remain responsible for protecting personal information we receive from service providers. This includes limited transaction, fraud, and dispute information received from PayPal even though PayPal separately controls full payment credentials. We apply access, transmission-security, retention, and log- redaction controls to that information; limit it to personnel and providers who need it for the transaction, support, fraud prevention, a dispute, or legal compliance; and do not place it in analytics or general application logs. We require service providers that process personal information for us to provide appropriate privacy and security protections and we review those providers in proportion to the risk.

10. Data Breach Notification

We maintain an incident-response process to identify, contain, investigate, document, and remediate suspected unauthorized access to personal information. When an incident involves a service provider, we will coordinate with that provider, preserve relevant evidence, determine the information and people affected, and assess notification duties under the laws of the affected residents.

If a breach requires notice, we will notify affected individuals, regulators, consumer-reporting agencies, or other parties in the manner and within the time required by applicable law. Under current Texas requirements, notice to affected Texas residents is generally due as quickly as possible and no later than 60 days after determining that a qualifying breach occurred, subject to statutory exceptions or law- enforcement delay. If a qualifying breach affects at least 250 Texas residents, we will also report it electronically to the Texas Attorney General as soon as practicable and no later than 30 days after determining that the breach occurred.

11. Children

The Site and its purchasing functions are intended for a general audience and are not directed to children under 13. Children under 13 may not create an account, subscribe to marketing email, place an order, or otherwise submit personal information through the Site. We do not knowingly collect personal information online from a child under 13.

If we obtain actual knowledge that we collected personal information online from a child under 13 without verifiable parental consent or another exception permitted by the Children's Online Privacy Protection Act ("COPPA"), including through notice from a parent or legal guardian, we will promptly stop any unauthorized use or disclosure, disable related account access or communications as appropriate, delete the information from active systems using reasonable measures, and instruct relevant service providers to delete it. We will not use such information for marketing or profiling. A temporary residual copy may remain in an access-restricted backup only for the applicable backup period stated in Section 6, and it will not be restored for ordinary business use. We will retain only the minimum information, and only for as long as necessary, when retention is required by law or permitted by COPPA for security, fraud prevention, or another limited purpose. A parent or legal guardian who believes a child under 13 provided personal information may email pauline.serice@ealdliving.com with the subject line "Child Privacy Request." After reasonably verifying the requester's identity and relationship to the child, we will provide the rights required by law to review the child's personal information, request its deletion, and prevent further collection or use. If we later offer a feature directed to children under 13, we will update this policy, provide the required direct notice, and obtain verifiable parental consent before collecting personal information, except when a limited COPPA exception applies.

12. International Data Transfers

The Company is based in the United States, and personal information may be processed and stored in the United States or in other countries where our service providers operate. Those countries may have privacy laws that differ from the laws where a visitor lives. When applicable law requires a transfer safeguard, we will use a recognized contractual or other lawful mechanism and will provide the rights and remedies that cannot lawfully be waived.

We do not presently offer publication shipping to the European Economic Area, the United Kingdom, or any other location outside the United States, and we do not intentionally direct the publication-shipping service to those locations. Accessing the Site from another country does not expand the geographic availability of shipping. If European Union or United Kingdom data-protection law nevertheless applies to a particular person or activity, the person may contact us under Section 7 to exercise applicable rights or ask about the relevant transfer safeguard.

13. U.S.-Only Publication Shipping

Physical publications are offered for shipment only to valid delivery addresses within the United States.

The Site may remain accessible elsewhere, but the publication-shipping service is not offered internationally.

14. Changes to This Policy

We may update this policy from time to time. We will post the revised version on the Site and change its last-updated date. If a change materially expands how we use or disclose personal information already collected or materially reduces the protections described here, we will provide conspicuous notice on the Site and send notice to affected account holders at least 30 days before the change takes effect, unless a shorter period is necessary to comply with law, address an urgent security issue, or prevent fraud or abuse. Before using personal information already collected for a materially different purpose that is incompatible with the purpose disclosed when it was collected, we will obtain the affected person's affirmative consent, even when a specific privacy law does not expressly require consent, unless the different use is strictly necessary to comply with law, protect security, prevent fraud, or respond to the person's request. Refusing such consent will not affect previously purchased publications or services already completed, but it may prevent use of a new optional feature that requires the proposed processing.

15. Governing Law, Venue, and Severability

To the extent permitted by applicable law, Texas law governs this policy and disputes concerning our privacy practices, without regard to conflict-of-law principles. A dispute that is not resolved through the request and appeal process above may be brought in a state or federal court of competent jurisdiction located in Harris County, Texas, and the parties consent to personal jurisdiction and venue there. The Harris County venue provision will not be enforced against a consumer when the law of the consumer's state of residence gives the consumer a nonwaivable right to bring a claim in the consumer's home jurisdiction or otherwise prohibits the selected venue. Nothing in this section limits a nonwaivable privacy or consumer right or prevents a complaint to a regulator.

If any provision of this policy is held invalid or unenforceable, that provision will be enforced to the maximum extent permitted by law and the remaining provisions will continue in effect. This severability provision does not reduce any nonwaivable right or remedy.

16. Contact Us

Dr. Pauline Serice & Associates, Inc.

Email: pauline.serice@ealdliving.com

Telephone: +1 (832) 558-6885

Website: https://ealdliving.com