privacy.

short version: we collect what you give us so we can ship you pops, email you when there's a drop, and run the business. we don't sell your data. we don't share it with people who shouldn't have it. if you want it deleted, email us.

what we collect

• email address · for receipts and the list
• shipping address · so the pops get to you
• payment info · processed by stripe; we never see your card number
• basic analytics · vercel analytics + speed insights · aggregated, no personal identifiers

what we don't do

• sell your data to third parties
• track you across other sites
• send you spam (one drop email per drop, max)
• store your card number anywhere

marketing emails · consent + unsubscribe

when you sign up to “the list” or check out, you're opting in to occasional marketing emails (drop announcements, festival activations, restocks). you can unsubscribe at the bottom of any email or by emailing thekiwipop@gmail.com. transactional emails (order confirmations, shipping notifications) keep coming regardless. we have to send those.

cookies + tracking

we use vercel analytics and speed insights to understand which pages people visit and how fast they load. those tools sample IPs and basic device info but don't set marketing cookies and don't link to identifiable individuals. we don't run retargeting pixels or advertising trackers.

third-party service providers

we share data only with service providers necessary to operate the business:

• stripe: payment processing (PCI-DSS compliant)
• supabase: database and authentication
• vercel: hosting and analytics
• resend: transactional email
• usps / shipping carriers: order fulfillment

these providers are contractually bound to use your data only for the services they provide to us and to maintain appropriate security measures.

data retention

we retain your personal information for as long as necessary to fulfill the purposes described in this policy:

• order data: 7 years (tax and legal compliance)
• email list data: until you unsubscribe
• analytics data: 26 months (aggregated)

you can request deletion at any time; we'll delete what we legally can and tell you what we have to keep and why.

data security

we implement industry-standard security measures including HTTPS encryption, secure authentication, and access controls. payment data is handled entirely by stripe and never touches our servers. no system is 100% secure. if we ever experience a breach affecting your data, we'll notify you as required by law.

california residents (CCPA / CPRA)

we don't sell or share personal information for cross-context behavioral advertising. you have the right to know what we have on you, request deletion, and opt out of any future sale or sharing (we don't do either, but the right is yours). email thekiwipop@gmail.com with the subject “CCPA request” and we'll handle it within 45 days.

kids · COPPA

this site and product are not directed at children under 13. we do not knowingly collect personal information from anyone under 13. if you believe a child has signed up, email us and we'll delete the record. kiwi pop is intended for adults 18+ only. see the fda + safety page.

your rights

email thekiwipop@gmail.com to:

• see what we have on you
• delete it
• unsubscribe from emails
• opt out of analytics

do not track

our site does not respond to “do not track” browser signals because there's no industry standard for what that means. however, we don't track you across other sites anyway.

international users

we currently ship only within the united states. if you access the site from outside the US, your data will be transferred to and processed in the united states, which may have different data protection laws than your jurisdiction. by using the site, you consent to this transfer.

changes to this policy

we may update this privacy policy periodically. the “last updated” date at the top reflects the most recent revision. continued use of the site after changes constitutes acceptance. material changes will be communicated via email to customers with orders in the past 12 months.

contact

questions about this privacy policy or your data: thekiwipop@gmail.com

mailing address: kiwi pop, salt lake city, utah, USA