Privacy policy

The short version

• We collect what an order needs: your name, address, email, and what you bought. Payment card numbers go straight to our payment processor and never reach us.
• We use it to ship your order, answer your emails, keep the store secure, and, if you have not opted out, to show you relevant advertising.
• We do not sell your information for money. We do share some information with advertising partners, which counts as selling and sharing under California and several other US state laws. You can turn that off.
• You can ask for a copy of your information, ask us to correct it, or ask us to delete it, at any time, by emailing support@lyffh.com. It costs nothing and we will not treat you differently for asking.

Everything below sets out the same thing in full.

What we collect from you

Only what the Services actually need. You give us most of it directly:

• Contact details. Your name, email address, shipping address, billing address, and phone number if you give us one.
• Order details. What you ordered, the value, the delivery address, confirmation that payment succeeded, and any discount code you used.
• Account details. If you create an account, your login details and saved preferences.
• Subscription details. Your delivery frequency, the next renewal date, and any changes you make to the schedule.
• What you say to us. The content of emails, contact form messages, product reviews, and support requests, including anything you choose to tell us in them.
• Marketing preferences. Whether you asked for our emails, and whether you have since unsubscribed.

Some parts of the Services will not work without this information. Checkout needs an address. Support needs a way to reply. You can always decline, and simply not use that part of the store.

What we collect automatically

When you browse the store, we and our providers record technical information about the visit. This is usage data:

• Device and browser type, screen size, and language.
• IP address, and the approximate city or region it indicates.
• Which pages you viewed, what you added to the cart, what you searched for, and how you arrived at the site.
• Whether you opened an email we sent and whether you clicked a link in it.

This is collected using cookies, pixels and similar technologies, described under cookies below.

What we receive from other companies

We also receive information about you from the companies that help us run the store:

• Shopify, which hosts the store and provides the checkout, analytics and order records, and which handles some of your information under its own consumer privacy policy.
• Payment processors, which take your card details directly and pass back only the confirmation, the card type, and the last four digits. We never see or store a full card number.
• Carriers, which return delivery scans and tracking events for your parcel.
• Advertising and analytics partners, which report how their placements performed and, in aggregate, how the site is used.

Anything we receive this way is handled under this policy from the moment it reaches us.

Why we use it

We use personal information for the purposes below and nothing else. Where you are in the UK or the European Economic Area, the legal basis for each is named.

• Providing the Services. Taking payment, packing and shipping your order, sending order and delivery emails, running your account, handling returns and refunds, and managing subscriptions. Basis: performance of our contract with you, Art. 6(1)(b) GDPR.
• Answering you. Replying to support emails and reviews, and keeping a record of the conversation so the next person who helps you is not starting cold. Basis: our legitimate interest in running a responsive business, Art. 6(1)(f) GDPR.
• Security and fraud prevention. Detecting fraudulent orders, protecting accounts, and investigating misuse of the store. Basis: our legitimate interest in keeping the store safe, Art. 6(1)(f) GDPR.
• Marketing and advertising. Sending email you asked for, and showing you Lyffh advertising on other sites. Basis: your consent where consent is required, Art. 6(1)(a) GDPR, otherwise our legitimate interest in promoting our products, Art. 6(1)(f) GDPR.
• Improving the store. Understanding which pages work, which do not, and where orders fail. Basis: our legitimate interest in improving the Services, Art. 6(1)(f) GDPR.
• Meeting our legal obligations. Keeping tax and transaction records, and responding to lawful requests. Basis: compliance with a legal obligation, Art. 6(1)(c) GDPR.

We do not use your information to make automated decisions that produce legal effects for you.

Cookies and tracking

Cookies are small files stored by your browser. We use them to keep your cart between pages, remember whether you are signed in, measure how the store is used, and support advertising. Shopify sets some of them to run the store itself, and lists them in its cookie policy.

Most browsers accept cookies by default, and every browser lets you remove or block them. Blocking them is your right and it will break parts of the store, most obviously the cart and the checkout.

We honour the Global Privacy Control signal. If your browser sends it, we treat it as a valid request to opt out of sharing and targeted advertising for that browser or device, and where we can connect it to your account we apply it to the account too. You can read about it at globalprivacycontrol.org. We do not act on any other "Do Not Track" signal, because there is no agreed standard for what one means.

Who we disclose it to

We disclose personal information in these circumstances, and no others:

• To vendors and service providers acting for us, including hosting, payment processing, fulfilment and shipping, email delivery, analytics and customer support.
• To advertising and marketing partners, who use it under their own privacy notices to show you our advertising.
• When you ask us to, or clearly direct us to, such as sending your address to a carrier.
• To professional advisers, or as part of a merger, acquisition or insolvency, where your information would move with the rest of the business.
• To comply with the law, respond to a lawful request, enforce our terms, or protect the rights and safety of our customers, our staff and ourselves.

The categories involved, in the language US state privacy laws use:

Category of personal information	Who receives it
Identifiers, such as name, email, postal address and IP address	Service providers, advertising and marketing partners
Customer records, such as the contact and billing details attached to an order	Service providers, advertising and marketing partners
Commercial information, such as what you bought, returned, or asked us about	Service providers, advertising and marketing partners
Internet activity, such as pages viewed and email opens	Service providers, advertising and marketing partners
Approximate location, derived from your IP address	Service providers, advertising and marketing partners

We do not disclose sensitive personal information, and we do not collect it in the first place. We do not ask for health information, and you should not send us any.

Selling and sharing for advertising

We do not exchange your personal information for money. We do share the categories below with advertising partners so that Lyffh advertising reaches people likely to be interested. California and several other US state laws define that as "selling" and "sharing", so we say so plainly here.

Category shared	Who receives it
Identifiers, such as name and email address	Advertising and marketing partners
Commercial information, such as records of products purchased	Advertising and marketing partners
Internet activity, such as browsing on this site	Advertising and marketing partners

You can stop this at any time through Your Privacy Choices, by sending the Global Privacy Control signal from your browser, or by emailing support@lyffh.com. We do not knowingly sell or share the personal information of anyone under 16.

Marketing email

We send product news and offers only to people who asked for them. Every one of those emails has an unsubscribe link at the foot, one click stops them, and we do not ask why.

Unsubscribing does not stop transactional email. You will still get order confirmations, shipping notifications and subscription renewal reminders, because those are part of the order rather than marketing.

Other sites we link to

The store links to sites we do not run. Once you follow one of those links you are covered by that site's privacy policy, not ours, and we are not responsible for what it does with your information. It is worth reading their policy before handing anything over.

Anything you post somewhere public, including a product review or a social media post, can be read by anyone.

Children

The Services are not intended for children and we do not knowingly collect personal information from them. Our products are not intended for children either. If you are a parent or guardian and believe your child has given us personal information, email support@lyffh.com and we will delete it.

Security and how long we keep information

The store runs over an encrypted connection, payment details are handled by our processor rather than by us, and access to customer records is limited to the people who need it to do their job. No system is perfect, and no transmission over the internet can be guaranteed secure, so we will not claim otherwise.

We keep your information for as long as we need it for the purpose it was collected. In practice: order and tax records for as long as the law requires us to hold them, account information until you close the account, support conversations while they may still be relevant to a refund or a dispute, and marketing lists until you unsubscribe. After that it is deleted or anonymised.

Your rights

Depending on where you live, some or all of these apply to you. Where local law gives you a right this policy does not mention, that law wins.

• Access. Ask what personal information we hold about you and get a copy of it.
• Correction. Ask us to fix information that is wrong or out of date.
• Deletion. Ask us to delete your personal information, subject to records we are legally required to keep.
• Portability. Ask for your information in a portable format, or ask us to send it to someone else.
• Opt out of sale, sharing and targeted advertising. Covered above.
• Objection and restriction. Object to processing based on our legitimate interests, or ask us to pause processing while a question about it is resolved.
• Withdraw consent. Where we rely on consent, withdraw it at any time. That does not undo processing that was lawful before you withdrew.
• Appeal. If we turn a request down, ask us to look again.

How to use those rights

Email support@lyffh.com and say what you want. There is no form and no fee.

We will ask you to confirm your identity first, usually by replying from the email address on the order, because handing your data to the wrong person would be the worse mistake. If someone is acting on your behalf, we will ask for proof that you authorised them. We respond within the time the law where you live allows, and sooner where we can.

We will never charge you more, give you worse service, or refuse to sell to you because you exercised a privacy right.

Complaints

If you are unhappy with how we have handled your information, tell us first at support@lyffh.com. We would rather fix it than have you take it elsewhere.

You also have the right to complain to your data protection authority. In the EEA, the list of authorities is published by the European Data Protection Board. In the UK it is the Information Commissioner's Office. Depending on your US state, you may have a right to appeal our decision, and we will tell you how when we reply.

International transfers

We are based in the United States and our service providers operate in several countries, so your personal information may be transferred, stored and processed outside the country you live in.

Where we transfer personal information out of the UK or the European Economic Area, we rely on a recognised transfer mechanism, normally the European Commission's Standard Contractual Clauses or the UK equivalent, unless the destination country has been formally recognised as providing adequate protection.

Changes to this policy

We update this policy when our practices change, or when the law does. The current version always sits on this page with the date it took effect at the top. Where a change materially affects you, we will tell you directly rather than quietly editing the page.

Contact

Questions about this policy, or about anything we hold on you, go to support@lyffh.com. A person reads every email, usually the same business day.

Lyffh operates this store and is the business responsible for your personal information. Where data protection law uses the term, we are the data controller.

Lyffh
381 Evertree Loop
Sanford, FL, 32771, US