How to reach us Email: info@insideoutcookie.com (put "privacy" in the subject line) Wholesale and fundraisers: sales@insideoutcookie.com Mail: Inside Out Cookie Co, 106 School St #206, Spring Mills, PA 16875, United States
1. What we collect
When you browse. Device and usage information: browser type, IP address, approximate location from that IP, time zone, the pages and products you look at, what you search for, how long you stay, and the site or ad that sent you here. Collected automatically through cookies, pixels, and similar tags (see section 4).
When you order. Name, email, phone number, billing and shipping address, what you bought, the gift note you add (who it is to, who it is from, and the message, which we print and put in the box), and payment details. Card numbers go straight to our payment processor over an encrypted connection. We never see or store your full card number.
When you subscribe to the Box. The same order details plus your box size, delivery schedule, flavor requests, and the payment method kept on file so we can bill and ship on the schedule you chose.
When you create an account. Email address and a login managed by Shopify. Your order history, addresses, and subscriptions attach to it.
When you write to us. Whatever you include in an email, the contact form, the wholesale or fundraiser application, the corporate gifting form, the flavor-swap request, or the accessibility feedback form. Business applications ask for your business name, address, and phone.
When you apply for a wholesale account. The business's legal name, its entity type (LLC, corporation, sole proprietorship, and so on), and its federal Employer Identification Number (EIN), plus a contact name, email, phone, business address, and how you plan to sell the cookies. We use the EIN only to confirm the business is real before Nick approves the account. It is saved on the business's customer record in Shopify, it is never shown on this site, and it is never sold or shared for advertising. Please give the business's EIN, not a Social Security number. The form goes through a small order desk we run on Vercel, which saves the application in Shopify and emails it to Nick to review; we do not store applications on Vercel.
At our events. You can type your email on our iPad at the table, or scan the QR code in line and type it on your own phone. The email goes to our email list at Klaviyo, marked as an event sign-up, so we can send you the code and our emails. If the iPad has no signal, your email waits on that iPad until it can send and is then removed from it.
When you join the email list, the loyalty program, or a referral. Your email address and, if you answer the question in our sign-up box (who the cookies are for), your answer. For loyalty and referrals, your order history, points, the reward you earned, and who referred you.
When you leave a review. Your name as you enter it, your email, the review, and any photo you attach. Reviews are public.
When you buy or redeem a gift card. Your email, the recipient's name and email, and the gift message.
We do not ask for and do not want sensitive information such as Social Security numbers, driver's license or passport numbers, health information, or precise geolocation. (The EIN on a wholesale application is a business tax number, not a personal one.) If you send sensitive information anyway, we delete it.
2. Why we use it
To load the site and keep it working, take and ship your order, bill subscriptions on schedule, answer you, run the loyalty and referral programs you joined, show you reviews, prevent fraud and abuse, understand how the site is used, and, if you opted in, send you email about new flavors, events, and offers. Every marketing email has an unsubscribe link. We do not send marketing texts. If that ever changes, texts will need their own separate opt-in.
3. Who receives it
We use these companies to run the store. Each one gets only what it needs for its job and is bound by its own privacy terms.
| Company | What it does for us | What it sees |
|---|---|---|
| Shopify (Shopify Inc., Canada/US) | Hosts the store, checkout, customer accounts, Shopify Subscriptions billing, Shop Pay, email notifications, and fraud analysis | Everything in section 1 that relates to an order or account. Shopify's policy: shopify.com/legal/privacy |
| Shopify Payments and Shop Pay | Process card payments and accelerated checkout | Payment and billing details. We see the last four digits and the card brand only |
| UPS | Delivers the box | Name, address, phone, and package weight |
| Printify | Prints and ships our hoodies | Name, shipping address, and the merch you ordered |
| Yotpo | Collects and displays product reviews after you order | Name, email, order, and the review you write |
| Loloyal | Runs the rewards and referral program | Email, order history, points, referral links |
| Klaviyo | Sends our marketing email and collects sign-ups from the site, the pop-up, and our event iPad and line QR code | Email, where you signed up, and, once you are on the list and have allowed marketing cookies, what you browse and buy here, so we can send relevant messages |
| Meta (Facebook and Instagram) | Advertising and measuring our ads, through the Meta pixel | Browsing and purchase events tied to a cookie or a hashed email |
| Google (Google Analytics through a Google tag we add to the site, plus the Google tag, Google Ads, and Google Analytics through Google's Shopify app) | Site analytics and advertising measurement | Browsing and purchase events tied to a cookie. Our own Google tag loads only after analytics is allowed, and sends advertising signals only when advertising is allowed too |
| Advertising and measuring our Pinterest pins, through the Pinterest tag | Browsing and purchase events tied to a cookie | |
| hCaptcha (Intuition Machines) | Keeps bots off our forms | IP address, browser details, and how you interact with the challenge |
| Gift Card Hero | Sells and delivers digital gift cards | Buyer and recipient name, email, and message |
| Pop Convert | Shows pop-ups on the site | IP address, browser details, and the pages you view |
| Instafeed | Shows our Instagram feed on the site | IP address and browser details |
| Elfsight | Loads site widgets | IP address, browser details, and the page you are on |
| ReferrLy | A referral app installed on the store. Its tracking pixel receives store events | Pages viewed, cart and checkout events, and permission to read customer name, email, and phone |
| Sami B2B Lock | Gates wholesale pricing to approved accounts | Your account login and tags |
| Puco | Page building | The fields you fill in |
| Vercel | Hosts the small order desk that passes wholesale applications and wholesale orders to Shopify and emails Nick | What you type into the wholesale application or order form, on its way to Shopify. It keeps no copy of applications |
| Convey (Convey Growth, our marketing agency) | Builds and maintains the site and runs our marketing | Site analytics, campaign data, and store data needed to do that work. Convey does not sell it and is bound to use it only for us |
| Anthropic (Claude) | The AI tool Convey uses to build and maintain the site and check that orders and subscriptions work | The store data Convey is working on, which can include order records |
If we add or remove a service, this table changes with it.
We also share information when the law requires it, to respond to a lawful request, to enforce our terms, or to protect people's safety or our rights. If the business is ever sold or merged, customer records go with it and this policy keeps applying until the new owner tells you otherwise.
We do not sell personal information for money. Sharing browsing and purchase data with the advertising partners above is something some laws call a "sale" or "sharing" or "targeted advertising." Section 6 tells you how to opt out of that.
4. Cookies, pixels, and consent
Cookies are small files your browser stores. Pixels and tags are small pieces of code that report what you do on a page. We use three kinds:
- Necessary. Checkout, cart, login, security, and fraud prevention. The site does not work without them, so they are always on.
- Analytics. How people use the site (which pages, how long, what breaks). Google Analytics (through a Google tag we add and through Google's Shopify app) and Shopify's own analytics.
- Advertising. Meta pixel, Google Ads tag, Pinterest tag. They let us show ads to people who visited, measure whether ads led to orders, and find people like our customers.
You see a cookie banner on your first visit. Where the law requires consent before analytics or advertising cookies run (the EU, UK, and Switzerland), the analytics and advertising tags listed above stay off until you say yes. In the US they run unless you decline in the banner or opt out below; once you decline or opt out, they stop, including our own Google tag. Some apps in section 3 (Loloyal, Pop Convert, Instafeed, Elfsight, and ReferrLy) load for every visitor whatever you choose, because they draw parts of the page. You can change your mind any time through the "Cookie preferences" link in the footer.
The advertising companies above can collect information about what you do on this site and on other sites over time.
Everywhere else, you can opt out of advertising cookies through:
- the "Do not sell or share my personal information" link in the footer
- Meta: facebook.com/settings/?tab=ads
- Google: adssettings.google.com
- Pinterest: pinterest.com/settings/privacy
- The Digital Advertising Alliance: optout.aboutads.info
- Your browser's cookie settings (blocking all cookies will break checkout)
Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sale, sharing, and targeted advertising for that browser, in every region where that right applies. No click needed, and when we detect it, the privacy line in the footer says it was honored.
Do Not Track. Browsers' older "Do Not Track" setting has no agreed meaning, so we do not act on it. GPC is the signal we honor.
The full list of cookies Shopify sets is at shopify.com/legal/cookies.
5. AI
We want to be plain about where software that could be called "AI" touches your information.
- Shopping assistants can read our public info. Our store is connected to Shopify's storefront tools that let approved AI shopping assistants (for example, the Shop app and other agents using Shopify's agentic commerce features) read our public product listings, prices, policies, and FAQ to answer a shopper's question or place an order that shopper asked for. They read the same public pages you can. They do not get your account or order history from us.
- We use AI tools to draft and to build. We and our agency, Convey, use AI-assisted tools to help draft product descriptions, marketing copy, images, video, and replies to routine questions. Convey builds and maintains this site with Anthropic's Claude, and in that work Claude can read store data, including order records. A person reviews anything before it is published or sent to you.
- Fraud screening. Shopify's checkout runs automated fraud analysis on orders. A person at Inside Out Cookie makes the final call on any order that gets flagged. Nobody is refused by a machine alone.
- What we do not do. We do not run a chatbot on this site. If you email us, a person answers. We do not use your emails, notes, reviews, or order details to train AI models, and we do not ask our vendors to train their models on them for us.
- How to reach a human. info@insideoutcookie.com, any time, about anything on this site.
If we ever add an AI surface that talks to you directly (a chat assistant, an automated phone line), we will label it as AI, give you a way to reach a person from inside it, and update this section first.
6. Your rights and choices
Depending on where you live, you may have the right to:
- Know what personal information we hold about you and get a copy
- Correct it
- Delete it
- Opt out of sale, sharing, targeted advertising, and profiling
- Limit use of sensitive information (we do not collect any on purpose)
- Not be treated differently for exercising these rights
- Appeal if we turn down a request
State consumer privacy laws give some or all of these rights to residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, and Maryland, and more states pass similar laws every year. Residents of the EU, UK, and Switzerland have them too. We do not wait to see where you live: every request gets the same treatment.
To make a request: email info@insideoutcookie.com with "privacy request" in the subject, or write to the mailing address above. Tell us what you want (a copy, a correction, deletion, an opt-out) and the email address you used with us. We will confirm it is you by replying to that email or, for account holders, asking you to log in. We answer within 45 days (we may take another 45 if the request is complicated, and we will tell you). You can name someone to make the request for you; we will still confirm with you directly. If we say no, we will say why, and you can reply "appeal" to have a different person look at it. If you are still unhappy you can complain to your state attorney general or, in the EU or UK, your data protection authority.
Marketing opt-outs. Unsubscribe from email with the link at the bottom of any message. It takes effect within 10 business days at most and usually right away. You will still get order and subscription emails, because those are part of the service you bought.
Delete your account. Email us and we will delete it. Shopify's customer accounts do not have a delete button, so email is the way. We keep the records the law makes us keep (see section 7) and delete the rest.
Non-discrimination. We will not refuse you service, charge you a different price, or give you a lesser product because you exercised a privacy right. Loyalty and referral rewards are a voluntary program with their own terms; leaving it ends the rewards, not your right to shop.
7. How long we keep it
| Information | Kept for |
|---|---|
| Order and payment records | As long as tax, accounting, warranty, and fraud rules require, and no longer |
| Account information | Until you ask us to delete the account |
| Subscription records | The life of the subscription, then the same window as order records |
| Marketing list | Until you unsubscribe or ask us to delete you |
| Wholesale application details (legal name, entity type, EIN) | While the wholesale account is open. If we decline an application, or the account closes, we delete the EIN within 30 days |
| Event sign-ups (iPad and line QR code) | The same as the marketing list. An email waiting on the event iPad for a signal is removed from the iPad as soon as it sends |
| Support emails and form submissions | In our inbox, so we can look back at an order if you write again. Ask and we delete them |
| Reviews | Until you ask us to remove them |
| Analytics and ad cookies | Per the vendor's default, generally 30 days to 2 years, and you can clear them any time |
Ask us at any time how long we are holding something of yours and we will tell you. When we erase your customer record in Shopify, Shopify passes the erasure request to the apps connected to the store. For the other companies in section 3, we send the request ourselves where they offer a way to do it. Vendors can keep what the law makes them keep.
8. California notice
If you live in California, here is the same information in the categories California law uses. In the last 12 months we collected:
| Category | Examples | Sold or shared for advertising? |
|---|---|---|
| Identifiers | Name, email, postal address, phone, IP address, cookie and device ids | Cookie and device ids and a hashed email, to Meta, Google, and Pinterest |
| Customer records | Billing address and the last four digits of your card (the full card stays with Shopify Payments) | No |
| Commercial information | What you bought, subscriptions, gift notes, reviews | Purchase events, to Meta, Google, and Pinterest |
| Internet activity | Pages viewed, searches, clicks, the ad that sent you | Yes, to Meta, Google, and Pinterest |
| Approximate location | City or region worked out from your IP address | Only as part of the browsing events above |
| Photos | A photo you attach to a review | No |
| Business information | Wholesale applicants: legal name, entity type, EIN | No |
We get it from you, from your browser or device, and from the companies in section 3. We use it for the purposes in section 2, share it with the companies in section 3, and keep it for the periods in section 7. We do not collect sensitive personal information on purpose. We do not knowingly sell or share the personal information of anyone under 16. To opt out of sale and sharing, use the "Do not sell or share my personal information" link in the footer or turn on Global Privacy Control; for your other rights, see section 6.
9. Visitors outside the United States
We are in Pennsylvania and our data is processed in the United States by the vendors above. If you visit from the EU, UK, or Switzerland: our legal bases are performance of a contract (taking and shipping your order), your consent (marketing, non-essential cookies), our legal obligations (tax, fraud), and our legitimate interest in running, securing, and improving the store. Transfers to the US rely on our vendors' standard contractual clauses or their certification under the EU-US Data Privacy Framework. You have the rights in section 6 plus the right to withdraw consent and to complain to your local supervisory authority. We ship within the United States only, so most non-US visitors are browsing, not buying.
10. Kids
This site sells food to adults. We do not knowingly collect personal information from anyone under 16, and we do not market to children. If you think a child gave us their information, email us and we will delete it.
11. Security
Checkout and account pages run over an encrypted connection. Payment details are handled by Shopify Payments, which is PCI DSS Level 1 certified; card data never touches our own systems. We limit who at Inside Out Cookie and Convey can see customer records to the people who need them for orders, support, and marketing. No site is perfectly secure; if we learn of a breach affecting your information, we will notify you as the law requires.
12. Changes
When this policy changes, the effective date at the top changes with it, and if the change is material we will email account holders and subscribers before it takes effect.