Privacy policy
Inside Out Cookie Co. ("Inside Out Cookie", "we", "us") runs insideoutcookie.com. This page says what we collect when you visit or buy, who touches it, how long we keep it, and how to reach a human about any of it.
Last updated: September 9, 2026
How to reach us Email: info@insideoutcookie.com (put "privacy" in the subject line) Wholesale and fundraisers: sales@insideoutcookie.com Mail: Inside Out Cookie Co, 106 School St #206, Spring Mills, PA 16875, United States
1. What we collect
When you browse. Device and usage information: browser type, IP address, approximate location from that IP, time zone, the pages and products you look at, what you search for, how long you stay, and the site or ad that sent you here. Collected automatically through cookies, pixels, and similar tags (see section 4).
When you order. Name, email, phone number, billing and shipping address, what you bought, the gift note you ask us to write, and payment details. Card numbers go straight to our payment processor over an encrypted connection. We never see or store your full card number.
When you subscribe to the Box. The same order details plus your box size, delivery schedule, flavor requests, and the payment method kept on file so we can bill and ship on the schedule you chose.
When you create an account. Email address and a login managed by Shopify. Your order history, addresses, and subscriptions attach to it.
When you write to us. Whatever you include in an email, the contact form, the wholesale or fundraiser application, the corporate gifting form, the flavor-swap request, or the accessibility feedback form. Business applications ask for your business name, address, and phone.
When you join the email list, the loyalty program, or a referral. Your email address, and for loyalty and referrals, your order history, points, the reward you earned, and who referred you.
When you leave a review. Your name as you enter it, your email, the review, and any photo you attach. Reviews are public.
When you buy or redeem a gift card. Your email, the recipient's name and email, and the gift message.
We do not ask for and do not want sensitive information such as government IDs, health information, or precise geolocation. If you send it to us anyway, we delete it.
2. Why we use it
To load the site and keep it working, take and ship your order, bill subscriptions on schedule, answer you, run the loyalty and referral programs you joined, show you reviews, prevent fraud and abuse, understand how the site is used, and, if you opted in, send you email or text about new flavors, events, and offers. Every marketing email has an unsubscribe link and every text accepts STOP.
3. Who receives it
We use these companies to run the store. Each one gets only what it needs for its job and is bound by its own privacy terms.
| Company | What it does for us | What it sees |
|---|---|---|
| Shopify (Shopify Inc., Canada/US) | Hosts the store, checkout, customer accounts, Shopify Subscriptions billing, Shop Pay, email notifications, and fraud analysis | Everything in section 1 that relates to an order or account. Shopify's policy: shopify.com/legal/privacy |
| Shopify Payments and Shop Pay | Process card payments and accelerated checkout | Payment and billing details. We see the last four digits and the card brand only |
| UPS, USPS, and FedEx | Deliver the box | Name, address, phone, and package weight |
| Yotpo | Collects and displays product reviews after you order | Name, email, order, and the review you write |
| Loloyal | Runs the rewards and referral program | Email, order history, points, referral links |
| Klaviyo | Sends our marketing email | Email, phone if given, what you browsed and bought, so we can send relevant messages |
| Meta (Facebook and Instagram) | Advertising and measuring our ads, through the Meta pixel | Browsing and purchase events tied to a cookie or a hashed email |
| Google (Google Tag Manager, Google Ads, and Google Analytics) | Site analytics and advertising measurement | Browsing and purchase events tied to a cookie |
| Advertising and measuring our Pinterest pins, through the Pinterest tag | Browsing and purchase events tied to a cookie | |
| hCaptcha (Intuition Machines) | Keeps bots off our forms | IP address, browser details, and how you interact with the challenge |
| Gift Card Hero | Sells and delivers digital gift cards | Buyer and recipient name, email, and message |
| Upsell Hero | Suggests add-ons in the cart | What is in your cart |
| Sami B2B Lock | Gates wholesale pricing to approved accounts | Your account login and tags |
| Puco and Mini Custom Fields | Page building and extra order fields such as gift notes and flavor choices | The fields you fill in |
| Convey (Convey Growth, our marketing agency) | Builds and maintains the site and runs our marketing | Site analytics, campaign data, and store data needed to do that work. Convey does not sell it and is bound to use it only for us |
If we add or remove a service, this table changes with it.
We also share information when the law requires it, to respond to a lawful request, to enforce our terms, or to protect people's safety or our rights. If the business is ever sold or merged, customer records go with it and this policy keeps applying until the new owner tells you otherwise.
We do not sell personal information for money. Sharing browsing and purchase data with the advertising partners above is something some laws call a "sale" or "sharing" or "targeted advertising." Section 6 tells you how to opt out of that.
4. Cookies, pixels, and consent
Cookies are small files your browser stores. Pixels and tags are small pieces of code that report what you do on a page. We use three kinds:
- Necessary. Checkout, cart, login, security, and fraud prevention. The site does not work without them, so they are always on.
- Analytics. How people use the site (which pages, how long, what breaks). Google Analytics through Google Tag Manager, and Shopify's own analytics.
- Advertising. Meta pixel, Google Ads tag, Pinterest tag. They let us show ads to people who visited, measure whether ads led to orders, and find people like our customers.
Where the law requires consent before analytics or advertising cookies run (the EU, UK, Switzerland, and any other region we enable in Shopify's consent tool), we show a banner and nothing but necessary cookies loads until you say yes. You can change your mind any time through the "Cookie preferences" link in the footer.
Everywhere else, you can opt out of advertising cookies through:
- the "Do not sell or share my personal information" link in the footer
- Meta: facebook.com/settings/?tab=ads
- Google: adssettings.google.com
- Pinterest: pinterest.com/settings/privacy
- The Digital Advertising Alliance: optout.aboutads.info
- Your browser's cookie settings (blocking all cookies will break checkout)
Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sale, sharing, and targeted advertising for that browser, in every region where that right applies.
Do Not Track. Browsers' older "Do Not Track" setting has no agreed meaning, so we do not act on it. GPC is the signal we honor.
The full list of cookies Shopify sets is at shopify.com/legal/cookies.
5. AI
We want to be plain about where software that could be called "AI" touches your information.
- Shopping assistants can read our public info. Our store is connected to Shopify's storefront tools that let approved AI shopping assistants (for example, the Shop app and other agents using Shopify's agentic commerce features) read our public product listings, prices, policies, and FAQ to answer a shopper's question or place an order that shopper asked for. They read the same public pages you can. They do not get your account or order history from us.
- We use AI tools to draft. We and our agency, Convey, use AI-assisted tools to help draft product descriptions, marketing copy, images, video, and replies to routine questions. A person reviews anything before it is published or sent to you.
- Fraud screening. Shopify's checkout runs automated fraud analysis on orders. A person at Inside Out Cookie makes the final call on any order that gets flagged. Nobody is refused by a machine alone.
- What we do not do. We do not run a chatbot on this site. If you email us, a person answers. We do not use your emails, notes, reviews, or order details to train AI models, and we do not ask our vendors to train their models on them for us.
- How to reach a human. info@insideoutcookie.com, any time, about anything on this site.
If we ever add an AI surface that talks to you directly (a chat assistant, an automated phone line), we will label it as AI, give you a way to reach a person from inside it, and update this section first.
6. Your rights and choices
Depending on where you live, you may have the right to:
- Know what personal information we hold about you and get a copy
- Correct it
- Delete it
- Opt out of sale, sharing, targeted advertising, and profiling
- Limit use of sensitive information (we do not collect any on purpose)
- Not be treated differently for exercising these rights
- Appeal if we turn down a request
State consumer privacy laws give some or all of these rights to residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, and Maryland, and more states pass similar laws every year. Residents of the EU, UK, and Switzerland have them too. We do not wait to see where you live: every request gets the same treatment.
To make a request: email info@insideoutcookie.com with "privacy request" in the subject, or write to the mailing address above. Tell us what you want (a copy, a correction, deletion, an opt-out) and the email address you used with us. We will confirm it is you by replying to that email or, for account holders, asking you to log in. We answer within 45 days (we may take another 45 if the request is complicated, and we will tell you). You can name someone to make the request for you; we will still confirm with you directly. If we say no, we will say why, and you can reply "appeal" to have a different person look at it. If you are still unhappy you can complain to your state attorney general or, in the EU or UK, your data protection authority.
Marketing opt-outs. Unsubscribe from email with the link at the bottom of any message. Reply STOP to any text. Both happen within 10 business days at most and usually right away. You will still get order and subscription emails, because those are part of the service you bought.
Delete your account. Log in and use the account deletion option, or email us and we will do it. We keep the records the law makes us keep (see section 7) and delete the rest.
Non-discrimination. We will not refuse you service, charge you a different price, or give you a lesser product because you exercised a privacy right. Loyalty and referral rewards are a voluntary program with their own terms; leaving it ends the rewards, not your right to shop.
7. How long we keep it
| Information | Kept for |
|---|---|
| Order and payment records | As long as tax, accounting, warranty, and fraud rules require, and no longer |
| Account information | Until you delete the account, or until it has been dormant long enough that keeping it serves no purpose |
| Subscription records | The life of the subscription, then the same window as order records |
| Marketing list | Until you unsubscribe or ask us to delete you |
| Support emails and form submissions | Long enough to answer follow-up questions about the same order, then deleted |
| Reviews | Until you ask us to remove them |
| Analytics and ad cookies | Per the vendor's default, generally 30 days to 2 years, and you can clear them any time |
Ask us at any time how long we are holding something of yours and we will tell you. When we delete something, it also gets deleted from the vendors above through their deletion tools or by request, except for records those vendors must keep by law.
8. Visitors outside the United States
We are in Pennsylvania and our data is processed in the United States by the vendors above. If you visit from the EU, UK, or Switzerland: our legal bases are performance of a contract (taking and shipping your order), your consent (marketing, non-essential cookies), our legal obligations (tax, fraud), and our legitimate interest in running, securing, and improving the store. Transfers to the US rely on our vendors' standard contractual clauses or their certification under the EU-US Data Privacy Framework. You have the rights in section 6 plus the right to withdraw consent and to complain to your local supervisory authority. We ship within the United States only, so most non-US visitors are browsing, not buying.
9. Kids
This site sells food to adults. We do not knowingly collect personal information from anyone under 16, and we do not market to children. If you think a child gave us their information, email us and we will delete it.
10. Security
Checkout and account pages run over an encrypted connection. Payment details are handled by Shopify Payments, which is PCI DSS Level 1 certified; card data never touches our own systems. We limit who at Inside Out Cookie and Convey can see customer records to the people who need them for orders, support, and marketing. No site is perfectly secure; if we learn of a breach affecting your information, we will notify you as the law requires.
11. Changes
When this policy changes, the effective date at the top changes with it, and if the change is material we will email account holders and subscribers before it takes effect.