1. Business Information

2. California Privacy Rights

Subject to applicable exceptions and verification requirements, California residents may have the following rights:

3. Categories of Personal Information

The following table describes categories of personal information we may have collected during the preceding 12 months, depending on how customers interacted with us.

4. Sources of Personal Information

We may collect personal information from:

• You when you place an order or contact us
• Your customer account and website interactions
• Shopify and authorized Shopify services
• Payment processors and financial institutions
• Shipping carriers and fulfillment providers
• Analytics, advertising, and marketing providers
• Fraud-prevention and security providers
• Social-media platforms when you interact with us
• Publicly available sources where legally permitted

5. Business and Commercial Purposes

We may use personal information to:

• Provide and operate our online store
• Process payments, orders, returns, and refunds
• Arrange shipping and order tracking
• Manage customer accounts
• Respond to questions and support requests
• Detect fraud, misuse, and security threats
• Maintain business and transaction records
• Improve products, services, and website performance
• Personalize content and product recommendations
• Send marketing when permitted
• Measure advertising effectiveness
• Comply with legal and regulatory obligations
• Protect customers, our business, and legal rights

6. Categories of Recipients

We may disclose personal information for legitimate business purposes to:

• Shopify and ecommerce infrastructure providers
• Payment processors and financial institutions
• Shipping carriers and fulfillment providers
• Security and fraud-prevention providers
• Website, hosting, and technical-support providers
• Analytics and advertising providers
• Email, messaging, and marketing providers
• Customer-service and review-platform providers
• Accountants, insurers, lawyers, and professional advisers
• Government agencies when legally required
• Business successors involved in a sale or reorganization

7. Sale and Sharing

Tales & Terrors does not sell personal information directly in exchange for money.

However, the use of certain advertising cookies, pixels, analytics technologies, or advertising partners may be considered “selling” or “sharing” under the CCPA, even when no money is exchanged for the information.

Categories that may be disclosed for qualifying targeted advertising include:

• Identifiers such as cookie, device, and online identifiers
• Internet or electronic activity
• Commercial and product-interest information
• Approximate location derived from an IP address
• Inferences about shopping interests

These categories may be disclosed to advertising, analytics, social-media, and marketing-platform providers.

8. Sensitive Personal Information

Sensitive personal information may include account credentials and payment information used to complete transactions and protect customer accounts.

Complete payment-card details are generally processed by Shopify and authorized payment processors rather than stored directly by Tales & Terrors.

We do not use sensitive personal information to infer characteristics about customers. We use it only for permitted purposes such as:

• Processing transactions
• Authenticating customer accounts
• Preventing fraud and security incidents
• Providing requested products and services
• Complying with legal obligations

If our practices change in a way that creates a right to limit under California law, we will provide an appropriate method for exercising that right.

9. Children Under 16

We do not knowingly sell or share the personal information of consumers under 16 years of age without the affirmative authorization required by California law.

If you believe a child has provided personal information without appropriate authorization, contact: support@talesandterrors.com .

10. Financial Incentives

We do not currently offer a financial incentive or price difference in exchange for the collection, sale, or sharing of personal information.

If we introduce a loyalty, rewards, discount, or promotional program that qualifies as a financial incentive under California law, we will provide the required notice before enrollment.

11. Global Privacy Control

Global Privacy Control, or GPC, is a browser-based preference signal that communicates a request to opt out of qualifying sales or sharing of personal information.

Where required and supported by our website technology, we process a recognized GPC signal as an opt-out request for the browser or device transmitting the signal.

Because the signal is generally browser- and device-specific, you may need to enable it separately on each browser and device you use.

12. Submitting a California Privacy Request

California residents may submit an access, correction, deletion, portability, limitation, or opt-out request using the following methods:

Include your full name, email address, state of residence, the type of request, and enough information for us to locate the relevant records.

13. Identity Verification

Before completing certain requests, we may need to verify that you are the person associated with the information.

Verification may require confirmation of your email address, order number, shipping details, customer-account information, or other information already associated with you.

We will not request more information than reasonably necessary to verify and process the request.

A request to opt out of sale or sharing will not be subjected to unnecessary verification. We may request information needed to identify the browser, device, or records associated with the request.

14. Authorized Agents

A California resident may authorize another person to submit a privacy request on their behalf.

We may require the authorized agent to provide proof of signed permission. We may also ask the consumer to verify their identity directly and confirm that the agent has permission to submit the request.

These additional steps may not apply when the agent holds a valid power of attorney under applicable California law.

15. Response Timing

We will acknowledge and respond to a verified California privacy request within the time required by applicable law.

If reasonably necessary, we may extend the response period as permitted by law. If an extension is needed, we will provide notice and explain the reason.

Privacy requests are generally processed without charge. We may charge a reasonable fee or decline a request if permitted by law because the request is manifestly unfounded, excessive, or repetitive.

16. Non-Discrimination

We will not unlawfully discriminate or retaliate against a California resident for exercising a CCPA right.

We will not unlawfully:

• Deny products or services
• Charge different prices or rates
• Provide a different quality of service
• Suggest that the customer will receive different treatment

Differences that are reasonably related to the value of personal information or otherwise permitted by law are not prohibited.

17. Data Retention

We retain personal information only for as long as reasonably necessary for the disclosed purposes, including:

• Processing and documenting transactions
• Providing customer service
• Managing returns and refunds
• Preventing fraud and security incidents
• Maintaining tax and accounting records
• Resolving disputes
• Complying with legal obligations

Retention periods vary according to the information involved, the business purpose, legal requirements, and whether the information is needed to protect our customers or business.

18. Changes to This Notice

We may update this California Privacy Rights notice to reflect changes in our practices, services, technology, or legal requirements.

The updated notice will be published on this page with a revised “Last updated” date.

19. Contact Us

For questions about this notice or your California privacy rights, contact: