Privacy policy

Effective Date: October 7, 2026

This Privacy Policy explains how cuddle and kind Inc., together with its subsidiaries and affiliates ("cuddle+kind," "we," "us," or "our"), collects, uses, discloses, and protects personal information when you visit cuddleandkind.com and ca.cuddleandkind.com (the "Website"), make a purchase, sign up for our emails or text messages, or otherwise interact with us.

Personal information means information that identifies, relates to, or could reasonably be linked to you or your household. It does not include information that has been de-identified or aggregated so that it can no longer reasonably identify you.

We may update this Privacy Policy from time to time. When we do, we will change the Effective Date above and, where required by law, notify you or ask for your consent.

Information We Collect

We collect the following categories of personal information. In the past 12 months, we have collected each category listed below.

Sensitive personal information. We do not knowingly collect sensitive personal information, such as information about race, ethnicity, religious beliefs, or health. If we begin collecting sensitive personal information, we will update this Privacy Policy and obtain your consent where required by law.

Purchases through third parties. If you buy our products through another retailer or platform, that retailer's privacy policy governs the information they collect, and we may not receive it.

How We Use Your Information

We use personal information for the purposes below. Where the EU or UK General Data Protection Regulation (GDPR) applies, the legal basis for each purpose is shown in the table.

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that occurred before you withdrew it.

We do not use your personal information to make automated decisions that produce legal or similarly significant effects about you.

How We Share Your Personal Information

We share personal information with the categories of recipients below.

• Service providers that operate on our behalf, including website hosting and e-commerce (Shopify), payment processing, shipping carriers (such as UPS, USPS, DHL, and Canada Post), customer service (Zendesk), email and text messaging (Klaviyo, Attentive), reviews (Yotpo), analytics (Google Analytics, Microsoft Clarity), data and tag management (Google Tag Manager, Elevar), and fraud prevention and security.

• Advertising and marketing partners that help us show ads, measure ad performance, and reach people likely to be interested in our products. These include Meta (Facebook and Instagram), Google Ads, Microsoft Advertising, Privy [confirm], Wunderkind [confirm], and affiliate partners (Impact [confirm]).

• Advertising platforms receiving contact information. We may share hashed (encoded) email addresses or phone numbers with advertising platforms to show relevant ads to you or to people with similar interests, measure ad performance, and exclude existing customers from certain ads.

• Visitor identification partners. We work with partners, including Retention.com and Customers.AI, that help us identify visitors to our Website. We may make identifiers available to these partners, such as IP addresses, cookie identifiers, and device information, which they may match with information they hold, such as a hashed email address. We use the results to send marketing emails to visitors, including visitors who have not given us their email address directly. We send these emails only to visitors in the United States. You can opt out as described in Your Privacy Choices, and you can unsubscribe from any marketing email using the link it contains.

• Government, law enforcement, and legal process. We may disclose personal information when required by law, in response to a valid legal request, or to protect the rights, property, or safety of cuddle+kind, our customers, or others.

• Business transfers. If cuddle+kind is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this Privacy Policy.

A current list of the cookies and third-party technologies on our Website is available through the Cookie Policy link in the footer of our Website.

Sale and sharing of personal information. We do not sell personal information for money. We do share personal information, including identifiers, device information, and internet activity, with advertising partners for targeted advertising. Under certain U.S. state privacy laws, including the California Consumer Privacy Act, this may be considered a "sale" or "sharing" of personal information. We have done so in the past 12 months. You can opt out as described in Your Privacy Choices below.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

We may share aggregated or de-identified information that cannot reasonably be used to identify you.

Cookies and Tracking Technologies

We use cookies, pixels, web beacons, tags, session recording tools, and similar technologies on our Website and in our emails. They fall into these categories:

• Strictly necessary: required for the Website to work, such as keeping items in your cart, securing checkout, and remembering your privacy choices. These are always on.

• Analytics: help us understand how visitors use the Website and improve it, for example Google Analytics and Microsoft Clarity. Clarity may record how you move through and interact with our pages.

• Advertising and marketing: used by us and our partners to show you relevant ads on other websites and platforms, measure ad performance, identify visitors so we can send them marketing emails, and send reminders such as abandoned-cart emails and texts. These technologies may collect your IP address, device and browser information, pages viewed, products added to cart, and ads you interact with. Our advertising partners may also use this information to recognize you across the different browsers and devices you use.

Some third parties that place cookies, pixels, or similar technologies on our Website, including Meta, Google, Microsoft, and our visitor identification partners, control the information they collect and may use it for their own purposes, such as providing, improving, and developing their services (including their automated and AI technologies), measurement, targeted advertising, and fraud prevention. To learn more, see their privacy policies, for example: Meta, Google, and Microsoft.

Consent banner. Visitors in California, Florida, the European Union, and Quebec are presented with a consent banner. In these regions, we do not use analytics or advertising technologies unless you accept them.

Opt-out everywhere else. Visitors in other locations can turn off analytics and advertising technologies at any time through the Cookie Policy link, and can opt out of the sale or sharing of their personal information through the Do Not Sell or Share link, both in the footer of our Website.

You can also block or delete cookies through your browser or device settings. Blocking strictly necessary cookies may prevent parts of the Website, such as checkout, from working.

A current list of the cookies and technologies we use, their purposes, and how long they last is available through the Cookie Policy link.

Your Privacy Choices

Withdraw consent or opt out. If you are in a region where we ask for your consent, you can withdraw it at any time. If you are in a region where we offer an opt-out, you can opt out of the sale or sharing of your personal information and targeted advertising at any time. You can manage cookie consent through the Cookie Policy link and opt out of the sale or sharing of your personal information through the Do Not Sell or Share link, both in the footer of our Website.

Opt out of sharing that cookie settings do not cover. Sharing hashed contact information with advertising platforms, and information our visitor identification partners already hold, may not be fully controlled by cookie settings. To opt out of this sharing and of visitor identification, submit a request through our Data Subject Request form (also linked in the footer of our Website) or email hello@cuddleandkind.com.

Global Privacy Control (GPC). We honor Global Privacy Control signals. When we detect a GPC signal from your browser, we treat it as a request to opt out of the sale or sharing of your personal information and targeted advertising for that browser. If you are logged in to your account, we will also apply your request to your account where required by applicable law.

Choices are browser-specific. Choices made through the Cookie Policy or Do Not Sell or Share links, or through GPC, apply to the browser and device you use. If you clear your cookies or use a different browser or device, you will need to make your choices again.

Do Not Track. Some browsers send a "Do Not Track" (DNT) signal. Because there is no accepted standard for responding to DNT, our Website does not change its practices in response to it. You can manage your choices through the Cookie Policy or Do Not Sell or Share links, or by enabling GPC.

Marketing emails. You can unsubscribe at any time using the link in any marketing email. We may still send you messages about your orders and account.

We will not discriminate against you for exercising any of your privacy rights.

Text Messaging

If you opt in to text messages, we use your phone number to send recurring automated marketing messages, order notifications, abandoned cart reminders, and review requests. Message frequency varies. Message and data rates may apply. Consent is not a condition of purchase.

We use a cookie to identify when you leave items in your cart and to check whether you have opted in to text messages, so we can send cart reminders.

You can opt out at any time by replying STOP to any message. Reply HELP for help.

Text messaging opt-in data and consent will not be shared with any third parties, except our messaging service providers for the purpose of operating our text messaging program.

Your Rights

Depending on where you live, you may have the following rights regarding your personal information:

• Access: know what personal information we have collected about you, how we use it, and who we share it with, and receive a copy.

• Correction: correct inaccurate personal information.

• Deletion: ask us to delete your personal information.

• Portability: receive your personal information in a portable format.

• Opt out: opt out of the sale or sharing of your personal information and of targeted advertising.

• Withdraw consent: withdraw consent you have given us at any time.

• Object or restrict: object to or ask us to restrict certain processing.

• Complain: lodge a complaint with your local data protection authority.

How to submit a request. Submit a request through our Data Subject Request form, email hello@cuddleandkind.com with "Privacy Request" in the subject line, or call 855-781-8778.

Verification. To protect your information, we will verify your identity before fulfilling access, correction, or deletion requests, usually by matching information you provide with information we have on file. Opt-out requests do not require verification.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require proof of the agent's authority and may ask you to verify your identity directly.

Appeals. If we deny your request, you may appeal by emailing hello@cuddleandkind.com with "Privacy Request Appeal" in the subject line. We will respond within the time required by law. If you are not satisfied with our response, you may contact your state Attorney General.

We may decline or limit a request where permitted by law, such as when we need to keep information to complete a transaction or meet a legal obligation. We will explain the reason.

Data Retention

We keep personal information only as long as needed for the purposes in this Privacy Policy, including to meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements.

When we no longer need personal information, we securely delete or de-identify it.

Security

We use administrative, technical, and physical safeguards to protect personal information, including encryption of data in transit using TLS. Payments are processed by Shopify and our payment processors, which comply with the Payment Card Industry Data Security Standard (PCI DSS). No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

International Transfers

We are based in North America, and our service providers may process personal information in the United States, Canada, and other countries. These countries may have different data protection laws from where you live. Where required, we use appropriate safeguards for transfers, such as the European Commission's Standard Contractual Clauses.

Children's Privacy

Our Website is intended for adults and is not directed to children. We do not knowingly collect personal information from children under 13, or under the age of digital consent in your country. If you believe a child has given us personal information, contact us and we will delete it.

Third-Party Websites

Our Website may link to third-party websites and services. Their privacy practices are governed by their own policies, not this one.

Contact Us

For questions about this Privacy Policy or to exercise your rights, contact our person responsible for the protection of personal information:

Privacy Officer (Person in Charge of the Protection of Personal Information) cuddle and kind Inc., Attention: Legal – Privacy 200 Continental Drive, Suite 401 Newark, Delaware 19713, USA Email: hello@cuddleandkind.com Phone: 855-781-8778

Please include "Privacy Request" in the subject line so we can route your request promptly.

European Union. Our lead supervisory authority in the European Union is the Irish Data Protection Commission: Canal House, Station Road, Portarlington, Co. Laois, R32 AP23, Ireland; phone +353 57 868 4757; email info@dataprotection.ie. You may also lodge a complaint with the data protection authority in the EU country where you live or work, or where you believe an infringement occurred. A list of national authorities is available from the European Data Protection Board at edpb.europa.eu.

United Kingdom and Quebec. If you are in the United Kingdom, you may lodge a complaint with the Information Commissioner's Office. If you are in Quebec, you may lodge a complaint with the Commission d'accès à l'information du Québec.

---