Last updated: September 2026 Stone & Moss (“Stone & Moss,” “we,” “us,” or “our”) operates the online store located at stoneandmossus.com. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our website, make a purchase, contact us, create an account, or otherwise interact with our services. Business Information For purposes of applicable privacy laws, the business responsible for your personal information is: Email: contact@stoneandmossus.com Instagram: @thestoneandmoss Website: stoneandmossus.com Personal Information We Collect The information we collect depends on how you interact with our website and services. Information You Provide We may collect information you provide directly, including: Name Email address Telephone number Billing and shipping addresses Account login details Order and transaction information Product preferences and selected sizes Marketing preferences Customer-support messages Reviews, photographs, or other content you submit Any other information you choose to provide Payment Information Payments are processed by Shopify and other authorized payment providers. Payment providers may collect payment-card details, billing information, and other information needed to authorize the transaction. Stone & Moss does not necessarily receive or store complete payment-card numbers. Payment providers process this information under their own terms and privacy policies. Information Collected Automatically When you visit or use our website, we and our service providers may automatically collect: IP address Browser and device type Operating system Device identifiers Referring and exit pages Pages and products viewed Search terms Cart and checkout activity Dates and times of visits Approximate location derived from an IP address Interactions with emails and advertisements Cookie, pixel, and similar technology data Information From Other Sources We may receive personal information from: Shopify Payment processors Shipping and fulfillment providers Fraud-prevention services Analytics providers Advertising and social-media platforms Customer-support applications Other service providers used to operate our business How We Use Personal Information We may use personal information to: Process and fulfill orders Process payments and refunds Arrange shipping and delivery Provide order confirmations and tracking information Manage returns and exchanges Create and manage customer accounts Respond to questions and support requests Detect and prevent fraud, abuse, and security incidents Maintain and improve our website and services Understand website usage and shopping behavior Personalize website content and product recommendations Measure the effectiveness of advertising campaigns Send promotional emails or messages when permitted Comply with legal, tax, accounting, and regulatory obligations Enforce our Terms of Service and other policies Protect our customers, business, and legal rights Legal Bases for Processing Where laws such as the GDPR or UK GDPR apply, we process personal information under one or more of the following legal bases: Contract: Processing is necessary to accept, fulfill, and manage your order. Consent: You have consented to marketing, non-essential cookies, or another specific use. Legitimate interests: Processing is necessary to operate, secure, improve, and understand our business, provided those interests do not override your rights. Legal obligations: Processing is required to comply with tax, accounting, consumer-protection, or other legal requirements. Legal claims and safety: Processing is necessary to establish or defend legal claims or protect individuals and property. You may withdraw consent at any time. Withdrawal does not affect processing that occurred before consent was withdrawn. Shopify Our store is hosted by Shopify, which processes personal information to provide its ecommerce platform and related services. Depending on the Shopify services you use, Shopify may process information to provide checkout, payment, account, fraud-prevention, analytics, personalization, or advertising features. Learn more in the Shopify Consumer Privacy Policy. Cookies and Tracking Technologies We and our service providers may use cookies, pixels, tags, local storage, and similar technologies. These technologies may be used to: Keep the website functioning Remember your preferences Maintain your shopping cart Enable checkout and account features Measure traffic and website performance Detect fraud and security threats Personalize content Measure and deliver advertising Cookies may be classified as: Essential cookies: Required for the website and checkout to function. Functional cookies: Remember preferences and optional features. Analytics cookies: Help us understand how visitors use the website. Advertising cookies: Measure campaigns and support personalized or targeted advertising. Where required by law, non-essential cookies will be used only after you provide consent. You can manage cookies through our cookie banner, available privacy controls, or your browser settings. Blocking some cookies may affect website functionality. Advertising and Data Sharing We may use advertising, analytics, or social-media services to measure campaigns and present relevant advertisements. These providers may collect or receive information about your browser, device, website activity, purchases, or interactions with advertisements. We do not sell personal information in exchange for money. However, using certain advertising and analytics technologies may be considered a “sale,” “sharing,” or processing for targeted advertising under some privacy laws. Where applicable, you may opt out through: Our [Your Privacy Choices / Do Not Sell or Share My Personal Information] page: [Insert link] The cookie settings available on our website A recognized browser-based opt-out signal, such as Global Privacy Control The advertising settings provided by the relevant platform How We Disclose Personal Information We may disclose personal information to the following categories of recipients: Shopify and ecommerce-platform providers Payment processors and financial institutions Shipping carriers and fulfillment providers Fraud-prevention and security providers Website-hosting and information-technology providers Analytics and advertising providers Email, SMS, and customer-support providers Accountants, attorneys, insurers, and professional advisers Government authorities when legally required Parties involved in a merger, sale, financing, reorganization, or transfer of the business We require service providers to use personal information only for authorized purposes and in accordance with applicable agreements and laws. International Data Transfers Because we operate an online store and use global service providers, personal information may be processed outside your state, province, or country. These locations may have different privacy laws from those in your jurisdiction. Where required, we use recognized legal safeguards for international transfers. Data Retention We retain personal information only for as long as reasonably necessary for the purposes described in this Policy. Retention periods may depend on: The length of our relationship with you Order fulfillment and customer support needs Tax, accounting, and recordkeeping obligations Fraud prevention and security requirements Applicable limitation periods Ongoing disputes or legal claims Your consent and marketing preferences When information is no longer required, we may delete, anonymize, or securely isolate it, subject to applicable law and technical limitations. Your Privacy Rights Depending on where you live, you may have the right to: Request access to your personal information Request correction of inaccurate information Request deletion of personal information Receive a portable copy of certain information Restrict or object to certain processing Withdraw consent Opt out of marketing communications Opt out of the sale or sharing of personal information Opt out of targeted advertising Limit certain uses of sensitive personal information Appeal the denial of a privacy request Exercise your rights without discrimination These rights are subject to legal exceptions and may not apply in every jurisdiction. California residents may have rights including access, correction, deletion, opt-out, limitation, and non-discrimination under applicable law. California Attorney General’s CCPA guidance Individuals in the EEA, United Kingdom, or Switzerland may also have rights to object, restrict processing, withdraw consent, and lodge a complaint with a competent data-protection authority. European Commission’s GDPR rights overview Exercising Your Rights To submit a privacy request, contact: Email: contact@stoneandmossus.com Please include: Your full name The email address associated with your order or account The right you wish to exercise Any information reasonably needed to locate your records We may need to verify your identity before completing a request. Authorized agents may submit requests when permitted by law, but we may require proof of authorization. We will respond within the timeframe required by applicable law. Marketing Communications You may unsubscribe from promotional emails by using the unsubscribe link included in the message or by contacting us. Even if you unsubscribe from marketing, we may still send non-promotional communications related to orders, accounts, security, policy updates, or customer-support requests. Security We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. However, no method of transmission or storage is completely secure. We cannot guarantee absolute security. If you believe your information has been compromised, contact us immediately. Children’s Privacy Our website and services are not directed to children under 13 or the minimum age required by applicable local law. We do not knowingly collect personal information from children in violation of applicable law. If you believe a child has provided personal information to us, contact us so we can review and delete it when required. Third-Party Websites Our website may contain links to third-party websites or services. We do not control and are not responsible for the privacy, security, or content practices of those third parties. Review their privacy policies before providing personal information. Changes to This Privacy Policy We may update this Privacy Policy to reflect changes to our business, services, technology, or legal obligations. The revised version will be posted on this page with an updated “Last updated” date. When required, we will provide additional notice or request renewed consent. Contact Us For questions, concerns, complaints, or privacy requests, contact: Stone & Moss Email: contact@stoneandmossus.com Instagram: @thestoneandmoss
