Privacy Policy

Niiroo (“Niiroo,” “we,” or “our”) respects your privacy. This Privacy Policy describes how we collect, use, disclose, and protect personal information about visitors and customers of niiroo.com (the “Site”).

By using the Site, you agree to the practices described in this Privacy Policy.

---

1. Information We Collect

We collect the following categories of personal information:

• Contact data: Name, email address, shipping and billing address, and phone number.
• Order and payment data: Items purchased, order history, and billing details. Payment card information is processed directly by our payment processors and is not stored on our servers.
• Account data: Login credentials and account details.
• Usage data: IP address, browser type, device identifiers, pages viewed, referral sources, and interactions with our emails and advertisements.
• Communications: Messages you send to customer support and responses to surveys.

We do not knowingly collect Sensitive Personal Information as defined under the California Privacy Rights Act (“CPRA”), including Social Security numbers, driver’s license numbers, financial account credentials, precise geolocation, health or genetic data, or biometric identifiers.

---

2. CCPA/CPRA Categories Collected — California Residents

During the past 12 months, Niiroo has collected the following categories of personal information under California Civil Code § 1798.140:

---

3. How We Use Your Information

We may use your personal information to:

• Process orders, payments, refunds, and shipping;
• Create and manage your account;
• Provide customer support and respond to inquiries;
• Send transactional communications, including order confirmations, shipping updates, and billing notices;
• Send marketing communications where permitted by law and with the option to opt out;
• Prevent fraud, abuse, and security incidents;
• Improve the Site, our products, and the customer experience; and
• Comply with applicable legal obligations.

---

4. How We Share Your Information

We do not sell personal information in exchange for monetary consideration. We may share personal information with the following categories of recipients:

• Service providers: Companies that help us operate our business, including payment processors, shipping carriers, email service providers, customer relationship management providers, analytics providers, hosting providers, and Shopify, which hosts the Site.
• Advertising partners: Partners such as Meta, Google, and TikTok that use cookies, pixels, and similar technologies to measure advertising performance and display relevant advertisements. Under California law, this activity may be considered a “sale” or “sharing” of personal information. You may opt out as described in Section 6.
• Legal and safety authorities: Government authorities, courts, regulators, or other parties when required by law, court order, or when reasonably necessary to protect our rights, property, users, or the public.
• Business transfer recipients: Parties involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar business transaction.

---

5. Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies for the following purposes:

• Essential functions: Enabling the shopping cart, checkout process, account login, and other core Site features.
• Analytics: Understanding how visitors use the Site through services such as Google Analytics and Shopify Analytics.
• Advertising: Displaying relevant advertisements and measuring advertising campaigns through services such as Meta Pixel, Google Ads, and TikTok Pixel.

You may control or disable cookies through your browser settings. Disabling non-essential cookies will not affect the Site’s core shopping functions, although certain features may not function as intended.

---

6. Your Privacy Rights

California Residents — CCPA/CPRA

California residents may have the right to:

• Know: Request information about the personal information we collect, use, disclose, sell, or share.
• Delete: Request deletion of personal information we hold about you, subject to applicable legal exceptions.
• Correct: Request correction of inaccurate personal information.
• Opt out: Opt out of the sale or sharing of personal information for cross-context behavioral advertising.
• Limit the use of Sensitive Personal Information: We do not knowingly process Sensitive Personal Information for purposes that require offering this right.
• Non-discrimination: We will not deny services, charge different prices, or provide a different level of service because you exercised your privacy rights.

To exercise your California privacy rights, email hello@niiroo.com with the subject line “Privacy Request — California” and include enough information for us to verify your identity.

We will respond to verified requests within 45 days, as required by applicable law.

Global Privacy Control — GPC

Niiroo honors the Global Privacy Control (“GPC”) browser signal as a valid request to opt out of the sale or sharing of personal information under California law.

When we detect a GPC signal, we treat it as an opt-out request for the browser or device from which the signal is received.

Texas Residents — TDPSA

Under the Texas Data Privacy and Security Act, Texas residents may have the right to:

• Access personal data we process about them;
• Correct inaccuracies in their personal data;
• Delete personal data;
• Obtain a portable copy of personal data; and
• Opt out of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects.

Appeal process: If we decline your request, you may appeal our decision by replying to the decision email within 60 days. We will respond to an appeal within 60 days. If your appeal is denied, you may contact the Texas Attorney General.

Residents of Other US States

If your state provides similar privacy rights, including Colorado, Virginia, Connecticut, or Utah, you may contact us using the information below. We will process applicable requests in accordance with the laws of your state.

European Union, United Kingdom, Switzerland, and Other International Residents

If you are located in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction with comprehensive data protection laws, you may have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your data, subject to applicable legal retention requirements;
• Restrict or object to certain processing activities;
• Receive a copy of your data in a structured, commonly used, and machine-readable format;
• Withdraw consent for processing based on consent at any time; and
• Lodge a complaint with your local data protection authority.

Legal Bases for Processing

Where applicable, we rely on the following legal bases to process personal data:

• Performance of a contract: Processing necessary for order fulfillment and account management.
• Compliance with legal obligations: Processing necessary to comply with tax, accounting, consumer protection, and other legal requirements.
• Legitimate interests: Processing for fraud prevention, security, service improvement, and business operations.
• Consent: Processing for marketing communications, non-essential cookies, and other activities where consent is required.

To exercise your GDPR or UK GDPR rights, email hello@niiroo.com with the subject line “Privacy Request — GDPR” and include enough information for us to verify your identity.

We will respond to applicable requests within 30 days, subject to any extensions permitted by law.

International Data Transfers

Because Niiroo operates and stores data primarily in the United States, your personal data may be transferred to and processed in countries outside your country of residence.

Where required, we rely on Standard Contractual Clauses, commonly known as SCCs, or equivalent safeguards to protect personal data transferred across international borders.

---

7. Data Retention

We retain personal information for as long as reasonably necessary to provide our services, complete transactions, comply with legal obligations, resolve disputes, prevent fraud, and enforce our agreements.

Account and transaction records are generally retained for up to seven years for tax, accounting, audit, and legal compliance purposes.

---

8. Security

We use commercially reasonable administrative, technical, and organizational safeguards designed to protect personal information.

However, no method of transmission over the internet or electronic storage system is completely secure. Therefore, we cannot guarantee the absolute security of your information.

---

9. Children’s Privacy

The Site is not directed to children under 13 years of age, or under 16 years of age in jurisdictions where a higher minimum age applies.

We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child without appropriate authorization, we will take reasonable steps to delete it.

---

10. International Visitors

Niiroo operates and stores data in the United States. If you access the Site from outside the United States, your information may be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in your jurisdiction.

Please refer to Section 6 for information regarding GDPR, UK GDPR, and other international privacy rights.

---

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations.

When we update this Privacy Policy, the “Effective Date” displayed at the top of this page will reflect the date of the latest revision. Your continued use of the Site after an updated Privacy Policy becomes effective constitutes acknowledgment of the revised policy.

---

12. Contact Us

If you have questions about this Privacy Policy or would like to exercise a privacy right, please contact us: