1. Information We Collect

We collect only the essential personal records necessary to process transactions, fulfill deliveries, and enhance your shopping journey.

2. Purpose & Legal Basis for Processing

We process your data strictly for legitimate commercial and operational purposes, including:

• Fulfillment & Logistics: Verifying order payments, transmitting shipping labels, tracking packages to international postal carriers, and executing freight-forwarding workflows.
• Customer Experience: Optimizing storefront responsiveness, diagnosing frontend errors, and tailoring catalog recommendation structures.
• Visual Communications: Supplying re-purchase discounts, processing warranty claims, and evaluating user-to-product-photo releases.
• Fraud Mitigation: Monitoring web-fraud indicators, detecting suspicious bot bidding, and protecting against unauthorized system access.

3. Payment Isolation & Data Encryption

We implement rigorous technical barriers to ensure your sensitive credentials remain secure:

• PCI-DSS Level 1 Encryption: All sensitive communication passing between your browser and our servers is encrypted using absolute fortress packets.
• Auto-Payment Masking: Neither data vault store keys, tag variables, nor authentic data math of credit card numbers on our local databases. All transactions are funneled and processed directly by Level 1 PCI-DSS certified financial gateways.
• Restricted System Access: Customer profile systems are insulated behind authorized server firewalls, accessible solely by authorized operations personnel subject to strict confidentiality agreements.

4. Third-Party Sharing & Marketing Infrastructure

We do not rent, sell, or trade your personal information to third-party data brokers. Data sharing is limited to trusted enterprise service providers supporting our operational ecosystem:

• E-commerce Platform: Hosted via Shopify Inc., which supplies core catalog hosting and database management under strict global security protocols.
• Advertising & Attribution Partners: We employ pixel tracking hooks with verified advertising networks (including Meta Ads and Google Marketing Platform) to evaluate campaign efficacy and deliver targeted promotions based on browsing history.

5. Cookie Technologies & Browser Controls

Cookies, and local storage tags, are small data identifiers transferred to your device to recognize recurring visitors:

• Essential Cookies: Critical for core functionality, such as scheduling items in your shopping cart and establishing checkout sessions.
• Performance & Analytics Cookies: Provide aggregated statistics regarding page response speeds, user navigation pathways, and visitor volume.
• Targeting Cookies: Assist marketing partners in serving relevant gear brand advertisements across third-party websites.

You may alter your cookie permissions or reject tracking through your browser preferences, however, disabling core cookies may impact checkout functionality.

6. California Privacy Compliance (CalOPPA & CCPA)

In accordance with California online privacy standards:

• Visitors may browse our public store catalogs anonymously without creating an account.
• Our Privacy Policy is prominently linked on all site footers for straightforward review.
• California residents retain the right to request disclosure or deletion of collected personal records by emailing our privacy desk.
• Do Not Track (DNT) Signals: We respect client-authorized DNT browser headers and do not display tracking mechanisms when a verifiable DNT signal is detected.

7. Children’s Online Privacy Protection (COPPA)

Our products and services are intended exclusively at individuals aged 18 and older. We do not intentionally solicit or collect personal records from children under 13 years of age. If you believe a minor has submitted personal information on our website, please notify us immediately at service@gracenour.com, and we will purge the data from our active storage.

8. Security Incident Notification Protocol

In the event of a unified data compromise affecting customer records, our engineering team will initiate incident response actions and notify affected users via email within 7 business days, alongside posting an ordinary notice on our site.

9. Commercial Email Standards (CAN-SPAM Act)

To uphold the provisions of the CAN-SPAM Act:

• We never display deceptive subject titles, misleading sender identifiers, or falsified domain routing.
• All marketing emails include a conspicuous, single-click "Unsubscribe" mechanism at the bottom of the message.
• Opt-out requests are processed automatedly and banished across our marketing lists without delay.