Privacy policy

In this Policy, “personal information” means information that identifies, relates to, describes or is reasonably capable of being associated with a particular individual or household, and does not include information that has been deidentified or aggregated such that it can no longer reasonably be linked to an individual; “service providers” means third parties that process personal information on our behalf and in accordance with our instructions; and “you” and “your” refer to any individual who accesses or uses the Services.

2.1 Information You Provide to Us

Account information

Your name, email address and, if you elect to provide one, your telephone number. Any password you create is held by our authentication service provider and is not accessible to us.

Order information

The name, email address, telephone number, shipping address and billing address associated with an order; the products purchased and the amounts paid; any discount code or promotional prize applied; any gift message and sender name; and any note submitted with the order.

Payment information

Payment card and digital wallet details are submitted directly to our third-party payment processor. We receive only limited information, such as the card brand, the last four digits of the card number, the expiration date, the billing name and address, and the status of the transaction. We do not receive or store full payment card numbers or card security codes.

Saved payment methods

If you elect to save a payment method, it is stored by our payment processor in association with your account, and we have access only to the limited information described above.

Support, return and exchange requests

The content of your communications, their subject matter and the orders to which they relate, any photographs you upload, and the reasons and notes you provide.

Reviews

Your rating, the content of your review, any photographs and the display name you select.

Email sign-ups and promotions

Your email address, the location on the Services at which you signed up, and any promotional prize awarded to you, together with its code.

Puff Club and wishlist information

The products you have purchased, your membership level and member number, and the items you have saved to your wishlist.

In-person purchases

If you purchase from us in person, such as at an event, the first name you elect to give us, the city and state in which the purchase was made, the products purchased and the date and time of the purchase.

2.2 Information Collected Automatically

Usage information

The pages you view, the features with which you interact, your search queries, the referring page or link, and your browser type, device type and screen size. Our analytics service providers also receive your Internet Protocol (IP) address and derive from it an approximate geographic location (country, region and city). We do not request access to your device's precise geolocation.

Session recordings

Our analytics service providers may record your interactions with the Services, including page navigation, scrolling, taps and clicks, so that we may identify errors and improve usability. Information entered into form fields is masked, payment fields are excluded from recording, and the text displayed on account, order, checkout and support pages is concealed. Recordings are retained for a limited period and then deleted.

Diagnostic information

When an error occurs, technical information regarding the error, the page on which it occurred and the browser in use is transmitted to our error-monitoring service provider. If you are signed in, this information may include your account identifier. Diagnostic reports generated in your browser exclude cookies and information entered into forms.

Visit measurement

We store a randomly generated identifier in your browser to count visits and to display aggregate activity on the Services, such as the number of individuals currently viewing a product. This measurement does not use cookies and does not record your IP address or name.

Visit source

We record in your browser the link, advertisement or website through which you arrived at the Services, including any campaign labels and advertising click identifier that link carried, and attach that record to any order you place, so that we may measure which of our links and advertisements lead to purchases.

Advertising information

When we advertise on social media platforms or other online advertising services, technologies provided by those advertising partners and placed on the Services, such as pixels and cookies, collect information regarding your visit, including the pages and products you view, the searches you make, the products you add to your cart or wishlist, the initiation of checkout, your joining of our email list, identifiers stored in your browser, your browser and device information and your IP address. When you place an order, our servers also transmit to those advertising partners the products purchased, the order number and the order value, together with your email address, telephone number, city, state and ZIP code in hashed form (an irreversible code that the partner can compare against information it already holds), your account identifier in hashed form, your browser information and the identifiers their technologies stored in your browser. We do not transmit your name, street address, gift messages, support communications or payment information to advertising partners. You may opt out as described in Section 7.

Security information

Our authentication service provider records the device, browser, IP address and approximate location associated with each sign-in in order to protect your account.

Fraud prevention information

On checkout and payment pages, our payment processor collects information regarding your device and network connection in order to detect and prevent fraud.

Where you are signed in, or where you place an order or sign up using your email address, the information described in this Section 2.2 may be associated with your account or email address.

2.3 Information We Receive from Third Parties

Third-party sign-in

If you elect to sign in using a third-party account, such as a Google or Apple account, we receive your name, email address and an account identifier from that provider, as further described in Section 2.4. If you use Apple's “Hide My Email” feature, we receive a relay email address in place of your personal email address.

Payment and shipping partners

Our payment processor informs us whether a payment was completed, refunded or disputed. Shipping carriers and our shipping service providers inform us of the location and delivery status of parcels.

Our prior online store

If you made a purchase from our prior online store in 2023 or 2024, we transferred your order history and contact information to the Services and established an account for you under the same email address. Payment methods you saved with that store remain held by our payment processor and may be presented at checkout when you sign in.

2.4 Signing In with Google

If you elect to sign in with Google, Google shares your name, email address, profile picture and Google account identifier with us through the standard “openid,” “email” and “profile” permissions. We do not request access to any other Google data, including your contacts, Gmail, Google Drive or calendar. Our authentication service provider receives this information from Google on our behalf. We use this information solely to create your Nimmies account and to sign you in: your email address becomes your account email address and is used as described in this Policy, and your profile picture may be displayed in your account menu. We do not sell Google user data, use it for advertising, or use it to develop, improve or train artificial intelligence or machine learning models. You may revoke our access at any time from your Google account at myaccount.google.com/connections; your Nimmies account will remain in place until you delete it. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.5 Biometric Information

When you sign in using Face ID, Touch ID, Windows Hello or a fingerprint reader, the verification is performed entirely on your device. Neither we nor our service providers receive, collect, capture, store or use your facial geometry, fingerprints or any other biometric identifier or biometric information, including as those terms are defined in the Illinois Biometric Information Privacy Act. Only a passkey, being a cryptographic credential confirming that your device approved the sign-in, is stored.

We use personal information for the following purposes:

• to process, fulfill, ship and track your orders and to send communications relating to them;
• to create and administer your account, including authentication, saved addresses, saved payment methods and order history;
• to process cancellations, returns, exchanges, refunds and support requests;
• to operate the Puff Club, including recording your purchases, determining your membership level, providing early access to product releases and notifying you of them;
• to send drop alerts and other marketing communications where you have elected to receive them;
• to display reviews and pop-up notifications on the Services, as described in Section 4;
• to calculate and collect applicable taxes;
• to detect, prevent and respond to fraud, unauthorized use of payment cards and other abuse, and to protect the security of the Services and your account;
• to analyze use of the Services, diagnose technical problems and improve the Services;
• to measure the effectiveness of our advertising, and to display our advertising to you and to individuals who may share your interests on the services of our advertising partners, as described in Section 5.4; and
• to maintain tax and accounting records, resolve chargebacks and disputes, enforce our Terms of Service and comply with applicable law.

Reviews

A published review displays the display name you selected, a “Verified buyer” designation, your rating, the content of your review and any photographs. We may reproduce reviews on the Services, in pop-up notifications, in emails and on our social media accounts; pop-up notifications abbreviate your name to your first name and last initial.

Purchase notifications

When live pop-up notifications are enabled, a recent order may be displayed to other visitors by reference to your first name, your city and state, and the product purchased. We never display the name of a gift recipient. While these notifications are enabled, checkout offers an option to be identified only as an anonymous purchaser in your state. A purchase made from us in person may be displayed in the same manner, together with the time elapsed since the purchase, by reference only to the first name you elect to give us and the city and state in which the purchase was made; you may ask at the time of purchase to be identified only as an anonymous purchaser. You may request that your orders and purchases be excluded from these notifications entirely by contacting us as provided in Section 14.

Aggregate activity

Pop-up notifications may also report the number of individuals viewing a product, adding it to their cart or wishlist, or joining our email list or the Puff Club. Such notifications contain numbers only and never identify any individual.

We do not sell personal information in exchange for money. When we advertise, we disclose certain personal information to advertising partners as described in Section 5.4, which may constitute a “sale,” “sharing” for cross-context behavioral advertising or processing for “targeted advertising” under the privacy laws of certain states; you may opt out as described in Section 7. We disclose personal information only as described in this Section 5.

5.1 Service Providers

We engage service providers that process personal information on our behalf, pursuant to their agreements with us and solely as necessary to perform services for us, in the following categories:

Hosting and infrastructure

Providers that host the Services and operate the databases and storage on which the Services rely.

Authentication

Providers that operate account sign-in, including the delivery of verification codes by email or text message.

Payment processing and fraud prevention

Providers that process payments, store saved payment methods and screen transactions for fraud.

Shipping and fulfillment

Providers that generate shipping labels and track parcels, and the carriers that deliver them, which receive the name, address and telephone number required for delivery.

Communications

Providers that deliver our emails and host our customer support inbox.

Analytics

Providers that measure use of the Services and record sessions as described in Section 2.2.

Error monitoring

Providers that collect diagnostic reports when the Services malfunction.

Bot protection

A provider that checks, when you send our message form, that the message comes from a person rather than automated means, and may for that purpose process your device and network information.

5.2 Third Parties You Choose

When you elect to use a third-party payment method at checkout, such as a digital wallet or a buy-now, pay-later service, or to sign in with a third-party account, that provider receives the information necessary to complete your request and processes it in accordance with its own privacy policy. Certain recipients, including payment processors, shipping carriers and sign-in providers, may also use information for their own purposes, such as fraud prevention or administration of an account you hold with them.

5.3 Other Disclosures

We may also disclose personal information:

• to our accountants, attorneys and other professional advisers in connection with the professional services they provide to us;
• where required by law, regulation, subpoena, court order or other legal process, or where we believe in good faith that disclosure is necessary to protect the rights, property or safety of our customers, the public or Nimmies;
• to an actual or prospective acquirer, successor or assignee in connection with a merger, acquisition, financing, reorganization, sale of assets or similar transaction; and
• with your consent or at your direction.

5.4 Advertising Partners

When we advertise, we disclose the information described under “Advertising information” in Section 2.2 to the social media platforms and online advertising services on which we advertise, so that they may attribute visits and purchases to our advertisements, measure the effectiveness of our advertisements, and display our advertisements to you and to individuals who may share your interests. Advertising partners may combine this information with information they hold about you, including information associated with any account you maintain with them, and process it in accordance with their own privacy policies. Where the privacy laws of certain states apply, we instruct our advertising partners to limit their use of this information. We make no such disclosures from a browser in which you have opted out or that transmits a Global Privacy Control signal, regarding orders placed while signed in to an account that has opted out, or regarding orders placed by our personnel for testing purposes.

We, our service providers and our advertising partners use cookies and similar technologies as described in our Cookies Policy, which also explains how we respond to browser privacy signals and how you may disable analytics and advertising technologies in your browser.

Marketing communications

You may opt out of marketing emails at any time by using the unsubscribe link included in each such email, and members may disable alerts in their account settings. Our marketing emails may contain a small image and tracked links that tell us whether and when an email was opened, which links were followed, and the general type of device (phone, tablet or computer) used to follow them, so we can measure and improve them; images you have set your email application to block are not loaded. Transactional communications relating to your orders, your account and your support requests will continue, as they are necessary to provide the Services.

Analytics

You may disable analytics in your browser as described in our Cookies Policy.

Advertising

You may opt out of the sale or sharing of your personal information, and of its processing for targeted advertising, using the advertising setting described in our Cookies Policy. A Global Privacy Control signal transmitted by your browser is treated as such an opt-out for that browser. If you are signed in when you use the setting, your opt-out is also recorded on your account and applies to orders you place while signed in on any device. You may also submit an opt-out request as described in Section 8.1.

Purchase notifications

You may limit or exclude the display of your purchases as described in Section 4.

Account deletion

You may update your account information, and delete your account, in your account settings. Deleting your account signs you out of all devices, removes your saved addresses and saved payment methods, and unsubscribes you from our email list. We retain records of past orders as required for tax, accounting, return and dispute purposes.

Subject to applicable law, and regardless of where you reside, you may request that we:

• confirm whether we process your personal information and provide you with access to, or a copy of, that information;
• correct inaccurate personal information;
• delete your personal information, subject to the exceptions permitted by law, such as order records we are required to retain for tax purposes or a record of your request not to receive marketing emails;
• cease sending you marketing communications; and
• cease disclosing your personal information to advertising partners, as described in Section 7.

Residents of certain states, including California, may have additional rights under applicable law, such as the right to know the categories of personal information we collect and the purposes for which it is used, and the right to appeal our decision regarding a request. We will honor such rights where they apply.

8.1 Submitting a Request

You may submit a request using the contact methods set out in Section 14. We will verify your request, generally by confirming it from the email address associated with your account or orders. You may designate an authorized agent to submit a request on your behalf by providing that agent with your signed, written permission, subject to our verification of that permission with you. We will respond within forty-five (45) days of receipt or, if we require additional time, notify you of the reason within that period. We will not discriminate against you for exercising any of your rights. If we decline your request, you may appeal by replying to our response, and we will review our decision.

8.2 California Residents

During the preceding twelve (12) months, we have collected the following categories of personal information, as enumerated in the California Consumer Privacy Act: identifiers (such as name, email address, telephone number, postal address, IP address and account identifier); customer records (such as billing information and order history); commercial information (such as products purchased or considered); internet or other electronic network activity information (such as interactions with the Services, including session recordings); geolocation data (approximate location only); audio, electronic or visual information (such as photographs you submit); and account log-in information. We collected this information from the sources, used it for the business purposes, and disclosed it to the categories of recipients described in Sections 2, 3 and 5. When we advertise, we disclose identifiers, commercial information and internet or other electronic network activity information to advertising partners as described in Section 5.4, which may constitute a “sale” or “sharing” under the California Consumer Privacy Act; we do not otherwise sell or share personal information. You have the right to opt out of such sales and sharing as described in Section 7. We have no actual knowledge of selling or sharing the personal information of consumers under sixteen (16) years of age. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about consumers.

California Civil Code Section 1798.83 permits California residents to request information regarding the disclosure of their personal information to third parties for those third parties' direct marketing purposes. We do not make such disclosures.

8.3 Nevada Residents

We do not sell covered information, as defined in Chapter 603A of the Nevada Revised Statutes.

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Policy, including:

• order and payment records, for the period required by tax, accounting and other applicable laws, which is generally several years;
• account information, until you delete your account;
• email sign-up information, until you unsubscribe, following which we retain a record of your request in order to honor it;
• support requests and reviews, for as long as they remain relevant to providing customer service and operating the Services; and
• session recordings and other analytics information, for the limited periods described in Section 2.2 or as otherwise provided under our arrangements with our service providers; and
• the record of the link or advertisement through which you arrived, in your browser for ninety (90) days and with any order to which it is attached for as long as that order record; information received by advertising partners is retained in accordance with their own policies.

We maintain administrative, technical and physical safeguards appropriate to the nature and scale of our business, including encryption of connections to the Services, the handling of payment card information exclusively by our payment processor, and access controls limiting personal information to personnel who require it. However, no method of transmission over the internet and no method of electronic storage is completely secure, and we cannot guarantee the absolute security of your personal information. You are responsible for maintaining the confidentiality of your sign-in credentials and should notify us promptly if you believe your account has been compromised. In the event of a data breach affecting your personal information, we will provide notice as required by applicable law.

The Services are intended solely for adults aged eighteen (18) years and older. We do not knowingly collect personal information from individuals under eighteen (18) years of age, including children under thirteen (13) years of age within the meaning of the Children's Online Privacy Protection Act. If you believe that an individual under eighteen (18) years of age has provided personal information to us, please contact us and we will delete it.

Nimmies is based in the State of Illinois, and personal information is stored and processed primarily in the United States. Certain of our service providers may process personal information in other countries, subject to their own safeguards. The Services are intended for individuals located in the United States.

We may amend this Policy from time to time. The amended Policy will be posted on this page with a revised “Last updated” date. If we make material changes, we will provide additional notice, such as a notice on the Services or an email to account holders.

If you have any questions regarding this Policy or our privacy practices, or if you wish to exercise any of your rights, please contact us:

Help center

shopnimmies.com/help

Email

support@shopnimmies.com