1. Information We Collect

We restrict our data intake to essential records required to fulfill bedding accessory orders, coordinate door-to-door transit, and refine your digital sanctuary experience:

2. Purpose & Legal Grounds for Processing

Customer data is processed exclusively under legitimate business operations, transparent compliance, and customer-consented channels:

• Fulfillment & Parcel Routing: Authenticating payment clearances, printing carrier labels, routing sleep accessories via reputable parcel handlers (e.g., USPS, UPS, FedEx), and sending transit milestone notices.
• Storefront Calibration: Auditing interface response speeds, minimizing cart friction, diagnosing UI anomalies, and personalizing bedroom relaxation recommendations.
• Client Concierge Services: Responding to ergonomics inquiries, managing 30-day sleep trial requests, and dispatching opt-in promotional notices.
• Risk Shielding & Fraud Prevention: Monitoring checkout parameters against credit card anomalies, chargeback abuse, and unauthorized administrative access.

3. Cryptographic Security & Payment Isolation

We employ multi-layer security barriers to ensure your sensitive payment and identity credentials remain uncompromised:

• 256-Bit SSL/TLS Encryption: All information exchanged between your device and our checkout interface travels across bank-grade Secure Sockets Layer encrypted pipelines.
• Zero Payment Card Archiving: andatuly™ never stores, caches, or inspects complete 16-digit credit or debit card numbers on local infrastructure. Transactions are tokenized directly through Level 1 PCI-DSS certified gateways.
• Segregated Infrastructure Access: Stored profile records reside behind protected cloud firewalls, accessible solely by vetted operations personnel bound by non-disclosure protocols.

4. Third-Party Infrastructure & Ecosystem Sharing

We do not sell, rent, or trade your personal records to third-party data brokers. Data sharing is limited to trusted enterprise service providers supporting our operational infrastructure:

• Commerce Hosting Engine: Managed securely via Shopify Inc., providing high-availability cloud architecture, SSL certificate infrastructure, and encrypted database governance.
• Analytics & Campaign Partners: We deploy pixel tracking tools with vetted networks (such as Meta Ads and Google Marketing Platform) to evaluate store performance and present curated sleep hardware releases to interested shoppers.

5. Cookie Technologies & Browser-Level Preferences

Cookies and local storage tokens are miniature data files placed on your browser to facilitate seamless site functionality:

• Essential Session Cookies: Indispensable for preserving active carts, remembering regional currencies, and securing checkout sessions.
• Performance & Diagnostics Cookies: Yield aggregate data regarding page rendering latencies, navigational traffic flows, and server load distributions.
• Preference & Marketing Cookies: Facilitate relevant accessory updates and prevent repetitive promotional displays across digital touchpoints.

You hold full discretion to block or remove cookies via browser preferences; note that disabling essential cookies may hinder checkout processing.

6. California Privacy Governance (CCPA / CPRA & CalOPPA)

In adherence with California consumer privacy mandates:

• Shoppers may browse our public catalog anonymously without mandatory profile creation.
• Our Privacy Policy is permanently accessible across our primary site navigation and footer menus.
• California consumers maintain explicit rights to request disclosure, rectification, or complete deletion of collected records without facing discriminatory pricing.
• Do Not Track (DNT) Signals: We honor industry-standard Global Privacy Control (GPC) and DNT automated browser headers. When detected, non-essential analytical scripts are deactivated.

7. Children’s Online Privacy Protection (COPPA)

Our sleep accessories and concierge services are engineered exclusively for adult homeowners and consumers aged 18 and older. We do not knowingly solicit or maintain records belonging to children under 13. If you suspect an underage individual has submitted identifying details, please notify us at service@andatuly.com for immediate database purging.

8. Security Incident Notification Protocols

In the improbable event of a validated database compromise impacting customer privacy, our security leads will initiate forensic mitigation and provide formal email notifications to affected parties within 7 business days, accompanied by an explanatory advisory on our storefront.

9. Commercial Email Standards (CAN-SPAM Act)

To uphold the provisions of the United States CAN-SPAM Act:

• We never utilize deceptive subject headers, falsified sender origins, or ambiguous corporate identities.
• Every automated message and newsletter incorporates a conspicuous, single-click "Unsubscribe" link at the base of the correspondence.
• Opt-out requests are executed immediately through automated suppression rosters with zero delay.