Your Rights and Choices under the CPRA

California law grants you the following rights with respect to your personal information:

• Right to Know / Access. You can request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, our business or commercial purposes for using it, and the categories of third parties with whom we have shared it. For example, we may collect identifiers (name, email, postal address, telephone number, IP address, device identifiers) and commercial information (products purchased, preferences). Upon a verifiable request, we will provide this information covering the 12-month period preceding your request.
• Right to Deletion. You can request that we delete any of your personal information that we have collected and retained, subject to certain exceptions. We will comply with your verifiable deletion request unless retaining the data is necessary for legal or business purposes (such as completing a transaction you initiated, detecting security incidents, or complying with law). We will also notify our service providers and other third parties to delete the data, unless this is impossible or requires disproportionate effort.
• Right to Correction. You can request correction of any inaccurate personal information that we maintain about you. We will use commercially reasonable efforts to correct your data taking into account the nature of the information and the purposes of processing.
• Right to Limit Use and Disclosure of Sensitive Information. California recognizes certain categories of data as “sensitive personal information” (such as financial account numbers, login credentials, precise geolocation, health/medical data, racial/ethnic information, etc.). You have the right to direct us to limit the use and disclosure of your sensitive personal information to only that use which is necessary to provide the goods or services you have requested or that is needed to ensure security, quality, or short-term non-personalized uses (see Cal. Civ. Code § 1798.140). We collect sensitive data only as necessary (for example, payment account information to process orders) and will comply with any lawful request to limit its use.
• Right to Opt-Out of Sale or Sharing. You have the right to direct us not to sell or share your personal information. We do not sell personal information for monetary value; any “sharing” we do is limited and always in accordance with your choices. For example, we may share limited, anonymized data (such as hashed identifiers and aggregated site analytics) with our marketing and advertising partners to improve and target ads. You may opt out of such cross-context behavioral advertising. If you wish to opt-out of sale or sharing, you may do so at any time by emailing us or by using a Global Privacy Control (GPC) signal.
• Right to Non-Retaliation / Non-Discrimination. California law prohibits us from discriminating against you for exercising any of these rights. We will not, for example, deny you goods or services, charge different prices, or provide a different level of service because you have exercised your privacy rights.

How to Exercise Your California Privacy Rights

To exercise any of the rights above, submit a verifiable consumer request to us by the following method:

• Email: Send your request to [email protected].

Only you, or someone you authorize (such as a parent or person authorized by power of attorney), may make a request about your personal information. You may also make a request on behalf of your minor child. We cannot fulfill your request unless you provide sufficient information to verify your identity (for example, full name, email address, and other unique information we have on file) and describe your request with sufficient detail for us to understand and act on it. You may make a request to know or delete your information up to twice per 12-month period.

When you submit a request, please specify which rights you are exercising (access, deletion, correction, limit, or opt-out) and any details we need to locate your information. We will only use the information you provide with your request to verify your identity and process your request. You do not need to create an account to make such requests.

Upon receiving a verifiable request, we will confirm receipt within 10 business days and provide information about how we will process your request. We aim to respond to all verifiable requests within 45 days of receipt. If we require more time, we will let you know and may take up to a total of 90 days. Any disclosures provided will cover the 12-month period preceding the request, unless the law requires otherwise. We do not charge a fee to respond unless your request is excessive, repetitive, or unfounded; any such fee will be reasonable and explained in advance.

Personal Information We Collect

We collect “personal information” as defined under California law: information that identifies, relates to, describes, or could reasonably be linked to you or your household (Cal. Civ. Code § 1798.140(o)). Within the last 12 months, we have collected the following categories (non-exhaustive examples in parentheses):

• Identifiers: e.g., name, postal address, email address, telephone number, date of birth, government ID number, online identifiers, IP address, device identifiers. These may come from forms you fill out (orders, account sign-up).
• California Customer Records personal information: e.g., payment account information (credit/debit card numbers, bank account info) and other financial data, if you make a purchase. This is used only to process transactions.
• Commercial information: e.g., records of products or services you have purchased, received, or considered; browsing and search history on our site.
• Internet or other electronic network activity: e.g., browsing history, search history, information regarding your interaction with our website or advertisements. We use Matomo, a privacy-friendly analytics platform, to collect such usage data (primarily first-party cookies, which respect privacy standards).
• Professional or employment information: e.g., business or organizational affiliation, employment status, if relevant to your interaction with us.
• Inferences: e.g., profiles about your preferences, characteristics, behavior, attitudes, or interests based on the information above.

We do not collect sensitive personal information for any purposes outside what is necessary to provide our services. Examples of sensitive categories include your precise geolocation, health data, race/ethnicity, or contents of communications. To the extent we do collect sensitive information (such as account log-in or payment credentials), we only use it to fulfill your requests and otherwise in ways that do not trigger additional CPRA restrictions.

Use of Personal Information

We use your personal information for our business purposes and the purposes disclosed at collection, including:

• Service Fulfillment: To process and fulfill your orders (for products or services), ship items, manage your account, and provide customer service.
• Communications: To respond to your inquiries, send order confirmations and updates, provide support, and, where you have opted in, send you marketing emails or newsletters.
• Marketing and Advertising (with Consent): To send you promotional offers or ads (via email or online advertising) based on your preferences or past purchases, only with your consent or as otherwise permitted by law. We may share limited, anonymized data (such as hashed email addresses or cookie-based identifiers) with advertising partners to deliver targeted ads and measure campaign effectiveness.
• Site Analytics and Improvement: To analyze site usage and improve our website, products, and services. Matomo automatically anonymizes visitor IP addresses, and uses first-party cookies by defaul.
• Legal and Security Purposes: To detect and prevent fraud, prosecute violators of our terms, enforce our contracts, secure our systems, and comply with legal obligations or law enforcement requests.
• Business Operations: To manage our business (e.g., billing, accounting, storing records, backups) and execute internal business purposes (such as quality assurance and auditing).

We will not collect or use your personal information for any materially different purpose without providing you notice beforehand.

Sharing of Personal Information

We may disclose your personal information for business or commercial purposes to the following types of third parties:

• Service Providers: Companies that help us operate our business or provide services (such as payment processors, IT support, shipping carriers, email and marketing platforms, data hosts, analytics services, and advertising networks). Each of these providers is contractually required to keep your information confidential and only use it to perform their assigned service.
• Affiliates: Our parent company and subsidiaries, if any, for our internal business purposes.
• Authorized Third Parties: Third parties you authorize (for example, to facilitate a return or warranty).
• Marketing Partners: Ad networks and social media platforms for cross-context behavioral advertising (to deliver ads on their sites/apps). In the past 12 months, the categories of personal information shared for this purpose have been limited to identifiers and internet/network activity information. We share this data only after obtaining any required consent.

We do not sell your personal information for monetary value. We have not sold any personal data in the past 12 months, nor do we share it in exchange for money. (Note: under California law “share” for cross-context behavioral advertising is distinct from “sale”; we do engage in the former as described above.) We also do not knowingly sell or share personal information of anyone under age 16 without affirmative authorization.

Cookies and Tracking

Our website uses cookies, web beacons, and similar tracking technologies to operate effectively (e.g., keeping you logged in, remembering preferences) and to collect analytics data. Matomo sets first-party cookies to gather anonymous usage statistics. You can typically control cookie preferences through your browser settings or privacy tools. Please note that most browsers’ Do Not Track (DNT) signals are not currently honored by our site; however, you may opt out of online advertising via available mechanisms (e.g., your ad settings or tools like DAA Consumer Choice).

Exercise of Do-Not-Sell/Share Rights

Although we do not sell data, California law gives you the right to opt out of sharing your personal information for targeted advertising. You may exercise this right at any time by contacting us (see How to Exercise Your Rights above). If you use an authorized Global Privacy Control (GPC) or similar mechanism indicating your choice to opt out, we will treat that as a valid opt-out request. Once you opt out, we will stop sharing your personal information for cross-context behavioral advertising unless you later authorize it.

Non-Retaliation

California law (Cal. Civ. Code § 1798.125) prohibits us from discriminating against you for exercising your rights under the CPRA. In practice, this means we will not deny you goods or services, charge you different prices, or otherwise alter our relationship with you because you exercised any privacy right.

California “Shine the Light” Disclosure

If you are a California resident, you have the right under Cal. Civ. Code §§ 1798.83–1798.84 to request a list of certain categories of personal information we have shared with third parties for their own direct marketing purposes. If you make such a request, we will disclose the categories of information shared and the names and addresses of those third-party recipients. To request this information, please contact us as described below.

Contact Information and Additional Notices

Our full Privacy Policy (including descriptions of our data practices and your rights) is available at https://www.maisonmoyi.com/us/privacy. For more information about this Notice or our privacy practices, please contact us at [email protected]. We do not have a designated telephone number for privacy requests; please use the email address above. We will update this Notice from time to time (for example, when our practices change); we will post a notice on our website when this Notice has been materially revised.

California Civil Code Section 1789.3 (Grievance Notice)

California Civil Code § 1789.3 provides that California residents may file complaints or inquiries about consumer privacy with the state. The relevant contact information is: the Complaint Assistance Unit, Division of Consumer Services, California Department of Consumer Affairs, 400 R Street, Suite 1080, Sacramento, CA 95814; by telephone at (916) 445-1254 or (800) 952-5210; or by email at [email protected]. This Notice is provided pursuant to California law, including Sections 1798.100–1798.199 of the California Civil Code.

Proposition 65 Notice

California’s Proposition 65 requires businesses to provide warnings for products containing certain chemicals known to cause cancer or reproductive harm. Maison Moyi’s products are fully organic and chemical-free, and we do not sell any products that would require a Proposition 65 warning under the law. (For more information about Proposition 65, please visit OEHHA’s website at oehha.ca.gov/proposition-65.)