Poppit's Playhouse LLC ("Poppit's Playhouse," "we," "us," or "our") designs and sells wheelchairs and mobility products for small dogs. We respect your privacy and are committed to being transparent about the personal information we collect, how we use it, and the choices you have.

This Privacy Policy ("Policy") applies to personal information we collect through www.poppitsplayhousellc.com (the "Site"), by email or phone, and through our customer service interactions. By using the Site or purchasing our products, you acknowledge that you have read and understood this Policy.

Residents of California and Washington: This Policy contains state-specific disclosures and rights that apply to you. See Section 9 ("Your Privacy Rights") below.

When you place an order, create an account, contact customer service, or otherwise interact with us, you may provide:

• Contact information: name, shipping address, billing address, email address, phone number.

• Order and payment information: products purchased, order history, and payment card details. Payment card data is collected and processed directly by our PCI-DSS-compliant payment processor (Stripe); we do not store full card numbers on our servers.

• Account credentials: username and password (if you create an account).

• Product fit information: measurements, weight, breed, and photos of your dog that you voluntarily provide so we can recommend or build the correct wheelchair. This is information about your pet, not human health data.

• Communications: messages, emails, reviews, survey responses, and other content you send us.

• Marketing preferences: your opt-in status for email or SMS marketing.

When you visit the Site, we and our service providers may automatically collect:

• Device and browser data: IP address, browser type, operating system, device identifiers, screen resolution.

• Usage data: pages viewed, links clicked, time spent on pages, referring URL, search terms used on the Site.

• Approximate location: general geographic location derived from your IP address. We do not collect precise GPS location.

• Cookies and similar technologies: see Section 6 for details.

We may receive information from:

• Payment processors: transaction confirmation and fraud-screening data from Stripe.

• Shipping carriers: delivery status and address verification (e.g., USPS, UPS, FedEx).

• Analytics and advertising providers: aggregated audience data (e.g., Google Analytics, Meta).

• Social media platforms: if you engage with our pages or click our ads, limited profile information per the platform's privacy settings.

We do not knowingly collect: Social Security numbers, driver's license numbers, passport numbers, precise geolocation, biometric identifiers, genetic data, health information about human consumers, information about sexual orientation, religious beliefs, union membership, or information from children under 13.

We use personal information for the following business purposes:

• Fulfilling orders: processing payments, shipping products, managing returns, providing customer support.

• Product fit and customization: using measurements and photos you provide to recommend or size a wheelchair for your dog.

• Account management: creating and maintaining your account, authenticating you.

• Communications: responding to inquiries, sending order confirmations and shipping updates, and (with your consent where required) marketing emails about new products or promotions.

• Site operation and improvement: analyzing usage, debugging, improving site performance, and testing new features.

• Fraud prevention and security: detecting fraudulent orders, unauthorized access, and other misuse.

• Legal compliance: complying with tax, accounting, consumer protection, and other legal obligations.

We do not use automated decision-making or profiling in ways that produce legal or similarly significant effects about you.

We share personal information only as described below. We do not sell personal information for money.

We share personal information with vendors who perform services on our behalf and are contractually restricted from using it for other purposes. Categories include:

• E-commerce platform: Shopify (or equivalent) for hosting our online store.

• Payment processing: Stripe for secure payment handling.

• Shipping and logistics: USPS, UPS, FedEx, and third-party logistics providers.

• Email and marketing: email service providers (e.g., Klaviyo, Mailchimp) for transactional and marketing communications.

• Analytics: Google Analytics for site usage analytics.

• Customer support tools: help-desk platforms used to handle inquiries.

• Cloud hosting and storage: providers that host our website and data.

We may share limited identifiers (such as hashed email, IP address, or cookie IDs) with advertising platforms (e.g., Google Ads, Meta/Facebook, TikTok) so we can show you relevant ads on those platforms and measure their performance. Under California law, this activity may be considered "sharing" for cross-context behavioral advertising. You have the right to opt out (see Section 9.1).

We may disclose personal information when we believe in good faith that disclosure is necessary to: (a) comply with a legal obligation, subpoena, warrant, or court order; (b) enforce our Terms of Service or protect our rights and property; (c) investigate fraud or security incidents; or (d) protect the safety of any person.

If we are involved in a merger, acquisition, financing, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any such transfer and any resulting changes to this Policy.

We may share information at your direction or with your express consent, such as when you post a product review or opt into a co-marketing promotion.

For transparency with California residents, the table below summarizes the categories of personal information defined in the California Consumer Privacy Act and whether we collect them:

Category

Examples

Collected?

A. Identifiers

Name, postal address, email, phone number, IP address,   account username, order number

Yes

B. Personal info (Cal. Civ. Code § 1798.80(e))

Name, address, phone, payment information (processed by   our payment processor)

Yes

C. Protected classifications

Age, gender, etc.

No

D. Commercial information

Products purchased, order history, cart activity,   preferences

Yes

E. Biometric information

Fingerprints, faceprints, voiceprints

No

F. Internet / network activity

Browsing history on our Site, clickstream data,   interactions with ads or emails

Yes

G. Geolocation data

Approximate location derived from IP address (not precise   GPS)

Yes (approximate)

H. Sensory information

Audio, visual, thermal, olfactory information

No (except customer-submitted photos/measurements of your   dog, if provided)

I. Professional / employment info

Job title, employer

No

J. Non-public education info

Education records

No

K. Inferences

Profiles reflecting preferences, characteristics, behavior

Limited (for product recommendations)

L. Sensitive personal information

SSN, driver's license, financial account credentials,   precise geolocation, racial/ethnic origin, religious beliefs, health data,   sexual orientation

No

We retain each category only as long as necessary for the purposes described in Section 7.

We use cookies, pixels, and similar technologies to operate the Site, remember your preferences, analyze traffic, and support advertising. Categories include:

• Strictly necessary: required for the Site to function (e.g., keeping items in your cart, authenticating logged-in users). These cannot be disabled.

• Performance / analytics: help us understand how visitors use the Site (e.g., Google Analytics 4).

• Functional: remember choices like language or region.

• Advertising / targeting: used by us and our partners to deliver and measure relevant ads.

Global Privacy Control (GPC). We honor the Global Privacy Control browser signal as a valid request to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising.

Cookie choices. You can manage cookie preferences through the cookie banner on the Site, through your browser settings, or by visiting the Digital Advertising Alliance WebChoices tool or the Network Advertising Initiative opt-out page.

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. Our general retention criteria:

• Order records: typically retained for 7 years to comply with tax, accounting, and consumer protection obligations.

• Account information: retained while your account is active, plus up to 2 years of inactivity, then deleted or anonymized.

• Marketing preferences and suppression lists: retained until you withdraw consent, plus records of your opt-out kept indefinitely to honor your choice.

• Customer support communications: typically 3 years after the case is closed.

• Website analytics: retained in identifiable form for up to 14 months, then aggregated.

• Security and fraud logs: up to 2 years.

We use administrative, technical, and physical safeguards designed to protect personal information, including TLS/HTTPS encryption for data in transit, access controls, and use of PCI-DSS-compliant vendors for payment processing. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your account password confidential.

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to Know: request the categories and specific pieces of personal information we have collected about you, the sources, the business purposes, and the categories of third parties with whom we share it.

• Right to Delete: request that we delete personal information we have collected from you, subject to exceptions (e.g., to complete a transaction, detect security incidents, or comply with law).

• Right to Correct: request that we correct inaccurate personal information.

• Right to Opt Out of Sale or Sharing: direct us to stop "selling" or "sharing" your personal information. As noted in Section 4.2, our advertising-related disclosures may be considered "sharing" under California law. We do not sell personal information for money.

• Right to Limit Use of Sensitive Personal Information: we do not collect sensitive personal information for purposes beyond those permitted without a limitation right, so this right does not currently provide additional options here.

• Right to Non-Discrimination: we will not deny you goods or services, charge different prices, or provide a different level of quality because you exercised a privacy right.

How to exercise your rights. Submit a request by email to privacy@poppitsplayhousellc.comor by mail to the address in Section 13. We will verify your identity by matching information you provide (e.g., email, order number, shipping address) with information in our records. You may also designate an authorized agent to submit a request on your behalf; the agent must provide written permission signed by you, and we may still verify your identity directly.

We will respond to verifiable consumer requests within 45 days (extendable by an additional 45 days with notice). There is no fee unless the request is manifestly unfounded or excessive.

Opt out of "sharing" / targeted advertising: click the "Do Not Sell or Share My Personal Information" link in the footer of our Site, enable the Global Privacy Control in your browser, or email us at privacy@poppitsplayhousellc.com.

Shine the Light (Cal. Civ. Code § 1798.83). California residents may request information about our disclosures of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes.

Washington does not currently have a comprehensive consumer data privacy law. The following Washington-specific points apply:

• Washington My Health My Data Act (RCW Ch. 19.373): This Act applies to "consumer health data" about natural persons. We do not collect consumer health data within the meaning of the Act. Health-related information about your pet (such as mobility limitations or weight) is not consumer health data under Washington law, because pets are not "consumers" as defined in the Act. If our practices change, we will update this Policy and, where required, obtain your affirmative consent before collecting or using consumer health data.

• Data breach notification: If we experience a security breach involving your personal information as defined in RCW 19.255.010, we will notify you and, where required, the Washington Attorney General in accordance with that statute.

• Washington Consumer Protection Act (RCW 19.86): We commit to handling your personal information in a manner consistent with the representations in this Policy.

• Voluntary rights: As a courtesy, Washington residents may exercise the same rights described above for California residents (access, deletion, correction, opt-out of targeted advertising). Contact us using the information in Section 13.

Regardless of where you live, you may email us at any time to request access to your information, correct it, delete it, or unsubscribe from marketing. We will accommodate reasonable requests consistent with applicable law.

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will promptly delete it.

We do not knowingly sell or share personal information of consumers under 16 for cross-context behavioral advertising without opt-in consent.

The Site may contain links to third-party websites, plug-ins (such as social media share buttons), and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review their privacy policies before providing information to them.

We operate in the United States. If you access the Site from outside the U.S., your information will be transferred to, stored in, and processed in the U.S., where privacy laws may differ from those in your country. By using the Site, you consent to this transfer.

If you have questions about this Policy or wish to exercise any of your privacy rights, contact us at:

Poppit's Playhouse LLC

Email: privacy@poppitsplayhousellc.com

Website: www.poppitsplayhousellc.com

Mailing address: [Insert business mailing address]

We may update this Policy from time to time. When we do, we will revise the "Effective Date" at the top and, where changes are material, provide additional notice (such as an email or a banner on the Site). We encourage you to review this Policy periodically.

For more information about your privacy rights, you can contact:

California Privacy Protection Agency: cppa.ca.gov

California Attorney General (CCPA): oag.ca.gov/privacy/ccpa

Washington Attorney General (MHMDA & privacy): atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy

IMPORTANT NOTE

This document is a template drafted for informational purposes only and is not legal advice. Privacy laws change frequently and specific obligations depend on your business practices, data flows, and vendor relationships. Before publishing this Policy on your website, you should have it reviewed by a licensed attorney with experience in U.S. state privacy law (CCPA/CPRA and Washington-specific). Placeholder items to complete before publishing: (1) confirm all listed service providers match your actual stack; (2) insert your mailing address; (3) set up a working privacy@ email inbox; (4) ensure your website has a functional "Do Not Sell or Share" mechanism and cookie banner; (5) verify that your data retention periods match your actual practice.