Privacy

What we collect

Only what is needed to fulfil an order lawfully, plus what the law requires us to keep as evidence.

• Contact details — your name, email address and, if you give one, a phone number.
• Delivery details — the address an order ships to, including any address you save for reuse.
• Order history — what you ordered, when, what it cost, and every change of status on it.
• Age-verification evidence — the fact that a check passed, when, and the IP address and browser user-agent it came from. We are required to be able to show this.
• Support messages — anything you send us through the chat or by email, so we can answer it. For chat, we also keep the internet address your latest message came from, and use it only to block abuse.
• Visits — a random identifier kept in a cookie, the pages you view and when, the site or campaign link that brought you here, your approximate location as our hosting provider estimates it from your internet connection (city, state, ZIP code, country, approximate coordinates and time zone — about the accuracy of a city or ZIP code, never a street address), and your device type, browser and operating system. We do not store your IP address for this, or the full identifying string your browser sends.
• Newsletter subscription — your email address, if you choose to give it, and where you subscribed from.

What we never collect

Some of the most sensitive data a shop normally holds simply does not exist here, and that is by design rather than by promise.

• Card numbers, expiry dates and security codes. We never ask for them, so none is ever entered, transmitted or stored.
• Third-party advertising or analytics trackers. There is no advertising pixel, no cross-site tracking, and no tag manager on this site — partly on principle, and partly because paid advertising is not permitted in this category anyway.
• Any data about you sold or rented to anyone. We do not do this, and there is no arrangement under which we would.

Cookies and browser storage

We use the smallest set that makes the site work. None of it is used to profile you or to follow you to other sites.

• A cart cookie holding which items you have selected. It holds no prices — those are always recalculated on our servers.
• A state preference, so we can show you what can lawfully ship to you without asking twice.
• A record in your browser that an age check passed, held for 30 days before we ask again. This one never leaves your device.
• A session cookie when you are signed in.
• A visitor cookie holding a random identifier, kept for 90 days. It links your page views to one another, and to any chat you start, so we can see how people find and use the site. It contains nothing about you and is never shared.
• If you arrived through a link someone shared, a cookie naming that link, kept for 30 days. It lets us credit whoever sent you if you order, and holds nothing about you.

Who else sees your data

Only the parties needed to get an order to you, and only the fields they need to do it.

• The carrier delivering your order — the delivery address and the signature requirement, not your order history.
• Our hosting, database and file-storage providers, who hold data on our behalf under contract and do not use it for anything else. This includes a short-term store that holds visit records only until they are moved into our database overnight.
• Our email provider, to send order and support messages.
• A state or federal authority, where the law requires it — including the monthly delivery reports the PACT Act requires for vapor products.

How long we keep it

Order records and the age-verification evidence attached to them are kept for as long as the law requires us to be able to produce them, which is longer than we would otherwise choose. Support messages and newsletter subscriptions are kept until you ask us to remove them.

Page-by-page visit records are kept for 90 days. After that only daily totals remain, and those identify no one.

If we block an internet address because of abuse, we keep that address and our reason for as long as the block stands.

When you ask for deletion, your personal details are erased while the minimum legally required order record is retained in a form that no longer identifies you.

Your rights

Wherever you live in the United States, we will honour these. Residents of California and other states with comprehensive privacy laws have them by statute; we extend the same handling to everyone rather than sorting customers by ZIP code.

• Ask for a copy of the personal data we hold about you.
• Ask us to correct anything inaccurate.
• Ask us to delete your data, subject to the record-keeping the law obliges us to maintain.
• Opt out of marketing email at any time, with one click, without affecting your orders.
• Ask us how a decision about an order was reached.

Contacting us about privacy

Write to sales@mimosalsd.com and say what you want. We will confirm we have received it and tell you what we are doing about it. We do not require you to use a specific form of words.