PRIVACY POLICY

Last Updated: 8/06/26

American Bonfire Co. ("American Bonfire," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit americanbonfireco.com (the "Site"), purchase our products, subscribe to our email or SMS programs, or otherwise interact with us. By using the Site, you agree to this Policy.

If you have questions, contact us at hello@americanbonfireco.com or American Bonfire Co., Attn: Privacy Compliance Officer, 952 School Road #161, Napa, CA 94559-2826.

1. Information We Collect

Information you provide to us. Name, shipping and billing address, email, phone number, payment information, account credentials, order history, customer service messages, product reviews, brand-representative applications, wholesale inquiries, and any content you submit to us.

Information collected automatically. IP address, device identifiers, browser type and version, operating system, referring URLs, pages viewed, links clicked, session duration, approximate geolocation derived from IP, and information collected through cookies, pixels, tags, SDKs, and similar technologies.

Information from third parties. Payment processors, shipping carriers, e-commerce and marketing platforms (including Shopify and Klaviyo), analytics providers, advertising partners (including Meta, Google, and TikTok), and social media platforms when you interact with our content.

2. Categories of Personal Information (CCPA/CPRA)

In the past twelve (12) months, we have collected the following categories of personal information as defined by the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Identifiers — name, postal address, email, phone number, IP address, account ID, order number
Customer records — billing and shipping information, payment card information (handled by our processor)
Commercial information — products purchased, purchase history, cart contents, browsing activity
Internet or electronic network activity — interactions with the Site, ads, and emails
Geolocation data — approximate location derived from IP address
Inferences — preferences, characteristics, and predispositions drawn from the above

We do not knowingly collect sensitive personal information as defined by CPRA beyond payment card data, which is handled directly by our PCI-DSS-compliant payment processor and not retained by us. We do not use or disclose sensitive personal information for any purpose other than as permitted by CPRA § 1798.121(a).

3. How We Use Your Information

We use personal information to:

Process, fulfill, and ship your orders
Provide customer service, including responding to inquiries and processing returns
Send transactional communications (order confirmations, shipping notices, receipts)
Send marketing emails and SMS with your consent
Operate, secure, maintain, and improve the Site
Prevent fraud, abuse, and unauthorized access
Personalize content, product recommendations, and advertising
Measure and analyze the performance of our marketing
Comply with legal obligations, respond to lawful requests, and enforce our Terms and Conditions

4. How We Share Your Information

We share personal information with the following categories of recipients:

Service providers — Shopify (e-commerce hosting), Klaviyo (email and SMS), payment processors, fulfillment and shipping carriers, customer service tools, and analytics providers
Advertising partners — Meta, Google, TikTok, and similar platforms, through cookies and pixels for measurement and targeted advertising. This activity may qualify as "sharing" for cross-context behavioral advertising under CPRA. See Section 7 to opt out.
Professional advisors — attorneys, accountants, and auditors
Government authorities and law enforcement — when legally required or to protect our rights, safety, or property
In connection with a corporate transaction — such as a merger, acquisition, financing, reorganization, or sale of assets

We do not sell personal information for money. We may "share" personal information for cross-context behavioral advertising as defined under California law. To opt out, see Section 7.

5. Cookies and Tracking Technologies

We use cookies, pixels, tags, SDKs, local storage, and similar technologies for essential site functionality, analytics, personalization, and advertising. You can manage preferences through our cookie banner (where available), your browser settings, or the "Do Not Sell or Share" mechanism described in Section 7.

We honor Global Privacy Control (GPC) signals as an opt-out of the sale or sharing of personal information for California residents and, where applicable, residents of other states that recognize universal opt-out mechanisms.

Because there is no consistent industry standard, we do not currently respond to browser "Do Not Track" signals. See California Business & Professions Code § 22575 for more.

6. Your Privacy Rights

6.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

Know — request the categories and specific pieces of personal information we have collected, the sources, the purposes for collection, and the categories of third parties with whom we share it
Delete — request that we delete personal information we have collected from you, subject to certain exceptions
Correct — request correction of inaccurate personal information
Opt Out of Sale or Sharing — direct us to stop selling or sharing your personal information for cross-context behavioral advertising
Limit Use of Sensitive Personal Information — direct us to limit our use of sensitive personal information to purposes permitted by CPRA
Non-Discrimination — not be discriminated against for exercising your rights

To exercise these rights, submit a request in any of the following ways:

Email hello@americanbonfireco.com with the subject line "California Privacy Request"
Use the "Do Not Sell or Share My Personal Information" link in our website footer
Mail us at American Bonfire Co., Attn: Privacy Compliance Officer, 952 School Road #161, Napa, CA 94559-2826

We will verify your identity by matching information you provide against records we already hold. We will respond within 45 days, or 90 days when a longer period is required, and will notify you if we need more time. Authorized agents may submit requests on your behalf with written authorization.

California residents may also request information about our disclosures of personal information to third parties for their direct marketing purposes under California's "Shine the Light" law (Cal. Civ. Code § 1798.83). Send such requests to the addresses above.

6.2 Residents of Other U.S. States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Montana (MCDPA), Oregon (OCPA), Delaware (DPDPA), Iowa (ICDPA), New Hampshire (NHDPA), New Jersey (NJDPA), Nebraska (NDPA), Minnesota (MCDPA), Maryland (MODPA), Tennessee (TIPA), Indiana (INCDPA), Kentucky (KCDPA), and Rhode Island (RIDTPPA), and any other state with a comprehensive consumer privacy law, generally have rights to:

Access personal data we hold about you
Correct inaccurate personal data
Delete personal data
Obtain a portable copy of personal data
Opt out of targeted advertising, sale of personal data, and profiling for decisions producing legal or similarly significant effects
Appeal our decision on a rights request

Submit requests using the methods in Section 6.1. If we deny your request, you may appeal by replying to our response or emailing hello@americanbonfireco.com with the subject line "Privacy Rights Appeal."

6.3 Residents of the EU, UK, and EEA

If you are located in the European Union, the United Kingdom, or European Economic Area, you have the rights of access, rectification, erasure, restriction, portability, and objection under the GDPR and UK GDPR, and the right to lodge a complaint with your local supervisory authority. Our legal bases for processing include contract performance, our legitimate interests (operating our business and preventing fraud), consent (for marketing and non-essential cookies), and compliance with legal obligations.

To exercise these rights, email hello@americanbonfireco.com. If your request cannot be fulfilled directly through us, we will work with our data processors on your behalf.

7. Do Not Sell or Share My Personal Information

Under CCPA/CPRA and comparable state laws, you have the right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising.

We do not sell personal information for monetary value. However, we may "share" personal information with advertising partners (including Meta, Google, and TikTok) through cookies and pixels for targeted advertising, which qualifies as "sharing" under California law and analogous "targeted advertising" activity under other state privacy laws.

To opt out, you have three options:

Click "Do Not Sell or Share My Personal Information" in our website footer
Enable Global Privacy Control (GPC) in your browser — we honor GPC signals automatically
Email hello@americanbonfireco.com with the subject line "Do Not Sell or Share"

You do not need to create an account to opt out. We will process opt-out requests within 15 business days.

8. Marketing Communications

Email. By subscribing, you consent to receive marketing emails from American Bonfire Co. You can unsubscribe at any time via the link in any email or by contacting us.

SMS. By opting in to our SMS program, you consent to receive recurring automated marketing text messages at the phone number provided. Consent is not a condition of any purchase. Message and data rates may apply. Reply STOP to unsubscribe or HELP for assistance. Additional terms are in our Mobile Terms of Service.

We use Klaviyo as our email and SMS service provider. Klaviyo's privacy practices are governed by their own privacy policy.

9. Children's Privacy

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us at hello@americanbonfireco.com and we will delete it. If you are between 13 and 18, please use the Site only with the involvement of a parent or guardian.

10. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. General retention periods:

Order and transaction records — 7 years (tax, accounting, and audit requirements)
Customer accounts — until account deletion or 3 years of inactivity
Marketing subscriber records — until unsubscribe plus a suppression list retention period
Website analytics data — up to 26 months
Customer service correspondence — 3 years from resolution
Legal and compliance records — as required by applicable law

11. International Data Transfers

We are based in the United States. If you access the Site from outside the United States, your information will be transferred to, processed, and stored in the United States, which may have different data-protection laws than your jurisdiction. Where required, we rely on appropriate safeguards for international transfers (such as Standard Contractual Clauses).

12. Security

We use industry-standard administrative, technical, and physical safeguards to protect personal information, including SSL/TLS encryption in transit, PCI-DSS-compliant payment processing, and access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

13. Third-Party Links and Services

The Site may contain links to third-party websites, plug-ins, and applications. Clicking those links or enabling those services may allow third parties to collect data about you. We do not control and are not responsible for the privacy practices of third parties. Review their privacy policies before providing personal information.

14. Automated Decision-Making

We do not currently engage in solely automated decision-making that produces legal or similarly significant effects concerning you.

15. Notice of Financial Incentive

From time to time we may offer discounts, loyalty perks, or promotional codes (such as newsletter or SMS signup discounts) in exchange for your contact information. Participation is voluntary, you may withdraw at any time by unsubscribing, and the value of the incentive is reasonably related to the value of your personal information to our business, calculated based on expected marketing revenue attributable to subscribers.

16. Changes to This Policy

We may update this Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be communicated through the Site or by email. Continued use of the Site after changes constitutes acceptance.

17. Contact Us

Questions, requests, complaints, or concerns:

American Bonfire Co.
Attn: Privacy Compliance Officer
952 School Road #161
Napa, CA 94559-2826
Email: hello@americanbonfireco.com