Privacy Policy

• Orders. Your name, email address and U.S. delivery address, entered on the secure Stripe checkout page, plus what you ordered and the amounts, tax and refunds. We never receive or store your full card number.
• Messages. If you contact us: your name, email address, an optional phone number, and your message.
• Automatically. When you visit: the pages you view and how you arrived (through Google Analytics), technical details of errors (through Sentry), and a session record, which includes your IP address and browser details, that keeps the site and its forms working.

We don’t have customer accounts, so there is no password or profile to create. We don’t ask for anything we don’t need.

• To take payment, place your order with our supplier, ship it, send you order and tracking emails, and handle returns and refunds.
• To reply to your messages.
• To see which pages are used and fix errors, so the site works better.
• To keep tax, accounting and payment records, and to answer payment disputes.

We send transactional email only: order confirmations, shipping and delay notices, and replies to you. We don’t send marketing email.

These companies process personal information for us. Each gets only what it needs to do its job.

• Stripe takes payment and calculates sales tax. It receives your name, email, delivery address and card details.
• CJdropshipping (CJ) is the supplier that packs and ships your order. It receives your name, delivery address, email and, if provided, phone number so it can deliver.
• Resend delivers our email, so it handles your email address and the content of what we send you.
• Sentry records site errors so we can fix them. We configure it not to collect personal information by default and strip emails and tokens from what it receives.
• Google Analytics 4 measures how the site is used. See Cookies and Do Not Track below.
• Hosting and database providers run the site and store its database. The provider depends on where the site is deployed. Backups use Amazon Web Services only when that storage is configured.

We don’t sell your personal information or share it for advertising. We may disclose it if the law requires or to protect our rights, for example in a payment dispute.

The site uses session and security cookies that protect forms against forgery. It may also set an appearance preference cookie, and the admin may set a sidebar preference cookie. On public pages, Google Analytics also sets its own cookies to count visits and see which pages are used when Analytics is configured. We don’t load Analytics on our admin or sign-in pages, and we don’t run advertising or retargeting cookies. To block analytics cookies, use your browser’s settings or Google’s opt-out add-on. The site still works without them.

Some browsers send a “Do Not Track” signal. Our site doesn’t change how it works in response to that signal, so Google Analytics still runs on public pages. Use the opt-out above if you don’t want to be counted. Google, a third party, collects usage data about your visit to our public pages through Analytics under its own privacy policy. We’ve added no other third-party tracking.

• Money and legal records: retained for 7 years. That covers orders, payments, refunds, invoices, tax, consent and audit records. We keep them because the law lets us retain records we need for legal obligations and claims (GDPR Article 17(3)(b); California Civil Code 1798.105(d)). We don’t currently have an automatic process that deletes these records when that period ends.
• Messages: until you ask us to delete them, unless we need them for a dispute.
• Payment and delivery notifications from Stripe and our supplier: once handled, the personal details in them (such as your name, email and address) are removed 180 days later. We keep a stub with only the notification’s id and type, so the same one is never acted on twice.
• Sessions expire after two hours of inactivity. Old server-side session rows are swept periodically and may remain in storage after the session expires.
• Database backups are cleaned up under a schedule that keeps monthly and yearly snapshots. A deleted record may remain in a backup for around a year, depending on the configured backup storage and storage limit.

Email flipvollc@gmail.com from the address you used with us to ask to see, correct or delete your information, or to change anything on this page. We’ll answer within 45 days. We offer this to everyone, wherever you live.

If you ask us to delete your information, we review the request and remove or anonymise information where we can. We retain money and legal records when needed for legal obligations or claims. We also delete your customer profile at Stripe; Stripe keeps its own records of your payments, refunds and disputes. Some order information may remain identifiable while we process a request; email us if you need details about a particular record.

California’s Online Privacy Protection Act asks us to say what we collect, who we share it with, how to request changes, and how we treat Do Not Track. That is what the sections above do. We’ll tell you about changes by updating the date at the top of this page.

This site is for adults. You must be 18 or older to order, and we don’t knowingly collect information from children under 13. If you think we have, email us and we will delete it.

If we change what we collect or who handles it, we’ll update this page and the date at the top before the change takes effect. The current terms are on the Terms page.

Flipvo, LLC, 4281 Plompton Dr, Melbourne, FL 32935. Email flipvollc@gmail.com or use the contact page.