Privacy & Cookie Policy

1. Scope

This policy covers Pinchnip’s U.S. storefront, accounts, checkout, wholesale portal, customer support, retailer outreach, and related Pinchnip applications. Protected internal workforce notices supplement this policy for employees and contractors.

2. Information we collect

• Contact and account data, such as name, email, phone, role, password hash, and account status.
• Order, payment-status, shipping, billing, discount, return, refund, and support data. Stripe handles payment-card details.
• Retailer and business-prospect information, including public business contact details, websites, locations, social profiles, outreach history, and suppression status.
• Device, security, session, audit, cookie-choice, and approximate usage data.
• Information submitted in messages, reviews, applications, privacy requests, and internal company tools.

3. Sources

We receive information from you, authorized account administrators, order and shipping providers, public business websites and directories, retail partners, security systems, and service providers. CRM tools may use geocoding and AI-assisted enrichment to organize publicly available business information; staff review data before using it for outreach.

4. How we use information

• Operate accounts, checkout, payment, fulfillment, support, returns, and wholesale relationships.
• Authenticate users, prevent fraud, protect systems, and maintain audit records.
• Respond to inquiries and send transactional communications.
• Conduct lawful retailer outreach and honor opt-outs.
• Improve products and services using analytics only after analytics consent.
• Meet tax, accounting, legal, safety, and dispute obligations.

5. Cookies and layered analytics choices

Essential cookies and local storage support sessions, carts, security, and saved privacy choices. They cannot be disabled through our preference control because the service may not work without them.

Optional analytics is divided into capabilities. Core analytics measures anonymous 30-minute browser sessions, pages viewed, first-touch traffic sources, device category, campaign tags, and approximate city, region, and country supplied by Cloudflare at the edge. Google Analytics is part of core analytics and receives consented page views only, with advertising storage and personalization denied. Pinchnip does not send Google purchase events. We do not store raw IP addresses, full user-agent strings, full referring URLs, or account identifiers in Pinchnip analytics events.

Purchase attribution is a separate capability. When approved, Pinchnip may attach the anonymous analytics session to checkout and the completed order so we can report consented conversion and acquisition. Orders placed without this grant remain in operational sales totals but are unattributed. The session-to-order link is automatically removed after 14 months without deleting the operational order.

When a material analytics capability is added, previously approved capabilities may continue while the new capability remains off. “Keep existing analytics only” preserves those earlier grants and dismisses that update. Accepting the latest analytics policy is cumulative: it accepts every earlier analytics permission that is still in effect and included in the current bundle, including a capability you previously declined. It does not reactivate a capability Pinchnip has formally retired. Wording-only corrections do not create a new consent notice.

Your choice is remembered on your device and, when signed in, synchronized with your Pinchnip account. Individual decisions are resolved by time, with rejection winning a tie; a later explicit acceptance of the current bundle supersedes earlier declines for capabilities included in that bundle. “Reject all analytics” stops core measurement and purchase attribution immediately, removes analytics storage and Google cookies, and does not block shopping or account functions. A later material bundle may be offered once, but the same dismissed update is not repeatedly shown.

6. Service providers and disclosure

We disclose only what is reasonably needed to providers supporting the service, including Cloudflare for hosting, security, and coarse location information at the edge; Supabase for authentication and protected operational data; Stripe for payments; Shippo and carriers for shipping; Resend for email; Google Analytics after consent; OpenStreetMap’s Nominatim service for business geocoding; and OpenAI for AI-assisted business discovery and enrichment. Providers may process information under their own terms and privacy notices.

We may also disclose information in a business transfer, to protect rights and safety, with your direction, or when legally required.

7. No sale of personal information

Pinchnip does not sell personal information for money. We do not use personal information for cross-context behavioral advertising. If that practice changes, we will update this policy and provide legally required choices before the change applies.

8. Retention

Our documented schedule generally retains transaction and tax records for seven years; legal acceptances for seven years after the related transaction or account closure; resolved support and return cases for three years; inactive profile data for up to two years; CRM prospects for 24 months after meaningful activity; analytics for 14 months; routine security logs for 12 months; and abandoned checkout data for 30 days. Minimal suppression records may be kept as needed to honor opt-outs. Legal holds, fraud prevention, and mandatory law may require longer retention.

9. Your choices and requests

You may ask to access, correct, or delete information, or opt out of marketing. Some records must be retained for orders, security, legal obligations, or suppression. We will verify requests before disclosing or deleting information and respond as applicable law requires.

Submit a privacy request or email team@pinchnip.com.

10. Security, children, and U.S. operations

We use reasonable administrative, technical, and organizational safeguards, but no system is risk-free. Our services are not directed to children under 13, and purchases require an adult who can form a contract. Pinchnip currently operates for United States retail and wholesale audiences.

11. Contact

Policy updates

We may update this policy as our services or legal obligations change. The current effective date and version appear at the top of this page. Questions about this policy may be sent to team@pinchnip.com.