Privacy policy
Privacy Policy — Tangerine Cookies
Effective date: September 15, 2026
Last updated: September 4, 2026
1. Who we are
Tangerine Sweets LLC operates tangerinecookies.com, an online bakery selling fresh-baked gourmet cookies for delivery. In this policy "we", "us" and "our" mean Tangerine Sweets LLC.
This policy explains what personal information we collect when you use the site, why, who receives it, how long we keep it, and what rights you have. It covers this website and our email and SMS marketing. It does not cover other websites we link to.
Privacy contact: hello@tangerinecookies.com
2. How consent works on this site
We do not treat every visitor the same way, because the law does not.
- In California and Quebec, we ask before switching on analytics, advertising or session recording. Nothing in those categories runs until you choose. Change your mind at any time using Cookie preferences in the footer.
- Elsewhere in the United States and Canada, analytics and advertising run by default and you can switch them off at any time using Do Not Sell or Share My Personal Information .
- Everywhere, we honour the Global Privacy Control (GPC) signal automatically. If your browser sends GPC, we treat it as an instruction to stop selling and sharing your personal information. You need do nothing else.
Strictly necessary technologies — the ones that make the site and checkout work — always run. They do not track you across other websites.
3. What we collect (notice at collection)
| Category | Examples | Why | Sold or shared? | Kept for |
|---|---|---|---|---|
| Identifiers | Name, email, postal address, phone, IP address, device and cookie IDs, account ID | Orders, support, accounts, marketing, fraud prevention | Shared for cross-context behavioural advertising | Orders: 7 years. Account: until you ask us to delete it. |
| Customer records | Billing and shipping address, order history, payment method type and last four digits | Processing, delivering and refunding orders; accounting | No | 7 years from the order |
| Commercial information | Products viewed, added to cart, purchased, returned | Fulfilment, personalisation, analytics | Shared for cross-context behavioural advertising | 24 months |
| Internet or network activity | Pages viewed, referrer, on-site searches, clicks, time on page, device and browser, approximate location from IP | Site performance, analytics, ad measurement | Shared for cross-context behavioural advertising | 14 months |
| Session recordings | A replay of movement, scrolling, clicks and typing during your visit | Finding usability problems and errors | No | 90 days |
| Geolocation | Approximate city, region and country from your IP address. We do not collect precise GPS location. | Tax, shipping, fraud prevention, applying the right privacy settings for your region | No | 14 months |
| Inferences | Product preferences and audience segments drawn from the above | Personalising marketing and merchandising | Shared for cross-context behavioural advertising | 24 months |
Where it comes from. Directly from you when you order, subscribe, fill in a form or contact us; automatically from your device through the technologies in Section 4; and sometimes from our advertising and analytics partners.
Sensitive personal information. We do not collect sensitive personal information to infer characteristics about you. Payment details and login credentials are handled by our payment processor and platform only to complete your transaction and secure your account — permitted business purposes under California law. Because we do not use sensitive personal information beyond those purposes, we do not offer a "Limit the Use of My Sensitive Personal Information" option and are not required to.
Age. We do not knowingly collect personal information from anyone under 16. See Section 8.
4. Cookies, pixels and other technologies
The tables below name every third party that receives data from your visit. We update them whenever we add or remove a vendor.
Always on — strictly necessary
| Vendor / technology | What it does | Data it receives | Category | How to turn it off |
|---|---|---|---|---|
| Shopify (platform) | Runs the site: sessions, cart, checkout, fraud prevention, load balancing. | IP address, device and browser data, pages viewed, cart and order contents. | Strictly necessary | Cannot be disabled — the site does not function without it. |
Session recording — Microsoft Clarity
We use Microsoft Clarity to record how visitors use the site — mouse movement, scrolling, clicks and typing in form fields. This produces a replay of your visit that we use to find usability problems and errors. Microsoft acts as an independent controller of this data; its practices are at https://privacy.microsoft.com/privacystatement.
We ask permission before this starts in California and Quebec, and it does not run there unless you agree. Elsewhere it runs by default and you can switch it off through Cookie preferences or the Do Not Sell or Share link.
In every location: all text you type is masked before it leaves your browser, and checkout and account pages are excluded from recording entirely.
| Vendor / technology | What it does | Data it receives | Category | How to turn it off |
|---|---|---|---|---|
| Microsoft Clarity | Records a replay of your visit — movement, scrolling, clicks, typing (text masked). | Pages viewed, interaction events, masked form input, IP address, device and browser. | Session recording | Cookie preferences, or the Do Not Sell or Share link. |
Analytics
| Vendor / technology | What it does | Data it receives | Category | How to turn it off |
|---|---|---|---|---|
| Google Analytics (via Google Tag Manager) | Measures traffic and how people move through the site. | Pages viewed, referrer, approximate location from IP, device and browser, a random analytics ID. | Analytics | Cookie preferences, or Google's own opt-out add-on. |
| HubSpot Analytics | Measures traffic and links site activity to contact records in our CRM. | Pages viewed, referrer, IP address, a HubSpot visitor ID, and your email address once you identify yourself. | Analytics | Cookie preferences, or the Do Not Sell or Share link. |
Advertising and marketing
These involve sharing personal information for cross-context behavioural advertising. Section 2 explains how to switch them off.
| Vendor / technology | What it does | Data it receives | Category | How to turn it off |
|---|---|---|---|---|
| Meta (Facebook & Instagram) Pixel | Measures ad performance and builds advertising audiences. | Pages and products viewed, add-to-cart and purchase events, IP address, a Meta browser ID. | Advertising — sharing | Do Not Sell or Share link, or Meta's ad settings. |
| LinkedIn Insight Tag | Measures LinkedIn ad performance and builds advertising audiences. | Pages viewed, conversion events, IP address, a LinkedIn browser ID. | Advertising — sharing | Do Not Sell or Share link, or LinkedIn's ad settings. |
| HubSpot Ads Pixel | Attributes advertising to contacts in our CRM. | Pages viewed, ad interactions, IP address, HubSpot visitor ID. | Advertising — sharing | Do Not Sell or Share link. |
| Google Ads (via Google Tag Manager) | Conversion measurement and remarketing. | Pages and products viewed, conversion values, device and browser data. | Advertising — sharing | Do Not Sell or Share link, or Google's ad settings. |
| Klaviyo | Email marketing and on-site personalisation. | Email address if you give one, browsing and purchase history, an on-site tracking ID. | Advertising | Unsubscribe from emails, or the Do Not Sell or Share link. |
Functional and merchandising
These power specific features. They are not used to build advertising profiles.
| Vendor / technology | What it does | Data it receives | Category | How to turn it off |
|---|---|---|---|---|
| HubSpot Collected Forms | Captures what you enter in forms on this site so we can follow up on your enquiry. | The information you type into a form — see the note below. | Functional | Cookie preferences. |
| CsApps (Cirkle Studio) | Progressive web app and storefront features. | Pages viewed. | Functional | — |
A note on form capture
HubSpot Collected Forms records what you enter into forms on this site. Depending on configuration it can capture what you have typed into a field even if you never press submit. We use this only to follow up on genuine enquiries, we have configured it to exclude password and payment fields, and — like everything else in the analytics and advertising categories — it is switched off in California and Quebec unless you agree to it.
Shopify's own cookies. The platform sets cookies including _ab, _secure_session_id, cart, checkout_token, _shopify_s and _shopify_y to keep your session working and to produce aggregate statistics. Shopify's practices are at https://www.shopify.com/legal/privacy.
5. Selling and sharing
We would rather be blunt here than vague.
We share personal information for cross-context behavioural advertising. The advertising technologies in Section 4 receive identifiers and information about what you viewed and did, and use it to show you our ads elsewhere and measure whether they worked. Under California and several other state privacy laws this counts as "sharing", and some of it may count as a "sale" — even though no money changes hands for your data.
We do not sell personal information for money. We do not hand your name, email address, postal address or phone number to third parties for their own marketing.
We have not sold or shared the personal information of anyone we know to be under 16.
To stop it: Do Not Sell or Share My Personal Information, send GPC from your browser, or — in California and Quebec — decline advertising when we ask.
6. Your rights
Anyone, anywhere
- Switch off advertising and data sharing — the Do Not Sell or Share or Cookie preferences links in the footer.
- Stop marketing email — the unsubscribe link in any email.
- Stop marketing SMS — reply STOP to any message.
- Access, correct, or delete what we hold — email hello@tangerinecookies.com.
United States
Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia have some or all of these rights:
- Know / access what we hold, where we got it, why, and who we disclosed it to
- Delete personal information we hold about you
- Correct anything inaccurate
- Portability — a copy in a portable, machine-readable format
- Opt out of sale, sharing, targeted advertising, and profiling with legal or similarly significant effects
- Non-discrimination — exercising a right will never cost you a worse price or service
- Appeal — if we say no, you may appeal; we respond within the period your state allows and tell you how to complain to your Attorney General
Rights vary between states. We apply the broadest set we reasonably can to everyone.
California. You also have the right to know the categories collected, the sources, the business purposes and the categories of third parties — Sections 3, 4 and 5 set all of that out. You may use an authorised agent; we will ask for proof of authority and may ask you to verify your identity directly.
Canada
You may ask for access to your personal information and ask us to correct it, and withdraw consent to marketing at any time. Our commercial electronic messages comply with Canada's Anti-Spam Legislation (CASL): we send them only with consent and every message identifies us and carries a working unsubscribe.
Quebec. Technologies that identify, locate or profile you are off by default here. We ask before enabling them and you can change your answer at any time through Cookie preferences. You also have the right to request we stop disseminating your personal information, and the right to data portability.
Making a request
Email hello@tangerinecookies.com with "Privacy Request" in the subject line, or use the contact form at tangerinecookies.com/pages/contact. We acknowledge within 10 business days and respond within 45 days, extending once by a further 45 days if the request is complex — we will tell you if that happens. We verify identity by matching the email address or order details you give us against our records.
7. Who else receives information
Beyond the vendors in Section 4:
- Service providers working for us under contract — our platform, payment processors, shipping and delivery carriers, email and SMS providers, support tools and hosting. They may only use the information to provide their service to us.
- Professional advisers — accountants, auditors, lawyers, where needed.
- Authorities — where legally required, or to establish or defend legal claims, or to protect people or property.
- A buyer or successor — if the business is sold, merged or reorganised, personal information may transfer with it.
8. Children and teenagers
This site is for adults. We do not knowingly collect personal information from children under 13, we do not knowingly sell or share the personal information of anyone under 16, and we do not target advertising at anyone we know or reasonably should know is under 18.
If you believe a child has given us personal information, email hello@tangerinecookies.com and we will delete it.
9. How long we keep things
| Information | Kept for |
|---|---|
| Order and transaction records | 7 years from the order, for tax and accounting |
| Customer account details | Until you close the account or ask us to delete it, then 30 days |
| Marketing email and SMS lists | Until you unsubscribe, then 12 months, so we can honour the opt-out |
| Session recordings | 90 days |
| Customer support conversations | 3 years from the last message |
| Analytics and advertising identifiers | 14 months |
| Server and security logs | 90 days |
| Records of privacy requests | 2 years, as the law requires |
Where a legal obligation or an open dispute requires us to keep something longer, we keep only what that purpose needs.
10. Security
The site runs on Shopify, which holds PCI DSS Level 1 certification for payment handling. Traffic is encrypted in transit using TLS. Access to personal information is limited to people who need it for their work. No system is perfectly secure and we will not pretend otherwise, but if a breach affects your personal information we will notify you and the relevant regulators as the law requires.
11. Changes
We update this policy when our practices change, including whenever we add or remove a vendor from Section 4. The "last updated" date shows when it last changed. If we make a material change to how we use personal information, we will give notice on the site before it takes effect.
12. Contact
Tangerine Sweets LLC
Email: hello@tangerinecookies.com Contact form: tangerinecookies.com/pages/contact Website: tangerinecookies.com
Unhappy with our response? You may complain to your state Attorney General. In Canada, to the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec if you are in Quebec.
Configuration this policy assumes
For the Bower/client team — delete this section before pasting into Shopify.
- HubSpot Collected Forms is the item to look at first. It can capture text a visitor typed into a form without ever submitting it. That is captured communication content, which is exactly the §631 theory — a materially sharper risk than a plain pixel. Either disable it, or restrict it to explicit submissions and gate it behind consent. Section 4 currently promises the restricted behaviour; make it true.
-
You already have a HubSpot cookie banner script loading (
js-eu1.hs-banner.com) but no banner renders. HubSpot's consent banner is available on this store and simply is not switched on. That may be the quickest route to a banner here — but pick one consent system, HubSpot's or Shopify's, and make sure whichever you choose actually gates the theme scripts. Two half-configured banners is worse than one working one. - Clarity is consent-gated, masking set to Level 1 (strict), tag removed from checkout and account pages.
- Your current policy names the wrong company. The live policy's SMS section refers to "Agent84" — it was copied from another client's store. Publishing a policy naming a different business is a plain error and an easy thing for a demand letter to screenshot. Replace it wholesale.
- Postscript SMS. The current policy references Stodge, LLC d/b/a Postscript, but no Postscript script loads on the homepage. Confirm whether SMS is still live: if yes, add Postscript to the advertising table; if no, remove it from the SMS terms.
-
HubSpot is on EU infrastructure (
js-eu1), meaning this data lands in HubSpot's EU data centre. Not a problem, but worth knowing for a data-transfer question. - Cookie banner enabled for California and Quebec only.
- Data sale/sharing opt-out page live for the full US state list, link in the footer, plus a Cookie preferences link.
Optional addition
- Postal address. No mailing address is published anywhere on tangerinecookies.com, so this policy uses email plus the contact form as its two designated request methods — acceptable for an online-only business. If the client will publish an address, add it to Sections 1 and 12.