Privacy policy

Effective date: 8 September 2026 · Last updated: 8 September 2026

This policy explains what CandyDirect ("CandyDirect", "we", "us"), collects when you visit or buy from www.candydirect.com, how we use it, who we share it with, and the choices you have. California residents should also read our California Notice at Collection below, which describes what we collect at or before the point we collect it.

1. What we collect

Information you give us

• Orders and accounts: name, email address, phone number, billing and shipping addresses, order details, and any account login you create. Card numbers are handled by our payment processor; we do not receive or store full card numbers.
• Messages: what you send us by email or contact form.
• Marketing sign-ups: your email address when you subscribe or claim a discount, and your phone number if you give it to us and opt in to text messages.
• Reviews: the review text, rating, photos you upload, and the name you choose to display.

Information collected automatically

• Device and connection: IP address, browser type and version, operating system, screen size, language, and the approximate region the IP address points to.
• Site activity: pages and products viewed, searches, items added to cart, time on page, the site or ad that referred you, and errors.
• Cookies and similar technologies: described in section 3, which lists the places where non-essential cookies are not set until you accept them.

Information from others

• Payment and fraud signals from our payment processor and fraud-screening tools.
• Shipping status from carriers and from the supplier that ships some orders for us.
• Advertising measurement from Google about which ad brought you here, when you have allowed marketing cookies.

We may process limited information that California law treats as sensitive — such as account credentials and payment-related information — only as needed to provide and secure the services you ask for. We do not use or disclose it to infer characteristics about you. We do not knowingly collect information from children under 13.

2. How we use it

• To fill your order: process payment, screen for fraud, pack and ship (directly or through our supplier), send confirmations and delivery updates, handle returns and refunds.
• To support you: answer questions and resolve problems.
• To run and improve the site: cart, reviews, error diagnosis, and, with your consent where required, analytics about how the site is used.
• To market to you: newsletters and offers by email if you subscribe; text messages, if we are running them at the time and you opt in; and, with your consent where required, ads for our products on Google properties and the websites Google serves.
• To show social proof: notices on the site may show that an item was recently bought, with the purchaser's first name and city only. Tell us if you would prefer not to appear.
• To meet legal obligations: tax records, responding to lawful requests, enforcing our terms, and protecting the site and our customers.

We do not use your information to make automated decisions with legal or similarly significant effects.

We also produce anonymised, aggregated statistics — for example "3% of visitors bought gummies this week". These are not intended to identify you, and we may use and share them.

3. Cookies, the consent banner, and your choices

Group	What it does	Examples	Consent
Required	Cart, checkout, login, security, remembering your cookie choice	Shopify session and checkout cookies; _tracking_consent (stores your choice)	Cannot be switched off
Personalization	Optional. We have not identified a technology on this store in this category	—	Asked in the regions below
Analytics	Counts visits and shows us how the site is used	Google Analytics	Asked in the regions below
Marketing	Measures whether our ads worked and lets us show you our ads elsewhere; powers our email tool's on-site features	Google Ads, Klaviyo	Asked in the regions below

Where we ask first. If you visit from California, Pennsylvania, Florida, Canada, Australia, Japan, Hong Kong, the European Economic Area or the United Kingdom, a cookie banner appears on your first visit and we do not activate Analytics or Marketing processing until you consent. Some required or functional code still loads so the site works and the banner can be shown; it is not used for Analytics or Marketing unless your choice permits it. You can decline, or pick groups under Manage preferences.

Everywhere else, those technologies may operate by default unless you turn them off.

Changing your mind, anywhere. Your choice is stored in this browser. You can change it at any time from Manage cookie preferences in the site footer. Deleting this site's cookies erases the record of your choice rather than withdrawing it, and may return you to default processing where that applies, so use the preference control instead.

The cookies and similar technologies we use. Our Cookie notice describes those currently used or documented for this store, what they are for and their typical maximum durations. Not all measurement uses a cookie — pixels, tags, scripts, browser storage and server-side events are covered by the same choices where applicable.

Global Privacy Control. If your browser sends a recognised opt-out preference signal such as Global Privacy Control, we treat it as a request to opt out of sale and sharing for targeted advertising, for that browser or device and the profiles we can associate with it. We do not treat the absence of a signal on a later visit as permission to reverse an opt-out you already made. We do not respond to "Do Not Track" signals, which have no agreed meaning.

Opting out with the advertising companies directly. As well as our own controls, you can opt out with these companies:

• Google — My Ad Center and the Google Analytics opt-out browser add-on
• Microsoft — Microsoft advertising preferences
• Industry opt-out pages — YourAdChoices and the Network Advertising Initiative

These send you to each company's own site; they do not replace the choices you make here.

4. Who we share it with

• Store platform and payments: Shopify (hosting, checkout, fraud screening) and Shopify Payments, including Shop Pay and the wallet options shown at checkout; PayPal when you choose it; and OpenNode if you pay with Bitcoin. Shopify's Network Intelligence feature is switched on for this store. That means Shopify uses information about your visit and purchase here, together with data from other merchants on its platform and from Shopify itself, to improve the services it provides us — for example which payment methods appear first at checkout, fraud screening, and Shop app features. Your information may be handled by Shopify and its own providers in countries outside the United States. No other merchant can see your data. Shopify's own Consumer Privacy Policy explains what it does with it. California residents can opt out through Your privacy choices.
• Fulfilment and delivery: ShipStation (order routing and labels); Nassau Candy, our supplier, which ships some orders directly to you from New York and receives your name, address, phone number, and the items ordered; and carriers such as USPS, UPS, and FedEx.
• Email and text marketing: Klaviyo, which stores your name, email address, postal address, phone number, and your order and browsing activity on our site when you have allowed marketing cookies; and Shopify Email for some automated messages, such as abandoned-checkout reminders. Text messages, if you opt in, are also sent through Klaviyo.
• Customer support: Wufoo (SurveyMonkey), which hosts the contact form on our help page and receives everything you send through it — your name, email address, phone number, order number, your message, and any photo you attach.
• Site features: Fera (product reviews and photos), Helium Customer Fields (account registration forms), Hextom (announcement bar), Globo (menus), SC Easy Redirects (broken-link handling), and a PO Box checker that reads the delivery address you enter at checkout. Of these, Fera, Helium and the PO Box checker receive information that identifies you.
• Fraud screening: Beacon Fraud Prevention, which reviews order and device details to flag fraudulent orders.
• Order handling and records: Order Printer Pro (prints invoices and packing slips from your order), AOD Auto Tags (labels orders and customer records so we can sort them), and Klax Follow-Up (post-purchase follow-up email). Each receives the order details and contact information needed for that job.
• Advertising and analytics: Google (Google Analytics, Google Ads, Google Shopping through a product feed) and Microsoft Advertising, only when you have allowed those cookies. When you complete an order, we also send Google and Microsoft details of that order so they can match the purchase to the advertisement you saw. Google additionally receives contact and billing information including name and address; Microsoft receives your email address and phone number. Contact information is normalised and hashed before it is sent. Hashing is a safeguard for the transmission, not anonymisation — the advertising provider uses the hash to match your purchase against information it already holds.

Two different controls apply here, and they work differently. If you have not allowed marketing cookies, we do not send this information at all. If you have allowed them but later opt out of sale and sharing, the information may still be transmitted, but we instruct the provider to restrict how it may use it — it may no longer use it for its own purposes or to personalise advertising to you. - Google Customer Reviews: if you place an order, we pass your email address and order details to Google so it can invite you to review your purchase. You can ignore the invitation, and Google's own privacy policy governs what it does with your reply. - Professional advisers and authorities: lawyers, accountants, and public authorities when the law requires it or to protect our rights, our customers, or the public. - A buyer of the business, if the business or its assets are sold, under this policy.

We also use back-office software that can reach customer records but is not part of running the storefront — bulk import/export and automation tools used by our own staff. It is covered by the same contractual limits as everything above.

Links to other sites. Where we link to a site we do not run, that site's own privacy policy governs what it does with your information, not ours.

Selling and sharing. We do not sell personal information as "sale" is defined by the California Consumer Privacy Act. We do "share" it, in the sense used by California law, with Google and Microsoft for targeted advertising.

You have two separate controls, and they are not the same thing. Cookie choices decide whether Analytics and Marketing technologies are activated in your browser — change them from Manage cookie preferences in the footer. Sale and sharing choices are a legal opt-out from targeted advertising, exercised through Your privacy choices or a recognised opt-out preference signal. Their practical effects overlap, but they are different rights and we treat them separately.

We do not sell or share the personal information of consumers we know to be under 16 without the authorisation the law requires.

5. Email and text messages

• Email: every marketing email has an unsubscribe link. Order and delivery emails are sent regardless, because they are part of your purchase.
• Text messages: if you give us your mobile number and opt in — at checkout or on a sign-up form — we may send you marketing text messages through Klaviyo. Reply STOP to any message to stop, or HELP for help. Message and data rates may apply; frequency varies. Consent to texts is never a condition of buying anything.

Email sign-up — what we collect, and the terms of the offer

You may have arrived here directly from the Privacy Policy link on our email sign-up form. If so, this section covers that form. It is part of our full privacy policy — the rest of the page explains everything else we collect, who we share it with, how long we keep it, and the rights you have. Section 9 tells you how to make a request.

What we collect, and what we do with it. When you sign up we collect your email address and the fact and date that you signed up. We use it to send you marketing emails and to issue and honour the discount code described below. It is held by us and by Klaviyo, the email provider listed in section 4, for as long as section 6 says. Every marketing email has an unsubscribe link, and unsubscribing costs you nothing else — see the last bullet below.

Notice of financial incentive. We offer a discount in return for joining our email list. California law calls that a "financial incentive" and asks us to describe it.

• What you get. A single-use code for $10 off an order of $100 or more, valid for 14 days, one per customer, not combinable with other order discounts.
• What we collect for it. Your email address, and the fact that you signed up. If you use the code, it links your sign-up to that order.
• How to join, and how to leave. Enter your email in the sign-up form. To leave, use the unsubscribe link in any email, or contact us; an unused code simply expires.
• Is it sold or shared? The email address you give here is used to send you our messages and to issue and administer the code. It is not sold for money. It is not used for targeted advertising unless you have also allowed marketing cookies, and you can opt out at any time through Your privacy choices.
• How long we keep it. As set out in section 6: while you remain subscribed, and afterwards a minimal suppression record so we can honour your unsubscribe.
• Your choices. Use Your privacy choices in the footer to opt out of sale and sharing for targeted advertising, and Manage cookie preferences to change your cookie choice.
• What we think your information is worth, and how we worked it out. We estimate the value of an email address given to us through this offer at about 45 cents. We calculate it from what the offer actually costs us: over the period since 3 July 2026 we issued 3,660 codes and 165 were redeemed, so the discounts we funded came to $1,650, which is about $0.45 for each person who joined. We do not sell email addresses, so they have no resale value to us.
• Why the difference in price is reasonable. The discount is worth more to you than your email address is worth to us. We offer it because a subscriber may buy again, not because the address itself is valuable, and we think that is a fair exchange to put in front of you plainly.
• It changes nothing else. You can shop without joining. Joining, declining, or leaving later does not change the price of anything else, what you can buy, or the service you get.

6. How long we keep it

We keep personal information for as long as we need it for the purposes described above, and then delete or anonymise it. Rather than fix an arbitrary number of months to each kind of information, we work to the criteria below — what the information is for, and what has to be true before it can go:

Information	How long
Orders, invoices, and payment records	For as long as tax, accounting and consumer-protection rules require us to keep them, and while a return, dispute or warranty claim could still arise
Your account	Until you delete it or ask us to
Marketing profile (email, phone, preferences, on-site activity)	While you are subscribed. When you unsubscribe we stop using it to market to you
Suppression record after you unsubscribe	A minimal record kept as long as reasonably necessary to honour your opt-out and meet legal obligations
Support messages	While we are dealing with your request, and afterwards while it could reasonably come back — for example a related return, dispute or warranty claim
Reviews	Until you ask us to remove them
Google Analytics event data	14 months (the retention setting in GA4)
Cookie consent choice	Until it expires or you change it. The cookie that records it currently lasts about a year and may renew with use

We may keep information longer where the law requires it, to establish or defend legal claims, or where it sits in routine backups that are overwritten on a schedule.

7. Security

We use Shopify's PCI-compliant checkout, encrypt data in transit, restrict staff access to what each person needs for their work, and we do not store full card numbers. No system is perfectly secure; if a breach affects you we will notify you as the law requires.

8. Children

Our services are not intended for children under 13, and we do not knowingly collect personal information from children under 13. We do not knowingly sell or share the personal information of consumers under 16 without the authorisation the law requires. If you believe a child has given us information, contact us and we will look into it and delete what we are able to.

9. Your privacy rights

Depending on where you live, the law may give you rights to access, correct, delete or obtain a copy of your personal information, or to opt out of certain processing. California rights are set out below. We honour these requests for every United States resident, not only where a law requires it. Our Your privacy choices page is active nationwide, and we run the same request process for everyone. We will not treat you differently for exercising a right.

California residents have these additional rights under the California Consumer Privacy Act:

• To know the categories and specific pieces of personal information we have collected about you, where we got it, why we use it, and who we have shared it with.
• To delete and to correct your personal information, subject to legal exceptions.
• To opt out of sale or sharing for targeted advertising: use Your privacy choices in the footer, or turn on Global Privacy Control in your browser.
• Not to be discriminated against for exercising any right.
• Shine the Light: you may ask once a year whether we disclosed personal information to third parties for their own direct marketing during the preceding calendar year. Requests may be sent to the contact details in section 11.

California Notice at Collection — what we collect now

This section is our notice at collection. It describes what we collect at or before the point we collect it, why, and whether it is sold or shared. Retention is in section 6; the full policy is above and below.

California category	What that means here	Why we collect it	Sold?	Shared for targeted advertising?	How long
Identifiers	name, email address, phone number, postal address, IP address, online identifiers	orders, delivery, support, security, marketing, advertising measurement	No — we do not sell personal information for money. We offer the opt-out below for these disclosures regardless of how they are classified	Yes — with Google and Microsoft, only where you have allowed marketing cookies	section 6
Customer-records information	billing and shipping details; payment information handled by our processor	payment, fulfilment, fraud screening, records	No — we do not sell personal information for money. We offer the opt-out below for these disclosures regardless of how they are classified	Yes, on a completed order only — name, email, phone and billing address for conversion matching	section 6
Commercial information	orders, carts, reviews, discount code use	fulfil orders, support, analytics, measurement	No — we do not sell personal information for money. We offer the opt-out below for these disclosures regardless of how they are classified	Yes, on a completed order only — the order details	section 6
Internet or network activity	pages and products viewed, searches, referring site or advert, errors	run the site, analytics, security, advertising	No — we do not sell personal information for money. We offer the opt-out below for these disclosures regardless of how they are classified	Yes — with Google and Microsoft, only where you have allowed marketing cookies	section 6
Sensory or visual information	photos you attach to a support request or to a product review	answering your message and publishing your review	No	No	section 6
Sensitive personal information	account credentials, and payment-related information, where California law classifies them that way	account access, payment, security and fraud prevention	No — we do not sell personal information for money. We offer the opt-out below for these disclosures regardless of how they are classified	No	section 6

We do not collect protected classifications, precise geolocation, biometric information or health data.

We do not sell personal information for money. Where the table says we share a category for targeted advertising, the opt-out below applies to it. We also apply that opt-out to advertising-related disclosures that may not meet the legal definition of a sale or a share, so you do not have to know which is which.

Sensitive personal information. We use and disclose it only for the purposes listed above, which are permitted purposes under California law.

Your choices. Use the Your privacy choices link in the footer to opt out of sale and sharing for targeted advertising, and Manage cookie preferences to change your cookie choice. Those are separate controls. You can also email customercare@candydirect.com.

California disclosure for the 12 months before this policy took effect

Separate from the notice above, which describes what we do now. California requires us also to report the preceding twelve months.

Table A — categories we collected

Category	Examples collected in that period	Where it came from	Business or commercial purpose
Identifiers	name, email, phone, postal address, IP address, online identifiers	you; your device; our service providers	orders, support, security, marketing, measurement
Customer-records information	billing and shipping details	you; our payment processor	payment, fulfilment, fraud screening
Commercial information	orders, carts, reviews, discount use	you; your device	fulfilment, support, analytics
Internet or network activity	pages viewed, searches, referring advert	your device; our analytics and advertising providers	site operation, analytics, advertising
Sensory or visual information	photos you attach to a support request or to a product review	you	support and reviews

Table B — categories sold or shared, and who received them

Category	Categories of third party that received it	Purpose
Identifiers	advertising networks and data-analytics providers — Google, Microsoft, Mailchimp and OptinMonster. Mailchimp and OptinMonster were removed on 3 September 2026; Google and Microsoft remain in use	cross-context behavioural advertising and measurement
Internet or network activity	advertising networks and data-analytics providers — Google, Microsoft, Mailchimp and OptinMonster. Mailchimp and OptinMonster were removed on 3 September 2026; Google and Microsoft remain in use	cross-context behavioural advertising and measurement
Customer-records and commercial information, on completed orders	advertising networks — Google and Microsoft	conversion measurement

Our email, store-platform and reviews providers act as service providers or processors under their own terms, and are listed in Table C rather than here. Google and Microsoft receive information for targeted advertising and are listed above. Where you opt out, Google is instructed to process your information in a restricted mode, as its own terms provide.

Table C — categories disclosed for a business purpose

Category	Categories of recipient	Business purpose
Identifiers, customer-records, commercial information	store platform and payments, fulfilment and delivery, customer support, fraud screening	taking, paying for, packing and delivering your order, and answering you about it
Identifiers and marketing preferences	email marketing provider	sending the messages you asked for
Internet or network activity	analytics and site-feature providers	running and measuring the site
All of the above	professional advisers and public authorities	legal obligations and defending claims

The specific companies in each category are named in section 4.

Minors. We do not have actual knowledge that we sell or share the personal information of consumers under 16.

Sensitive personal information. We did not use or disclose it for purposes outside those California permits.

To make a request: email customercare@candydirect.com, use the Your privacy choices page, or write to the address below.

Opting out of sale or sharing does not require us to verify who you are. Use Your privacy choices, or send a recognised opt-out preference signal; we act on it promptly and in any event within the 15 business days California allows. For requests to know, correct or delete we do need to confirm it is your information: we will use details from your order or account where you have one, and proportionate alternatives where you do not. You may use an authorised agent; we will ask for proof of authority.

We will confirm receipt of a California request to know, delete or correct within 10 business days and tell you how we verify it and when to expect a substantive answer. We generally respond within 45 calendar days, and where reasonably necessary and permitted by law we may extend that by up to a further 45 days and will tell you why. If applicable law gives you a right to appeal a decision on a privacy request, our response will tell you how to appeal and how long we will take. If you need this notice in another format because of a disability, contact us and we will work with you to provide it in a format you can use.

If you are outside the United States. We ship to Canada, Australia, Japan and Hong Kong, and visitors reach us from elsewhere. Wherever you are, we are a United States company and we store and process your information in the United States, which means it may be accessible to US courts, law enforcement and other authorities under US law. We and our service providers may also process and store personal information in other countries in which they operate, and those countries may have privacy laws that differ from the laws where you live. We require service providers to handle personal information consistently with their contractual obligations and applicable law, as appropriate to their role.

Whichever of these applies to you, you may ask us to see, correct, delete or export your information, object to or restrict how we use it, and withdraw any consent you gave — including your cookie choice, which you can change at any time from Manage cookie preferences in the footer. Contact us below, and see section 9 above for how we handle requests.

• Canada. Your information is stored and processed in the United States and is subject to US law while it is there. You may complain to the Office of the Privacy Commissioner of Canada, or to your provincial regulator.
• Australia. We disclose your information to overseas recipients — principally in the United States — including the service providers listed in section 4. You may complain to us first, and then to the Office of the Australian Information Commissioner.
• Japan and Hong Kong. Your information is transferred to and held in the United States by us and by the service providers in section 4, for the purposes described in section 2.
• The United Kingdom and the European Economic Area. We do not sell or ship to the UK or the EEA — our online store does not accept orders from there — but the cookie banner still applies to visitors, and analytics and marketing cookies run only with your consent, which you may withdraw at any time.

10. Changes

We will post changes here and update the date at the top. Where the law requires us to give you additional notice before a change takes effect, we will give it in the way the law requires.

11. Contact

CandyDirect, 9190 W Olympic Blvd #269, Los Angeles, CA 90212 Email: customercare@candydirect.com