PRIVACY POLICY

Last Updated and Effective Date: October 2, 2026

Heart Made of Gold, Inc. (“Heart Made of Gold,” “we,” “us,” or “our”) respects your privacy and is committed to transparency regarding how we collect, use, disclose, and protect personal information.

This Privacy Policy describes our privacy practices when you visit or interact with www.heartmadeofgold.com (the “Site”), purchase our products, communicate with us, subscribe to marketing communications, interact with us through social media, or otherwise use our products and services (collectively, the “Services”).

This Privacy Policy also explains the choices and privacy rights that may be available to you.

Please read this Privacy Policy carefully. Your use of the Site is also subject to our Terms of Use.

Where applicable law requires consent for certain processing, including the use of non-essential cookies, pixels, analytics technologies, or advertising technologies, we request that consent through our privacy controls. We do not treat merely visiting or continuing to browse the Site as affirmative consent where affirmative consent is required by law.

1. PERSONAL INFORMATION WE COLLECT

The personal information we collect depends on how you interact with us and the Services you use.

Information You Provide Directly to Us

We may collect information you voluntarily provide when you:

• purchase or attempt to purchase a product;

• create or use a customer account;

• contact customer service;

• submit a contact form;

• communicate with us by email, telephone, text message, chat, or social media;

• subscribe to email or SMS marketing;

• participate in a promotion, giveaway, survey, or other program;

• submit a review or other content; or

• otherwise provide information to us.

This information may include:

• name;

• billing address;

• shipping address;

• email address;

• telephone number;

• account information;

• order and transaction information;

• product preferences;

• communications with us;

• reviews or other content you submit; and

• other information you choose to provide.

Payment Information

Payments made through our Site may be processed by Shopify, financial institutions, payment processors, or digital payment providers.

Depending on your chosen payment method, payment information may include credit or debit card information, Shop Pay information, Apple Pay, Google Pay, PayPal, or other payment credentials.

Heart Made of Gold generally does not directly store complete payment-card numbers. Payment information is processed by the applicable payment provider in accordance with its privacy and security practices.

Information Collected Automatically

When you visit or interact with our Site, we and companies that provide services to us may automatically collect information about your device and activity.

This information may include:

• Internet Protocol (“IP”) address;

• browser type and version;

• device type;

• operating system;

• approximate location derived from an IP address;

• referring website or source;

• pages viewed;

• links clicked;

• products viewed;

• searches performed;

• shopping-cart activity;

• checkout activity;

• date and time of visits;

• interactions with our Site;

• advertising identifiers;

• cookie identifiers;

• analytics identifiers;

• referral or campaign information;

• information regarding advertisements with which you interacted; and

• other Internet or electronic network activity information.

We may collect this information using cookies, pixels, tags, APIs, server logs, local storage, software development kits, and similar technologies.

2. COOKIES AND SIMILAR TECHNOLOGIES

Cookies are small files or pieces of information placed on or associated with a browser or device.

We use cookies and similar technologies for purposes including:

• operating our Site;

• maintaining shopping carts and checkout functionality;

• remembering privacy and other preferences;

• maintaining security;

• preventing fraud;

• measuring Site usage and performance;

• understanding how visitors interact with our Site;

• measuring advertising performance; and

• supporting advertising and marketing activities.

These technologies may be provided directly by Heart Made of Gold, Shopify, or other third parties.

Strictly Necessary Technologies

Strictly necessary technologies are used to provide functionality that is necessary for our Site and Services to operate.

They may be used for purposes including:

• maintaining a shopping cart;

• providing checkout functionality;

• processing transactions;

• maintaining account sessions;

• remembering privacy preferences;

• maintaining Site security;

• preventing fraud;

• authenticating users; and

• providing functionality you request.

These technologies may operate without a separate advertising or analytics consent choice where permitted by applicable law because they are necessary to provide the Site or Services you request.

Preference Technologies

Preference technologies may help our Site remember choices you make and provide enhanced or personalized functionality.

Where required by applicable law, these technologies are used only after the applicable permission has been obtained.

Analytics Technologies

We may use analytics technologies to understand how customers and visitors use our Site and to improve the performance and operation of our Services.

These technologies may collect information such as:

• pages viewed;

• Site interactions;

• referring sources;

• device and browser information;

• approximate location;

• analytics identifiers; and

• information about how visitors navigate our Site.

We may use Google Analytics and similar analytics services for these purposes.

Where affirmative consent is required by applicable law or by the privacy settings we make available, analytics technologies requiring such consent are not activated until the applicable consent has been obtained.

Advertising and Marketing Technologies

We may use advertising, marketing, attribution, and measurement technologies provided by companies including:

• Meta Platforms, Inc., including Meta/Facebook advertising technologies;

• Pinterest, including the Pinterest Tag;

• Google, including Google Ads and related advertising and measurement technologies; and

• other advertising, social-media, attribution, or marketing providers that we may use from time to time.

These technologies may help us:

• measure advertising effectiveness;

• determine whether an advertisement led to a Site visit or purchase;

• measure conversion events;

• understand interactions with our Site;

• create or measure advertising audiences;

• attribute purchases or Site activity to advertising campaigns;

• prevent repeatedly displaying the same advertisement;

• measure marketing performance; and

• personalize advertising where permitted by law and your privacy choices.

Depending on the technology and your choices, information made available to these companies may include:

• IP address;

• page URL;

• browser information;

• device information;

• cookie identifiers;

• advertising identifiers;

• Site interactions;

• products viewed;

• purchase or conversion information; and

• similar Internet or electronic network activity.

Where affirmative consent is required by applicable law or by our applicable consent settings, non-essential advertising and marketing technologies requiring such consent are not activated until the applicable consent has been obtained.

3. COOKIE AND PRIVACY CHOICES

We provide controls that allow visitors to manage certain non-essential cookies and similar technologies.

Depending on your location and our applicable privacy settings, our consent interface may allow you to:

• accept non-essential technologies;

• reject non-essential technologies; and

• manage individual privacy preferences.

You may also be able to change your choices through the Cookie Preferences option available on our Site.

Rejecting non-essential technologies does not prevent strictly necessary technologies from operating and generally should not prevent you from using the basic shopping and checkout functions of the Site.

Your browser may also allow you to block or delete cookies. Browser controls may affect functionality on our Site and other websites.

Withdrawing consent does not affect the lawfulness of processing that occurred before consent was withdrawn.

4. GLOBAL PRIVACY CONTROL AND OPT-OUT PREFERENCE SIGNALS

Some browsers, browser extensions, and devices allow users to transmit legally recognized opt-out preference signals, including the Global Privacy Control (“GPC”).

Where required by applicable law, we recognize and process qualifying opt-out preference signals as requests to opt out of:

• the sale of personal information;

• the sharing of personal information for cross-context behavioral advertising; and/or

• targeted advertising,

as applicable to the law governing the request.

Because an opt-out preference signal generally applies to the browser or device transmitting the signal, you may need to enable the preference separately on each browser or device you use.

5. HOW WE USE PERSONAL INFORMATION

We may use personal information for the following purposes:

Providing Our Services

We may use information to:

• operate the Site;

• process and fulfill orders;

• process payments;

• arrange shipping and delivery;

• provide order confirmations and updates;

• process returns and exchanges;

• maintain customer accounts; and

• provide requested products and Services.

Customer Service and Communications

We may use information to:

• respond to questions;

• communicate regarding orders;

• provide customer support;

• address complaints or disputes;

• process warranty claims; and

• otherwise communicate with you regarding our relationship.

Security and Fraud Prevention

We may use information to:

• authenticate transactions;

• detect potentially fraudulent activity;

• protect accounts;

• maintain Site security;

• investigate suspicious activity; and

• protect Heart Made of Gold, our customers, and others.

Analytics and Improvement

We may use information to:

• understand Site usage;

• troubleshoot technical problems;

• measure Site performance;

• improve the customer experience;

• develop or improve our products and Services; and

• understand customer preferences.

Advertising and Marketing

Subject to applicable law and your privacy choices, we may use information to:

• send email or SMS marketing;

• measure advertising campaigns;

• understand marketing effectiveness;

• create advertising audiences;

• perform attribution;

• personalize advertising; and

• promote our products and Services.

Legal and Business Purposes

We may also use information to:

• maintain business and financial records;

• enforce agreements and policies;

• protect our legal rights;

• comply with applicable law;

• respond to lawful government or regulatory requests;

• establish, exercise, or defend legal claims;

• comply with tax, accounting, and recordkeeping requirements; and

• evaluate or complete a merger, acquisition, financing, restructuring, sale, or similar business transaction.

We may use information for another purpose when disclosed to you at the time of collection or when permitted by law.

6. HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information to the following categories of recipients.

Shopify and Ecommerce Service Providers

Our Site is hosted and supported through Shopify.

Shopify may process information about your interactions with our Site and purchases to provide ecommerce, hosting, payment, fraud-prevention, analytics, personalization, and other services to us.

Depending on the Shopify services and features enabled for our store, Shopify may process information from your interactions with our store together with information from interactions with Shopify or other merchants to provide enhanced services, personalization, analytics, fraud prevention, or advertising-related functionality.

Where required by law, applicable consent and opt-out choices are communicated to Shopify through our privacy controls.

For additional information regarding Shopify's processing of personal information, please review the Shopify Consumer Privacy Policy and Shopify's privacy portal.

Payment Providers

We may disclose information to:

• payment processors;

• banks;

• financial institutions; and

• digital payment platforms

as reasonably necessary to complete transactions, prevent fraud, process refunds, and provide related payment services.

Shipping and Fulfillment Providers

We may disclose information including your name, shipping address, email address, telephone number, and order information to:

• shipping carriers;

• warehouses;

• fulfillment providers; and

• other companies involved in fulfilling and delivering your purchases.

Marketing and Communications Providers

We may disclose information to companies that assist us with:

• email communications;

• SMS communications;

• customer relationship management;

• marketing;

• promotions;

• customer engagement; and

• similar services.

Advertising, Analytics, and Social-Media Providers

Subject to applicable law and your privacy choices, we may disclose or make available certain identifiers, commercial information, and Internet or electronic network activity information to companies providing:

• analytics;

• advertising;

• attribution;

• campaign measurement;

• social-media;

• audience measurement; and

• marketing services.

These providers may include Google, Meta, Pinterest, and similar providers.

Professional Advisers

We may disclose information where reasonably necessary to:

• attorneys;

• accountants;

• auditors;

• insurers;

• consultants; and

• other professional advisers.

Legal, Regulatory, and Safety Disclosures

We may disclose information when we reasonably believe disclosure is necessary to:

• comply with applicable law;

• respond to a lawful subpoena, warrant, court order, or governmental request;

• cooperate with law enforcement or regulators;

• investigate or prevent fraud;

• protect the security of our Services;

• protect the rights, safety, or property of Heart Made of Gold, our customers, or others; or

• establish, exercise, or defend legal claims.

Business Transactions

If Heart Made of Gold is involved in a merger, financing, acquisition, restructuring, bankruptcy, sale of assets, or similar transaction, personal information may be transferred or disclosed in connection with that transaction.

7. SALE, SHARING, AND TARGETED ADVERTISING

We do not sell personal information in exchange for money.

However, certain U.S. privacy laws define terms such as “sale,” “share,” “sharing,” or “targeted advertising” broadly.

As a result, making information available to advertising, analytics, or social-media providers through technologies such as cookies and pixels may be considered:

• a “sale” of personal information;

• “sharing” for cross-context behavioral advertising; or

• processing for targeted advertising

under certain state privacy laws, even when no money is exchanged.

Categories of personal information potentially involved in these activities may include:

• identifiers;

• IP addresses;

• cookie or advertising identifiers;

• device information;

• Internet or electronic network activity;

• commercial information; and

• inferences based on online activity.

Recipients may include advertising networks, analytics providers, and social-media platforms.

Where applicable law provides a right to opt out, you may exercise that right using the Cookie Preferences and/or Do Not Sell or Share My Personal Information mechanism available on our Site.

We also process qualifying opt-out preference signals, including GPC, where required by applicable law.

8. SHOPIFY NETWORK INTELLIGENCE AND ENHANCED SERVICES

Shopify offers certain enhanced services that may use information about customer interactions with Shopify merchants to help provide features such as:

• fraud prevention;

• personalization;

• analytics;

• improved commerce services; and

• advertising-related functionality.

If Shopify Network Intelligence or related Enhanced Services are enabled for our store, information about your interactions with our Site may be processed by Shopify together with information from your interactions with Shopify or other Shopify merchants.

Such processing may involve Shopify or other service providers located in jurisdictions outside your state or country.

Where applicable law provides a right to opt out of the sale or sharing of personal information or targeted advertising, we provide applicable privacy controls.

You may also review Shopify's Consumer Privacy Policy and use Shopify's privacy portal to learn more about Shopify's privacy practices and rights available directly through Shopify.

9. EMAIL AND SMS MARKETING

If you subscribe to marketing communications, we may use information such as your:

• email address;

• telephone number;

• purchase history;

• product preferences; and

• permitted online activity

to provide marketing communications.

You may unsubscribe from marketing emails using the unsubscribe mechanism included in those emails.

You may opt out of SMS marketing by following the instructions included in the applicable message, including replying STOP where available.

Marketing opt-outs do not prevent us from sending non-marketing communications that are necessary to provide Services, including:

• order confirmations;

• shipping notifications;

• customer-service communications;

• account notifications;

• security messages; and

• other transactional communications.

10. VISITOR IDENTIFICATION SERVICES

We may use service providers that help us understand visitors to our Site for purposes such as:

• marketing;

• analytics;

• attribution;

• fraud prevention;

• customer service; or

• related business functions.

Depending on the provider and applicable privacy choices, information processed through these services may include:

• IP addresses;

• cookies;

• browser identifiers;

• device identifiers;

• online activity;

• hashed or pseudonymized identifiers; and

• hashed versions of email addresses or other identifiers.

Where applicable law requires consent or provides an opt-out right for these activities, we provide the applicable privacy choice.

11. SOCIAL MEDIA AND THIRD-PARTY SERVICES

Our Site may contain links, features, widgets, plug-ins, or integrations provided by third-party companies.

Those services may collect information such as:

• IP address;

• browser or device information;

• pages viewed; and

• interactions with the applicable feature.

When you interact directly with a third-party website or service, that company's independent privacy practices apply.

We encourage you to review the privacy notices of third-party services before providing information to them.

12. DATA RETENTION

We retain personal information for only as long as reasonably necessary and proportionate to accomplish the purposes for which it was collected or as otherwise required or permitted by law.

Retention periods may depend on:

• the type of information;

• the purposes for which it was collected;

• the sensitivity of the information;

• whether you maintain an account or ongoing relationship with us;

• order-fulfillment requirements;

• customer-service requirements;

• warranty, return, and exchange periods;

• fraud-prevention and security needs;

• accounting and financial requirements;

• tax obligations;

• contractual obligations;

• legal and regulatory requirements;

• applicable statutes of limitation;

• actual or anticipated disputes or litigation; and

• legal obligations to preserve information.

When personal information is no longer reasonably necessary, we may delete, deidentify, anonymize, or otherwise dispose of it in accordance with applicable law and our data-retention practices.

13. DATA SECURITY

We use reasonable administrative, technical, physical, and organizational safeguards designed to protect personal information.

However, no Internet transmission, electronic system, or method of storing information can be guaranteed to be completely secure.

We therefore cannot guarantee the absolute security of personal information.

You are responsible for protecting passwords or other credentials associated with any account you maintain with us.

14. CHILDREN'S PRIVACY

Our Site and Services are intended for a general audience and are not directed to children under 13 years of age.

We do not knowingly collect personal information directly from children under 13 without legally required parental consent.

If we learn that we collected personal information from a child under 13 in circumstances in which parental consent was legally required, we will take reasonable steps to delete the information.

We do not knowingly sell or share personal information belonging to consumers under 16 in circumstances where applicable law requires affirmative authorization.

15. YOUR U.S. STATE PRIVACY RIGHTS

Depending on your state of residence, the nature of our relationship with you, and whether a particular privacy law applies to Heart Made of Gold, you may have rights concerning your personal information.

These rights may include the right to:

• confirm whether we process your personal information;

• access personal information;

• obtain information concerning our collection, use, and disclosure practices;

• request correction of inaccurate personal information;

• request deletion of personal information;

• obtain certain personal information in a portable format;

• opt out of the sale of personal information;

• opt out of sharing for cross-context behavioral advertising;

• opt out of targeted advertising;

• opt out of certain qualifying profiling activities;

• limit certain uses or disclosures of sensitive personal information;

• withdraw consent where processing relies on consent;

• appeal certain decisions regarding privacy requests; and

• exercise privacy rights without unlawful discrimination.

These rights are subject to applicable limitations, exceptions, verification requirements, and legal thresholds.

Submitting a Privacy Request

You may submit a privacy request by contacting:

Email: contact@heartmadeofgold.com

You may also use privacy-request tools made available through our Site, including our applicable Cookie Preferences or Do Not Sell or Share My Personal Information mechanism.

Please identify the privacy right you wish to exercise and provide enough information for us to understand and process your request.

Verification

We may need to verify your identity before processing certain requests.

The information required for verification will depend on:

• the nature of the request;

• the information involved;

• applicable law; and

• the risk associated with unauthorized disclosure or deletion.

Information provided for verification will be used only as reasonably necessary to verify and process the request or as otherwise permitted by law.

Authorized Agents

Where permitted by applicable law, you may authorize another person to submit a privacy request on your behalf.

We may request reasonable documentation showing that the agent has permission to act for you and may require you to verify your identity directly with us where permitted by law.

Appeals

If applicable law gives you a right to appeal our decision concerning a privacy request, you may submit an appeal to:

contact@heartmadeofgold.com

Please indicate that your message is a Privacy Request Appeal and provide sufficient information for us to review the request and our prior decision.

16. ADDITIONAL NOTICE FOR CALIFORNIA RESIDENTS

This section supplements the remainder of this Privacy Policy for California residents where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies.

Categories of Personal Information

Depending on your interactions with us, we may collect the following categories of personal information:

Identifiers

Examples include:

• name;

• postal address;

• email address;

• telephone number;

• IP address;

• account identifiers;

• online identifiers; and

• device or cookie identifiers.

California Customer Records Information

Examples may include:

• contact information;

• billing information; and

• transaction information.

Commercial Information

Examples include:

• products purchased;

• products considered;

• products viewed;

• transaction history;

• shopping-cart activity; and

• purchasing preferences.

Internet or Other Electronic Network Activity

Examples include:

• browsing activity;

• Site interactions;

• referral information;

• advertising interactions; and

• device and browser information.

Geolocation Information

We may collect approximate location information derived from IP addresses.

We do not intentionally collect precise geolocation information through the ordinary operation of our online store unless separately disclosed.

Audio, Electronic, or Visual Information

We may process this information if you voluntarily provide photographs, recordings, or similar information in communications with us.

Professional or Employment-Related Information

We may collect this information where relevant to a business relationship or employment inquiry.

Inferences

We may derive inferences regarding interests or preferences from purchases, products viewed, or other interactions with our Site.

Sensitive Personal Information

We may process limited information that may qualify as sensitive personal information where necessary for transactions, account security, fraud prevention, payment processing, or other permitted purposes.

We do not use or disclose sensitive personal information for the purpose of inferring characteristics about consumers except where permitted or separately disclosed.

Sources of Personal Information

We may collect personal information from:

• you;

• your browser or device;

• Shopify;

• payment providers;

• shipping and fulfillment companies;

• analytics providers;

• advertising platforms;

• social-media services;

• marketing and communications providers;

• fraud-prevention and security providers; and

• other service providers and business partners.

Business and Commercial Purposes

We collect and use personal information for the purposes described throughout this Privacy Policy, including:

• providing products and Services;

• processing transactions;

• order fulfillment;

• customer service;

• fraud prevention;

• security;

• analytics;

• advertising;

• marketing;

• Site improvement;

• legal compliance; and

• business administration.

Categories of Recipients

We may disclose applicable categories of personal information to:

• service providers;

• contractors;

• Shopify;

• payment providers;

• shipping and fulfillment providers;

• communications providers;

• security providers;

• advertising companies;

• analytics providers;

• social-media platforms;

• professional advisers;

• government or regulatory authorities where legally required; and

• parties involved in qualifying corporate transactions.

Sale and Sharing

We do not sell personal information for money.

However, our use of online advertising technologies may constitute a “sale” or “sharing” of personal information under the CCPA's definitions.

Categories potentially sold or shared for these purposes may include:

• identifiers;

• Internet or electronic network activity;

• commercial information; and

• inferences.

Categories of recipients may include:

• advertising networks;

• analytics providers; and

• social-media platforms.

These activities are generally used for advertising, attribution, analytics, campaign measurement, and related marketing purposes.

California Privacy Rights

Subject to applicable exceptions and verification requirements, California residents may have the right to:

• know the categories of personal information we collect;

• know the categories of sources from which personal information is collected;

• know the purposes for collecting, selling, or sharing personal information;

• know the categories of third parties to whom information is disclosed;

• access specific pieces of personal information;

• request deletion;

• request correction;

• opt out of sale or sharing;

• limit certain uses or disclosures of sensitive personal information where applicable; and

• receive equal service and pricing without unlawful discrimination for exercising privacy rights.

Right to Opt Out of Sale or Sharing

California residents may opt out of the sale or sharing of personal information through our Do Not Sell or Share My Personal Information and/or Cookie Preferences mechanism.

Where required by the CCPA, we also recognize qualifying Global Privacy Control signals as requests to opt out of sale or sharing for the browser or device transmitting the signal.

You are not required to create an account in order to exercise your right to opt out.

Retention

We retain each category of personal information only for as long as reasonably necessary and proportionate for the purposes for which it was collected or as otherwise permitted by law.

The criteria used to determine our retention periods are described in the Data Retention section above.

Financial Incentives and Loyalty Programs

From time to time, we may offer discounts, promotions, loyalty programs, or other benefits that involve the collection of personal information.

If an offer constitutes a financial incentive or price or service difference regulated by applicable privacy law, we will provide any required separate notice describing the material terms before you participate.

Participation in such a program is voluntary, and where required by law you may withdraw from the program in accordance with the terms provided with the offer.

California “Shine the Light”

California Civil Code Section 1798.83 may provide certain California residents with rights relating to disclosures of personal information to third parties for those third parties' direct-marketing purposes.

Where applicable, you may submit a request using the contact information provided below.

17. DO NOT TRACK

Some browsers offer a traditional “Do Not Track” (“DNT”) setting.

Because there is not currently a universally adopted standard for responding to traditional DNT signals, our Site may not respond to DNT signals.

Traditional DNT is different from legally recognized opt-out preference signals such as Global Privacy Control.

Where required by applicable law, we process qualifying opt-out preference signals as described in this Privacy Policy.

18. INTERNATIONAL AND CROSS-BORDER PROCESSING

Heart Made of Gold and the companies that provide services to us may process personal information in locations outside the state or country in which you reside.

Privacy and data-protection laws may differ among jurisdictions.

Where legally required, we use appropriate mechanisms or contractual protections relating to transfers of personal information.

19. THIRD-PARTY WEBSITES

Our Site may contain links to websites, applications, or services operated by third parties.

We do not control the privacy, security, or information practices of independent third parties.

This Privacy Policy does not apply to information independently collected by those third parties.

We encourage you to review the privacy notices of third-party websites and services before providing information to them.

20. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in:

• our business practices;

• our Services;

• technology;

• vendors;

• privacy practices; or

• applicable legal requirements.

When we update the Privacy Policy, we will revise the Last Updated and Effective Date displayed at the top of this Policy.

If applicable law requires additional notice or affirmative consent for a material change, we will provide the required notice or request the applicable consent before the new processing begins.

21. CONTACT US

If you have questions about this Privacy Policy, our privacy practices, or your privacy rights, please contact:

Heart Made of Gold, Inc.

Email: contact@heartmadeofgold.com

Mailing Address:

Heart Made of Gold
6442 Platt Ave
#2008
West Hills, CA 91307

For privacy-rights requests, please provide enough information for us to understand the nature of your request and respond appropriately.