Privacy policy

Last updated: September 9, 2026

This Privacy Policy explains how Beyond Polish ("Beyond Polish," "we," "us," or "our") collects, uses, and discloses personal information when you visit beyondpolish.com (the "Site"), buy from us, create an account, join our rewards program, subscribe to email or text messages, contact customer support, or otherwise interact with us. It also explains the choices you have about your information.

Our Site is operated from the United States and is intended for customers in the United States. If you use the Site from outside the U.S., your information will be transferred to and processed in the U.S.

By using the Site you acknowledge the practices described in this policy. If you do not agree with them, please do not use the Site.

---

1. Information We Collect

Information you give us

• Identifiers and contact details: name, email address, phone number, billing and shipping addresses, and account login credentials.
• Order and payment information: the products you buy, order value, discounts and rewards used, returns and refunds, and payment details. Payments are processed by Shopify Payments, Shop Pay, PayPal, Afterpay, or other payment providers offered at checkout. We receive confirmation of payment and limited details (such as the last four digits and card type); we do not store full payment card numbers.
• Account, rewards, and wishlist information: saved addresses, order history, wishlist items, rewards points and redemptions, and subscription settings.
• Communications: messages you send us through our contact form, email, live chat, or text message, including any order details or photos you include.
• Reviews and user content: product reviews, ratings, photos, and other content you choose to post.
• Marketing sign-ups: your email address and/or mobile number when you subscribe, plus your consent records and preferences.
• Program applications: information you submit to join our affiliate, brand ambassador, wholesale, or vendor programs.

Information collected automatically

When you visit the Site, we and the third-party services described in Section 4 automatically collect information using cookies, pixels, tags, scripts, local storage, and similar technologies. This includes: IP address and approximate location derived from it; device type, operating system, and browser; unique device, cookie, and advertising identifiers; the pages and products you view, searches you run, links you click, items you add to your cart, and checkout activity; the site you came from and the site you go to next; dates, times, and duration of visits; and how you interact with our emails, text messages, push notifications, and ads.

On your first visit we also use a third-party IP geolocation service (ipapi.co) to determine whether you appear to be located in Texas, so that we can comply with Texas text-messaging law. We store the result in a cookie for 30 days.

Information from other sources

We receive information from Shopify; payment and fraud-prevention providers; shipping carriers; advertising and analytics platforms (such as Meta, Google, Microsoft, Pinterest, and Reddit); affiliate and shopping-rewards networks (Rakuten Advertising and Refersion); email, SMS, and marketing-technology providers; and visitor-identification services (see Section 4). Some of these partners combine information we provide with information they already hold about you.

2. How We Use Personal Information

We use personal information to:

• process, fulfill, ship, and provide updates on your orders, and handle returns, exchanges, and refunds;
• create and manage your account, rewards balance, subscriptions, and wishlist;
• respond to customer-service requests through email, chat, and text;
• send order confirmations, shipping notices, and other transactional messages;
• send marketing emails, text messages, and web push notifications if you have opted in, including cart and browse reminders;
• run our rewards, referral, affiliate, and ambassador programs, and administer promotions, giveaways, and surveys;
• show you ads for Beyond Polish on other websites and apps, and measure how well those ads perform;
• identify visitors who have not signed in so that our marketing partners can send them Beyond Polish offers (see Section 4);
• analyze how the Site is used and improve our products, content, and shopping experience;
• detect and prevent fraud, abuse, and security incidents;
• comply with legal obligations and enforce our Terms & Conditions; and
• protect the rights, property, and safety of Beyond Polish, our customers, and others.

3. How We Disclose Personal Information

We disclose personal information to the following categories of recipients:

• Shopify, which hosts our store, processes orders and payments, and provides our customer accounts. Shopify's handling of your information is also described in the Shopify Consumer Privacy Policy.
• Service providers that work on our behalf, including payment processors, fraud-prevention services, shipping and fulfillment partners, customer-support and chat software, email and SMS platforms, review platforms, rewards and subscription apps, wishlist and cart-recovery tools, push-notification services, shipping-protection providers, and analytics providers.
• Advertising, affiliate, and visitor-identification partners that collect information directly from your browser through cookies and pixels on our Site. These partners use the information for their own purposes as well as ours, which is why some of these disclosures are treated as a "sale" or "sharing" of personal information under certain state laws (see Sections 4 and 9).
• Payment and buy-now-pay-later providers such as Shop Pay, PayPal, and Afterpay, which act as independent businesses when you choose to pay with them.
• Professional advisors, law enforcement, and government authorities when required by law, subpoena, or legal process, or when we believe disclosure is necessary to protect our rights or the safety of others.
• A successor business in connection with a merger, acquisition, financing, or sale of all or part of our business.

We do not sell personal information for money. We do not disclose your personal information to third parties for their own marketing of unrelated products.

4. Cookies, Pixels, and Third-Party Technologies

Below is the list of third-party technologies active on the Site as of the date above. These tools load when you visit the Site. The Site does not currently display a cookie banner; see Section 9 for how to opt out of advertising-related uses.

Essential and functional

• Shopify — session, cart, checkout, security, and fraud-prevention cookies required for the store to work.
• Appstle — powers our rewards program and product subscriptions.
• Wishlist Hero — saves your wishlist.
• Re:amaze — live chat and customer-support inbox. Chat conversations are stored on Re:amaze's systems.
• Judge.me — collects and displays product reviews.
• Navidium — optional shipping protection at checkout.
• BOGOS, Hextom, and KeepCart — free-gift promotions, on-site sales messaging, and cart persistence.
• ipapi.co — one-time IP geolocation to identify Texas visitors (Section 1).
• Google Customer Reviews badge — displays our seller rating.

Analytics

• Google Analytics 4 — traffic and behavior analytics. Google's practices: How Google uses information from sites that use its services.
• Shopify Analytics — store performance reporting.

Advertising, marketing, and attribution

• Meta Pixel and Conversions API (Facebook and Instagram) — ad measurement and audience building. Meta may match your activity to your Meta account. Meta Privacy Policy.
• Google Ads — conversion tracking and remarketing.
• Microsoft Advertising, Pinterest Tag, and Reddit Pixel — conversion tracking and remarketing on those platforms.
• Klaviyo — email marketing, on-site behavior tracking (product views, cart activity), and customer profiles. Klaviyo Privacy Notice.
• Attentive — text-message marketing and on-site sign-up forms. Attentive Privacy Policy.
• PushOwl — browser push notifications, if you allow them.
• Minty — a visitor-identification network. Minty uses cookies and identifiers to recognize visitors who have not signed in, matches them against its own network of shopper email addresses, and may send those shoppers Beyond Polish offers by email. This disclosure is treated as a sale or sharing of personal information under California law. You can opt out directly with Minty at minty.com/privacy-policy or with us as described in Section 9.
• Disco (Coop Commerce) — a cross-brand marketing network that may show you offers from other brands after your purchase and shares purchase-related information with participating brands.
• CartHook — post-purchase offers and related conversion tracking.
• Rakuten Advertising and Refersion — affiliate and shopping-rewards networks that track whether you arrived from an affiliate or cash-back link and whether you purchased, so that commissions can be paid. Rakuten Advertising Services Privacy Policy and rights request form.

Managing cookies in your browser

Most browsers let you block or delete cookies through their settings. If you block essential cookies, parts of the Site (including cart and checkout) will not work. Blocking cookies does not stop server-side data sharing that occurs when you place an order; use the opt-out methods in Section 9 for that. For industry-wide advertising opt-outs, you can also visit optout.aboutads.info and optout.networkadvertising.org.

5. Email, Text Messages, and Push Notifications

Email

If you subscribe or make a purchase, we may send you marketing emails through Klaviyo. You can unsubscribe at any time using the link at the bottom of any marketing email. You will still receive transactional emails about your orders and account.

Text messages (SMS/MMS)

Our text-message program is operated through Attentive. By opting in, you agree to receive recurring automated marketing and transactional text messages (including cart reminders) at the number you provided. Consent is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to cancel or HELP for help. We keep records of your consent and opt-out for compliance purposes. Full program terms are in our Terms & Conditions.

Texas residents: we do not send marketing text messages to Texas residents. This is why we check your approximate location as described in Section 1.

Push notifications

If you allow browser notifications, PushOwl delivers them. You can turn them off at any time in your browser's site settings.

6. Rewards Program

Our rewards program (operated through Appstle) gives you points, discounts, or other benefits in exchange for creating an account, making purchases, referring friends, or completing other activities. Participation is voluntary. To run the program we collect your name, email address, purchase history, and program activity. We value the personal information collected through the program at roughly the value of the rewards issued, based on the cost of those rewards to us. You can leave the program at any time by contacting us at hello@beyondpolish.com; unredeemed points will be forfeited.

7. Data Retention

We keep personal information for as long as needed for the purposes described above. In general: order, payment, and tax records are kept for at least seven years to meet accounting and legal requirements; account information is kept while your account is active and for a reasonable period afterward; marketing consent and opt-out records are kept for as long as needed to honor your choices and demonstrate compliance; customer-service conversations are kept for a reasonable period to resolve issues and improve service; and website analytics and advertising data are kept according to the retention settings of the providers in Section 4 (generally 2 to 26 months). When information is no longer needed, we delete or de-identify it.

8. Security

The Site is served over HTTPS, and payments are handled by PCI-DSS compliant processors. We use reasonable administrative, technical, and physical safeguards, but no system is completely secure and we cannot guarantee the security of your information. Keep your account password confidential and contact us right away if you suspect unauthorized access.

9. Your Privacy Rights and Choices

Rights available to residents of certain U.S. states

Depending on where you live (including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia), you may have the right to:

• Know / access the personal information we have collected about you, including the categories, sources, purposes, and the categories of third parties we disclosed it to;
• Delete personal information we collected from you, subject to legal exceptions (for example, we must keep order records);
• Correct inaccurate personal information;
• Obtain a portable copy of your information;
• Opt out of the sale or sharing of personal information and of targeted advertising;
• Limit the use of sensitive personal information (we do not collect sensitive personal information as defined by these laws, other than your account password, which we use only to log you in);
• Appeal a decision we make on your request, where your state provides that right; and
• Not be discriminated against for exercising these rights.

How to submit an access, deletion, or correction request

Email hello@beyondpolish.com with the subject line "Privacy Request," and tell us which right you want to exercise. You can also delete saved addresses and update your details yourself in My Account. We will confirm receipt within 10 business days and respond within 45 days (we may extend once by 45 days where the law allows, and will tell you if so).

Verification. To protect your information, we will verify your identity by matching the information you provide (such as the email address, name, and a recent order number) against our records. We may ask for additional information if needed. We will not ask for a government ID unless there is no other way to verify you.

Authorized agents. You may designate an agent to make a request for you. We will ask the agent for written proof of your permission and may also verify your identity directly with you.

Appeals. If we deny your request and your state gives you the right to appeal, reply to our decision email with "Appeal" in the subject line and we will review it. If your appeal is denied, we will tell you how to contact your state Attorney General.

California-specific disclosures (CCPA/CPRA)

In the 12 months before the date above, we collected the following categories of personal information from the sources and for the purposes described in Sections 1 and 2, and disclosed them as follows:

Categories of third parties to which we sell or share: advertising networks and social-media platforms (Meta, Google, Microsoft, Pinterest, Reddit), visitor-identification and cross-brand marketing networks (Minty, Disco), and affiliate networks (Rakuten Advertising, Refersion). We do not knowingly sell or share the personal information of consumers under 16 years of age. Sensitive personal information: we do not collect sensitive personal information other than account credentials, and we do not use it to infer characteristics about you.

Retention periods for each category are described in Section 7. The rewards program described in Section 6 is a financial incentive under the CCPA.

Shine the Light. California residents may request a list of third parties to which we disclosed personal information for their own direct-marketing purposes in the prior calendar year. Send requests to hello@beyondpolish.com with "Shine the Light Request" in the subject line.

Nevada residents

Nevada residents may opt out of the sale of covered information by emailing hello@beyondpolish.com.

10. Children

The Site is a general-audience store and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, email hello@beyondpolish.com and we will delete it.

11. Third-Party Links and Social Media

The Site links to third-party websites and social-media platforms, including Facebook, Instagram, YouTube, X, Pinterest, and TikTok. Those sites have their own privacy policies, and we are not responsible for their practices.

12. Changes to This Policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top. If the changes are material, we will post a notice on the Site or email account holders before they take effect.

13. Contact Us

Beyond Polish