Privacy Policy

Last updated: July 24, 2026

Heather Pullis Jewelry (“Heather Pullis Jewelry,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

  • Visit or interact with our website;

  • Purchase or browse our jewelry and other products;

  • Create or use a customer account;

  • Visit or make a purchase at our California retail location;

  • Communicate with us;

  • Subscribe to our email or text message programs;

  • Interact with our advertisements or social media pages; or

  • Otherwise use our products, services, website, applications, and related offerings.

Our website and online store are hosted through Shopify. We also use third-party providers, including payment processors, shipping providers, analytics providers, advertising platforms, and email and SMS service providers. Our current email and SMS providers may include Constant Contact and Klaviyo while we migrate our marketing programs.

By using our website, purchasing our products, visiting our retail location, or otherwise providing personal information to us, you acknowledge the practices described in this Privacy Policy.

1. Personal Information We Collect

The information we collect depends on how you interact with us.

Information You Provide Directly

We may collect information you provide when you place an order, visit our store, create an account, subscribe to marketing, request customer service, submit a form, participate in a promotion, or otherwise communicate with us.

This information may include:

  • Name;

  • Email address;

  • Telephone or mobile phone number;

  • Billing address;

  • Shipping address;

  • Account login information;

  • Order and purchase information;

  • Product preferences;

  • Gift recipient information;

  • Payment and transaction information;

  • Information relating to returns, exchanges, repairs, resizing, custom orders, or warranties;

  • Communications, questions, reviews, feedback, and customer service requests;

  • Marketing preferences;

  • SMS and email subscription information;

  • Information you provide at our retail location; and

  • Any other information you voluntarily provide.

Payment card information is generally collected and processed directly by Shopify, Shopify Payments, or another authorized payment processor. We may receive limited payment-related information, such as payment status, transaction identifiers, card type, and the last digits of a payment card, but we do not generally receive or store complete payment card numbers.

Information Collected Automatically

When you visit our website or interact with our digital services, we and our service providers may automatically collect information such as:

  • Internet Protocol address;

  • Browser type;

  • Device type;

  • Operating system;

  • Device identifiers;

  • Cookie identifiers;

  • Approximate location derived from an IP address;

  • Language and time-zone settings;

  • Referring and exit pages;

  • Pages and products viewed;

  • Search activity;

  • Items placed in a shopping cart;

  • Checkout activity;

  • Links and advertisements clicked;

  • Date, time, and duration of visits;

  • Website navigation and interaction data;

  • Email opens and clicks;

  • SMS engagement data;

  • Advertising attribution data; and

  • Information about how you use our website and services.

We may collect this information through cookies, pixels, tags, software development kits, local storage, server logs, and similar technologies.

Information From Other Sources

We may receive personal information from:

  • Shopify and Shopify applications;

  • Shopify Payments and other payment processors;

  • Shipping, delivery, and fulfillment providers;

  • Constant Contact;

  • Klaviyo;

  • Google, including Google Analytics and Google advertising services;

  • Meta, including Facebook and Instagram advertising services;

  • Social media platforms;

  • Fraud prevention and security providers;

  • Customer service providers;

  • Advertising and marketing partners;

  • Business and technology service providers; and

  • Publicly available sources.

The information received may include contact details, transaction information, website activity, advertising interactions, marketing preferences, audience information, and fraud or security signals.

2. How We Use Personal Information

We may use personal information to:

Provide Products and Services

  • Process and fulfill online and in-store purchases;

  • Process payments;

  • Confirm, update, and deliver orders;

  • Provide order and shipping notifications;

  • Manage returns, exchanges, repairs, custom orders, and warranties;

  • Maintain customer accounts;

  • Provide customer service;

  • Respond to questions and requests;

  • Communicate about purchases or services; and

  • Operate our website and retail business.

Communicate and Market

  • Send email newsletters and promotional messages;

  • Send SMS or MMS marketing messages where permitted;

  • Send abandoned-cart or abandoned-checkout reminders;

  • Inform you about products, collections, events, promotions, and special offers;

  • Personalize marketing communications;

  • Measure engagement with our emails and messages;

  • Manage marketing preferences and opt-out requests;

  • Create advertising audiences;

  • Deliver and measure targeted or interest-based advertising; and

  • Evaluate the effectiveness of our marketing campaigns.

Consent to receive promotional text messages is not a condition of purchasing from us. Message and data rates may apply. Message frequency may vary. You may unsubscribe from promotional text messages by replying STOP to a message and may request assistance by replying HELP.

You may unsubscribe from promotional emails by using the unsubscribe link included in an email. Even after unsubscribing from marketing, you may continue to receive non-promotional communications, such as order confirmations, shipping updates, account notices, and customer service messages.

Improve and Personalize Our Business

  • Understand how visitors use our website;

  • Remember shopping preferences;

  • Recommend products;

  • Personalize website content;

  • Conduct analytics and research;

  • Develop or improve products and services;

  • Diagnose technical issues;

  • Test website functionality;

  • Measure customer and campaign performance; and

  • Improve our retail and online customer experience.

Protect Our Business and Customers

  • Detect and prevent fraudulent or unauthorized transactions;

  • Protect accounts, systems, customers, and our business;

  • Enforce our policies and agreements;

  • Investigate suspected misconduct;

  • Maintain records;

  • Manage disputes;

  • Comply with legal obligations;

  • Respond to lawful requests from governmental authorities; and

  • Establish, exercise, or defend legal claims.

3. Legal Bases for Processing

For individuals located in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction requiring a lawful basis, we process personal information under one or more of the following bases:

Contract

We process personal information when necessary to enter into or perform a contract with you, including processing purchases, payments, deliveries, returns, repairs, and customer service requests.

Consent

We may rely on your consent for activities such as:

  • Sending certain marketing emails;

  • Sending promotional text messages;

  • Using nonessential cookies;

  • Delivering personalized advertising; or

  • Processing information for another purpose disclosed when consent is requested.

You may withdraw consent at any time. Withdrawal does not affect processing that occurred before consent was withdrawn.

Legitimate Interests

We may process information when necessary for our legitimate business interests, including:

  • Operating and improving our business;

  • Understanding customer activity;

  • Providing customer support;

  • Securing our services;

  • Preventing fraud;

  • Marketing our products where permitted;

  • Measuring business performance; and

  • Establishing or defending legal claims.

We consider whether our interests are overridden by your privacy rights before relying on this basis.

Legal Obligations

We may process information to comply with tax, accounting, consumer protection, law enforcement, product safety, regulatory, and other legal obligations.

4. Cookies and Similar Technologies

We and our partners use cookies, pixels, tags, and similar technologies to operate our website and understand how it is used.

These technologies may include:

Essential Technologies

These are used to:

  • Operate the website;

  • Maintain your shopping cart;

  • Process checkout;

  • Authenticate accounts;

  • Prevent fraud; and

  • Maintain website security.

Essential technologies generally cannot be disabled through our cookie preference tools because they are necessary for the website to function.

Functional Technologies

These remember preferences and support features such as language selections, saved settings, and enhanced website functionality.

Analytics Technologies

These help us understand website traffic and usage. For example, we may use Google Analytics or similar services to measure visits, page views, purchases, and website performance.

Advertising Technologies

We may use Google, Meta, and other advertising services to:

  • Measure advertising performance;

  • Understand whether an advertisement resulted in a visit or purchase;

  • Build advertising audiences;

  • Limit repetitive advertising; and

  • Deliver advertisements based on browsing activity or inferred interests.

Depending on applicable law, the use of certain advertising cookies and pixels may be considered a “sale,” “sharing,” or processing for “targeted advertising,” even when no money is exchanged for personal information.

You can manage cookies through our cookie banner or privacy preference tool, where available. You may also adjust your browser settings to block or delete cookies. Blocking cookies may affect website functionality.

5. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients.

Shopify

Shopify hosts our online store and provides commerce, checkout, account, fraud prevention, analytics, and related services. Shopify may process personal information in accordance with its own privacy terms and its agreements with us.

Payment Processors

We disclose transaction and payment information to Shopify Payments, banks, card networks, payment processors, and fraud prevention providers to authorize and complete payments.

Fulfillment and Delivery Providers

We may provide names, contact details, delivery addresses, and order information to shipping carriers, fulfillment providers, customs authorities, postal services, and delivery partners.

Email and SMS Providers

We may disclose contact details, purchase information, browsing activity, marketing preferences, and engagement information to Constant Contact, Klaviyo, and other communications providers.

During our migration from Constant Contact to Klaviyo, both providers may process customer information for a limited period to support the transfer, operation, and maintenance of our email and SMS programs.

Analytics and Advertising Partners

We may disclose or make available device identifiers, cookie identifiers, website activity, purchase events, and advertising interaction data to providers such as Google and Meta.

These partners may use information in accordance with their own privacy policies and, depending on our settings and your consent choices, may combine information with other information they hold.

Technology and Business Providers

We may disclose information to providers supporting:

  • Website hosting;

  • Data storage;

  • Customer service;

  • Information technology;

  • Cybersecurity;

  • Fraud prevention;

  • Accounting;

  • Legal services;

  • Business analytics;

  • Marketing;

  • Reviews;

  • Promotions;

  • Inventory management; and

  • Business operations.

Legal and Safety Disclosures

We may disclose information when we reasonably believe disclosure is necessary to:

  • Comply with law, regulation, legal process, or governmental request;

  • Enforce our agreements;

  • Detect or prevent fraud, security issues, or illegal activity;

  • Protect the rights, property, and safety of Heather Pullis Jewelry, our customers, or others; or

  • Establish, exercise, or defend legal claims.

Business Transactions

If Heather Pullis Jewelry is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar business transaction, personal information may be disclosed or transferred as part of that transaction.

6. Sale, Sharing, and Targeted Advertising

We do not sell personal information in exchange for money.

However, our use of third-party analytics, advertising pixels, cookies, and similar technologies may be considered:

  • A “sale” of personal information under certain U.S. state privacy laws;

  • “Sharing” for cross-context behavioral advertising under California law; or

  • Processing for targeted advertising under other state laws.

The categories of information that may be disclosed for these purposes include:

  • Identifiers;

  • Internet or electronic network activity;

  • Device and cookie identifiers;

  • Approximate location;

  • Commercial or purchase information; and

  • Inferences concerning interests or product preferences.

The categories of recipients may include advertising networks, analytics providers, social media platforms, and marketing technology providers.

You may opt out through the Your Privacy Choices, Do Not Sell or Share My Personal Information, cookie preference, or similar link made available on our website.

Where required, we also process recognized browser-based opt-out preference signals, such as the Global Privacy Control, as a request to opt out of sale, sharing, or targeted advertising for the browser or device sending the signal. When you are logged into an account, we may be able to associate the request with your account.

7. Email and SMS Marketing

You may choose to receive promotional communications from us through email or SMS.

Email

You can unsubscribe from promotional email by clicking the unsubscribe link included in any marketing email.

Unsubscribing from promotional email does not prevent us from sending transactional or service-related communications about your orders, account, or requests.

Text Messages

By opting into an SMS program, you consent to receive recurring automated promotional and transactional messages at the telephone number provided.

Consent is not a condition of purchase. Message and data rates may apply. Message frequency may vary.

You may opt out by replying:

  • STOP;

  • QUIT;

  • CANCEL;

  • OPT-OUT; or

  • UNSUBSCRIBE.

You may reply HELP for assistance.

We may maintain limited information about an opt-out request to ensure that your preference continues to be honored.

8. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

  • Complete transactions;

  • Maintain customer accounts;

  • Provide customer service;

  • Honor marketing preferences;

  • Fulfill warranties, repairs, returns, and exchanges;

  • Maintain business, tax, and accounting records;

  • Prevent fraud;

  • Resolve disputes;

  • Enforce agreements; and

  • Comply with legal obligations.

The retention period depends on factors such as:

  • The nature and sensitivity of the information;

  • The purpose for which it was collected;

  • Whether you maintain an account or ongoing relationship with us;

  • Legal, tax, accounting, and regulatory requirements;

  • Warranty and product-service periods;

  • Fraud prevention needs; and

  • Applicable limitation periods.

When information is no longer required, we may delete, anonymize, or aggregate it, subject to legal and operational requirements.

9. Security

We use administrative, technical, organizational, and physical safeguards designed to protect personal information.

These safeguards may include access restrictions, account controls, secure service providers, encryption during transmission, monitoring, and employee or contractor confidentiality requirements.

No method of transmission, payment, or electronic storage is completely secure. We therefore cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for notifying us if you believe an account or transaction has been compromised.

10. International Data Transfers

Heather Pullis Jewelry is based in the United States. Shopify and our other service providers may process personal information in the United States, Canada, and other countries.

These countries may have privacy laws that differ from the laws where you live.

Where required by applicable law, we use recognized safeguards for international transfers, which may include:

  • Adequacy decisions;

  • Standard contractual clauses;

  • Contractual data protection terms; or

  • Other approved legal transfer mechanisms.

By purchasing from us or using our services, you understand that information may be transferred to and processed in countries outside your country of residence, subject to applicable legal requirements.

11. Your Privacy Rights

Your rights depend on where you live and the law applicable to Heather Pullis Jewelry.

Subject to applicable exceptions, you may have the right to:

  • Confirm whether we process your personal information;

  • Know what personal information we collect;

  • Access personal information;

  • Obtain a copy of personal information;

  • Correct inaccurate personal information;

  • Delete personal information;

  • Request portability of personal information;

  • Restrict certain processing;

  • Object to certain processing;

  • Withdraw consent;

  • Opt out of targeted advertising;

  • Opt out of the sale or sharing of personal information;

  • Limit certain uses or disclosures of sensitive personal information;

  • Opt out of certain automated decision-making or profiling;

  • Appeal a decision concerning a privacy request;

  • Lodge a complaint with a privacy or data protection authority; and

  • Receive equal service and pricing without discrimination for exercising privacy rights.

These rights are not absolute. We may deny or limit a request where permitted by law, including when information is necessary to:

  • Complete a transaction;

  • Provide a requested service;

  • Detect fraud or security incidents;

  • Exercise legal rights;

  • Comply with law;

  • Maintain required records; or

  • Protect the rights of another person.

Exercising Your Rights

To submit a privacy request, contact us at:

Email: shop@heatherpullisjewelry.com
Mail: 1001 W 17th St Ste P, Costa Mesa, CA 92627

Please include:

  • Your name;

  • The email address or telephone number associated with your interaction;

  • The type of request;

  • Your state or country of residence; and

  • Enough information for us to locate relevant records.

We may need to verify your identity before completing a request. Verification may require confirming information associated with your account, order, or prior interactions.

We will use information submitted with a privacy request only to verify and respond to the request.

Authorized Agents

Where permitted by law, you may use an authorized agent to submit a request.

We may require:

  • Proof that the agent is authorized to act for you;

  • Direct confirmation from you;

  • Verification of your identity; or

  • A valid power of attorney.

Appeals

Residents of certain U.S. states may have the right to appeal our decision regarding a privacy request.

To appeal, email shop@heatherpullisjewelry.com with the subject line Privacy Request Appeal and explain why you believe the decision should be reconsidered.

12. California Privacy Notice

This section applies to California residents and supplements the rest of this Privacy Policy.

California law defines certain terms, including “personal information,” “sell,” “share,” and “sensitive personal information,” in specific ways. The rights in this section apply only to the extent Heather Pullis Jewelry is subject to the relevant California law.

Categories of Personal Information

During the preceding 12 months, we may have collected the following categories of personal information:

California category Examples we may collect Business or commercial purposes
Identifiers Name, mailing address, email address, telephone number, IP address, account identifiers and device identifiers Orders, accounts, communications, security, marketing and customer service
Customer-record information Contact details, payment-related information and order information Processing purchases, maintaining records and providing support
Protected classification information Age-related information or other information voluntarily provided, when relevant Legal compliance and customer service
Commercial information Products purchased or considered, order history, returns, repairs and product preferences Order fulfillment, analytics, recommendations and marketing
Internet or network activity Browsing activity, product views, cart activity, advertisement interactions and website usage Analytics, security, website improvement and advertising
Geolocation information Approximate location derived from an IP address Fraud prevention, localization, analytics and advertising
Audio, electronic or visual information Customer service communications and content submitted by customers Customer service, recordkeeping and dispute resolution
Professional information Business or professional information voluntarily provided Customer service or business communications
Inferences Product, style, shopping or marketing preferences inferred from activity Personalization, analytics and advertising
Sensitive personal information Account credentials and payment information processed through authorized providers Account access, payment processing, fraud prevention and security

We collect these categories from:

  • Customers and website visitors;

  • Shopify;

  • Payment processors;

  • Shipping providers;

  • Constant Contact;

  • Klaviyo;

  • Google;

  • Meta;

  • Cookies and similar technologies;

  • Social media platforms; and

  • Other service providers and business partners.

Disclosure for Business Purposes

We may disclose the categories listed above to service providers and contractors for business purposes such as:

  • Processing payments;

  • Fulfilling orders;

  • Delivering packages;

  • Maintaining accounts;

  • Sending communications;

  • Providing customer service;

  • Detecting fraud;

  • Securing the website;

  • Conducting analytics;

  • Maintaining records; and

  • Operating our business.

Sale or Sharing

We do not sell personal information for money.

During the preceding 12 months, we may have shared or otherwise disclosed the following categories for cross-context behavioral advertising or activities that certain laws may define as a sale:

  • Identifiers;

  • Commercial information;

  • Internet or network activity;

  • Approximate geolocation information; and

  • Inferences.

These categories may have been shared with advertising, analytics, social media, and marketing technology providers, including Google and Meta.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

Sensitive Personal Information

We use sensitive personal information only as reasonably necessary to provide goods and services, process payments, maintain accounts, prevent fraud, secure our systems, comply with law, and perform other permitted purposes.

We do not use sensitive personal information to infer characteristics about individuals unless separately disclosed and permitted by law.

California Rights

Subject to applicable law, California residents may have the right to:

  • Know the categories and specific pieces of personal information collected;

  • Know the sources, purposes, and recipients of personal information;

  • Delete personal information;

  • Correct inaccurate personal information;

  • Opt out of sale or sharing;

  • Limit certain uses of sensitive personal information;

  • Receive information about financial incentives, if offered; and

  • Exercise rights without discriminatory treatment.

We do not currently offer a financial incentive or price or service difference in exchange for personal information. If that changes, we will provide the required notice before you participate.

Shine the Light

California’s Shine the Light law may allow certain California residents to request information regarding the disclosure of personal information to third parties for their own direct-marketing purposes.

Requests may be submitted to shop@heatherpullisjewelry.com.

13. European Economic Area, United Kingdom, and Switzerland

Individuals in the European Economic Area, United Kingdom, and Switzerland may have rights to:

  • Be informed about processing;

  • Access personal information;

  • Correct inaccurate or incomplete information;

  • Request deletion;

  • Restrict processing;

  • Receive portable data;

  • Object to processing based on legitimate interests;

  • Object to direct marketing;

  • Withdraw consent; and

  • Complain to a supervisory authority.

Where we rely on legitimate interests, you may request information about the balancing assessment supporting that processing.

You have an absolute right to object to the use of your personal information for direct marketing.

You may submit a complaint to the data protection authority in the country where you live, work, or believe a violation occurred. UK residents may contact the Information Commissioner’s Office.

14. Canadian Residents

Depending on the applicable Canadian federal or provincial law, Canadian residents may have the right to:

  • Know why personal information is collected, used, or disclosed;

  • Request access to personal information;

  • Request correction of inaccurate information;

  • Withdraw consent, subject to legal and contractual limitations;

  • Challenge our compliance with applicable privacy principles; and

  • Submit a complaint to the Office of the Privacy Commissioner of Canada or an applicable provincial privacy authority.

Withdrawal of consent may affect our ability to provide certain products or services.

15. Other U.S. State Privacy Rights

Residents of states with comprehensive privacy laws may have rights that include:

  • Access;

  • Correction;

  • Deletion;

  • Data portability;

  • Opting out of targeted advertising;

  • Opting out of sale;

  • Opting out of certain profiling;

  • Limiting certain uses of sensitive information;

  • Appealing a denied request; and

  • Protection from discrimination.

We will respond to valid requests according to the law applicable to the requester.

16. Children’s Privacy

Our website and services are intended for a general audience and are not directed to children under 13.

We do not knowingly collect personal information online from children under 13. We also do not knowingly collect personal information from children who are below the applicable minimum age for consent in their jurisdiction without appropriate authorization.

If you believe a child has provided personal information to us, contact shop@heatherpullisjewelry.com so that we can review and, where appropriate, delete the information.

17. Third-Party Websites and Services

Our website may contain links to third-party websites, social media pages, payment services, or applications.

We are not responsible for the privacy, security, content, or practices of third parties. Their handling of personal information is governed by their own privacy policies.

We encourage you to review the privacy policy of any third-party service before providing information.

18. Do Not Track

Some browsers offer a “Do Not Track” setting. There is not currently a universally accepted standard for responding to traditional Do Not Track signals.

We may not respond to traditional Do Not Track signals. However, where required by applicable law, we honor recognized opt-out preference signals such as the Global Privacy Control.

19. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in:

  • Our business;

  • Our technology;

  • Our service providers;

  • Our marketing practices;

  • Our legal obligations; or

  • Applicable privacy laws.

When we make changes, we will update the “Last updated” date at the top of this Privacy Policy.

Where required, we will provide additional notice of material changes.

Your continued use of our website or services after an updated policy becomes effective signifies your acknowledgment of the updated policy, to the extent permitted by law.

20. Contact Us

Questions, concerns, complaints, or privacy requests may be directed to:

Heather Pullis Jewelry
Email: shop@heatherpullisjewelry.com
Retail location: 1001 W 17th St Ste P, Costa Mesa, CA 92627
Website: https://www.heatherpullisjewelry.com