This Privacy Policy describes how OOEDN ("we," "us," "our") collects, uses, shares, and protects information about you when you visit ooedn.com (the "Site"), purchase our products, or otherwise interact with us. By using the Site, you agree to the practices described here.

---

1 · Who we are

OOEDN is an independent skincare-for-scalp brand headquartered in the United States. If you have any questions about this policy or your data, contact us at hello@ooedn.com.

---

2 · Information we collect

We collect information in three ways:

a) Information you give us directly: - Contact details (name, email, phone, shipping address) - Payment information (processed by Shopify Payments, Stripe, PayPal, Apple Pay, Shop Pay, Google Pay — we do not store full card numbers) - Order history and purchase preferences - Communications you send us (support, feedback, replies to emails or SMS) - Signup preferences (email, SMS, waitlist)

b) Information collected automatically when you visit the Site: - IP address, browser type, device type, operating system - Pages viewed, time on page, referring site, exit points - Cookies and similar tracking technologies (see §6) - Purchase behavior for personalization and cart recovery

c) Information from third parties: - Shipping carriers (delivery status) - Payment processors (fraud signals, transaction confirmation) - Meta (Facebook & Instagram): interaction data if you engage with our ads, tap our profile, or use our Meta Shop - Analytics + marketing platforms: Shopify, Klaviyo, Meta Pixel, Google Analytics (where enabled)

---

3 · How we use your information

• Fulfill your orders and provide customer support
• Send order confirmations, shipping updates, delivery notices
• Send marketing emails and SMS only with your consent — you can opt out at any time
• Personalize your experience (product recommendations, cart recovery)
• Improve our products, site, and services
• Detect and prevent fraud, abuse, and unauthorized activity
• Comply with legal obligations

We do not sell your personal data, and we do not share your data with third parties for their own marketing purposes.

Mobile information disclosure (SMS/A2P 10DLC compliance): Mobile phone numbers and messaging consent are never shared with third parties or affiliates for marketing purposes. Text messaging service opt-in data is not shared outside of the SMS service providers processing our messages.

---

4 · How we share your information

We share information only with the following categories of recipients:

Service providers we rely on to run the business: - Shopify — e-commerce platform, checkout, inventory - Klaviyo — email and SMS marketing - Payment processors — Shopify Payments, Stripe, PayPal, Apple Pay, Shop Pay, Google Pay - Shipping carriers — USPS, UPS, and other order-fulfillment providers - Cloudflare — content delivery, DDoS protection - Google — analytics, workspace email - Meta Platforms (Facebook & Instagram) — see §5

Each service provider only receives the minimum information needed to perform its function and is contractually bound to protect your data.

Legal requirements: We may disclose information if required by law, subpoena, court order, or to protect our rights, safety, or property.

Business transfers: If OOEDN is acquired or merged, your information may transfer to the successor entity, subject to the same protections.

---

5 · Meta Platforms · Facebook · Instagram

We use Meta Platforms (which owns Facebook and Instagram) for advertising and business operations. This section discloses that relationship in detail because Meta requires it and because you should know.

What we share with Meta: - Meta Pixel: When you visit the Site, our Meta Pixel may send Meta aggregated and pseudonymized data about your interactions (pages viewed, items added to cart, purchases). This helps us measure ad performance and show relevant ads. - Custom Audiences: We may share hashed email addresses or phone numbers with Meta to create audiences for advertising (retargeting, lookalikes). All identifiers are one-way hashed before transmission — Meta cannot reverse them. - Meta Conversion API: For accuracy, we may also send conversion events server-side through Meta's Conversion API.

What we access from Meta: - Meta Business Suite / Ads Manager: OOEDN staff and authorized internal tools access our own advertising account, campaign performance, ad creative libraries, and audience insights via Meta's Business Tools and Marketing API. These tools access only our own OOEDN business account data — not any individual user's private data. - Internal analytics tooling ("MANVIS"): OOEDN operates an internal tool called MANVIS that uses Meta's Marketing API to pull campaign performance data from our own ad account. MANVIS is not a consumer-facing product; only authorized OOEDN team members with valid Meta credentials for our business account can access it. MANVIS does not access, store, or process any individual Meta user's personal information.

Your controls with Meta: - Manage the ads you see: https://www.facebook.com/adpreferences - Opt out of interest-based advertising: https://www.aboutads.info/choices - Meta's Privacy Policy: https://www.facebook.com/privacy/policy

---

6 · Cookies and tracking technologies

We use cookies and similar technologies to make the Site work, understand how it's used, and personalize your experience. Categories:

Type	Purpose	Examples
Essential	Required for the site to work — cart, checkout, login	Shopify session, cart cookies
Analytics	Understand how visitors use the site	Google Analytics, Shopify Analytics
Marketing	Show relevant ads on other sites, measure ad performance	Meta Pixel, Klaviyo web tracking
Preferences	Remember your settings	Language, region, subscription plan choice

Managing cookies: Most browsers let you refuse or delete cookies via settings. Refusing essential cookies may break checkout. Refusing marketing cookies opts you out of personalized advertising.

Do Not Track: Our Site does not currently respond to browser Do Not Track (DNT) signals. We honor CCPA and GDPR opt-out requests as described in §7.

---

7 · Your rights

Depending on where you live, you have some or all of the following rights:

All customers: - Access the personal information we hold about you - Correct inaccurate information - Delete your account and personal information - Opt out of marketing emails (unsubscribe link in every email) and SMS (reply STOP)

California residents (CCPA/CPRA): - Right to know what personal information we collect, use, and share - Right to delete personal information - Right to correct inaccurate personal information - Right to opt out of the "sale" or "sharing" of personal information — we do not sell personal information - Right to limit use of sensitive personal information - Right to non-discrimination for exercising these rights

EU / UK residents (GDPR / UK GDPR): - Access, rectification, erasure, restriction, portability, and objection rights - Right to withdraw consent at any time - Right to lodge a complaint with your local data protection authority - Legal basis for processing: contract performance (orders), consent (marketing), legitimate interests (analytics, fraud prevention)

How to exercise your rights: Email hello@ooedn.com with the subject line "Privacy Rights Request" and include: - Your full name - The email address associated with your account - The specific right you're exercising

We respond within 30 days for GDPR requests and within 45 days for CCPA requests. Verification of identity may be required for security.

---

8 · Data deletion

You can request deletion of your personal information at any time by: 1. Emailing hello@ooedn.com with subject "Delete My Data" 2. Or from within your OOEDN account, using the "Delete Account" option

Upon a valid deletion request, we will: - Remove your personal information from our active systems within 30 days - Remove your data from third-party marketing platforms (Klaviyo, Meta Custom Audiences) - Retain only what is required by law (e.g. transaction records for tax, order records for warranty and return periods)

Meta-specific deletion: If you're asking us to delete Meta-related data (Custom Audience matches, Pixel-tracked events tied to your identifiers), we will remove your data from our systems and instruct Meta to purge associated Custom Audience entries.

---

9 · Data retention

We retain your information only as long as necessary:

Data type	Retention
Order and transaction records	7 years (tax + accounting compliance)
Marketing preferences and consent records	Until you unsubscribe or delete your account
Website analytics	24 months (Google Analytics default)
Meta Pixel event data	Per Meta's retention policy (max 180 days for most events)
Customer support conversations	3 years after the ticket closes
Deleted accounts	Personal info removed within 30 days; anonymized data may be retained for aggregate reporting

---

10 · Data security

We use industry-standard measures to protect your information: HTTPS encryption in transit, encryption at rest for sensitive data, PCI-DSS compliance for payment data (handled by our payment processors, not stored on our servers), access controls and audit logs for internal systems.

No system is 100% secure. If we experience a data breach that affects you, we will notify you as required by applicable law.

---

11 · International transfers

OOEDN is based in the United States. If you access the Site from outside the U.S., your information will be transferred to and processed in the U.S. and other countries where our service providers operate. We use standard contractual clauses and appropriate safeguards for cross-border data transfers involving EU/UK residents.

---

12 · Children's privacy

The Site and our products are not directed to children under 13 (or under 16 in the EU/UK). We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact hello@ooedn.com and we will delete it.

---

13 · Third-party links

Our Site may link to third-party websites (Meta, Instagram, TikTok, retail partners). We are not responsible for their privacy practices. Review their policies before providing information.

---

14 · Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a new effective date at the top. If changes affect how we handle your data in a significant way, we will notify you by email or a site banner.

---