Our Privacy Policy

Trailies LLC ("Trailies," "we," "us," "our"), a Wyoming limited liability company with its principal place of business at 8080 N Central Expressway, Suite 1700, 1034 Dallas, TX 75206, United States, provides this Privacy Policy for our websites, apps, and online services (collectively, the "Services"), including Trailies.com, the Trailies app at my.trailies.com (where digital products are delivered), and the Life School subscription service.

For most data processing activities, we act as a "business" (under U.S. state privacy laws such as the CCPA/CPRA) and "controller" (under the EU/UK GDPR and Swiss data protection law). Where third-party vendors process personal information on our behalf, we bind them through data processing agreements consistent with applicable law.

This Privacy Policy includes jurisdiction-specific supplements for California (CCPA/CPRA), other U.S. states (Colorado, Connecticut, Virginia, Texas, and others), and the EU/UK/Switzerland (GDPR).

Sensitive Personal Information: We do not intentionally collect sensitive personal information (such as Social Security numbers, precise geolocation, health information, or financial account details beyond payment processing). If we ever expand collection to include sensitive PI, we will update this policy and provide the required "Limit Use of Sensitive Personal Information" controls.

We collect personal information from the following sources:

• Directly from you: When you place an order, create an account, subscribe to Life School, complete onboarding forms, contact customer support, sign up for marketing, or otherwise interact with our Services.
• Automatically: Through cookies, pixels, SDKs, and similar tracking technologies when you visit our Site or interact with our emails. In the EU/UK/CH, non-essential tracking only occurs after you consent.
• From advertising and analytics partners: When their tags run on our Services (subject to your consent where required by law), we may receive information about your interactions with our ads on other platforms.
• From our fulfillment partner and carriers: Delivery confirmation and tracking updates from NextSmartShip (our fulfillment partner) and its delivery carriers.

4.1 Core Business Operations

• Processing and fulfilling orders (physical and digital products)
• Managing subscriptions (Life School)
• Communicating about your orders, subscriptions, and account
• Providing customer support
• Fraud prevention and security
• Legal compliance (tax records, responding to legal requests)

4.2 Analytics & Product Improvement

• Understanding how users interact with our Site and Products
• Improving our website, products, and services
• Conducting research and analysis (using de-identified or aggregated data where feasible)

4.3 Marketing & Advertising

• Sending promotional emails (subject to your consent or opt-out rights)
• Displaying targeted advertisements on third-party platforms
• Measuring ad effectiveness and campaign attribution
• Creating lookalike audiences on advertising platforms

In the EU/UK/CH: We rely on your consent for ad personalization and non-essential cookies. If you decline through our cookie banner, non-essential tracking is suppressed.

Children's data is NEVER used for marketing or advertising.

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data based on the following legal bases:

Legal basis references: Contract Performance (Art. 6(1)(b) GDPR), Legal Obligation (Art. 6(1)(c) GDPR), Legitimate Interests (Art. 6(1)(f) GDPR), Consent (Art. 6(1)(a) GDPR).

We maintain auditable consent records and provide easy withdrawal mechanisms via our Cookie Settings and unsubscribe links. Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal.

6.1 Cookie Categories

• Strictly Necessary: Essential for site functionality (shopping cart, checkout, security). Cannot be disabled.
• Functional: Remember your preferences (language, region). Require consent in EU/UK/CH.
• Analytics: Help us understand site usage via Google Analytics 4 (GA4) and our own first-party session analytics. Require consent in EU/UK/CH.
• Advertising: Enable targeted ads and conversion tracking through Meta, Google, TikTok, and Pinterest tags. Require consent in EU/UK/CH; opt-out available in U.S.

6.2 Consent Management

We show a cookie-consent banner to visitors in the EU/UK/CH. Non-essential cookies and identifiers are disabled by default until you provide consent through that banner, and if you decline, non-essential tracking (analytics and advertising tags) stays suppressed. Google tags adjust their behavior based on your consent choices.

You can view the full list of cookies and update your preferences at any time via Cookie Settings.

6.3 Browser Controls

Most browsers allow you to control cookies through settings. Note that blocking all cookies may affect site functionality. We also honor the Global Privacy Control (GPC) signal as an opt-out of sale/sharing for targeted advertising purposes.

6.4 Server-Side & First-Party Event Processing

In addition to the advertising and analytics tags that run in your browser, we process some measurement and conversion events server-side, through our own trailies.com domain, and then transmit them to the same advertising and analytics partners named above (for example, Meta's Conversions API, Google's Measurement Protocol, and the equivalent TikTok and Pinterest server APIs). We do this to improve the accuracy and reliability of the measurement described in this policy, not to collect anything beyond what this policy already discloses.

• Same data, same purposes. Server-side events carry the same categories of information described in this section (such as the page viewed, the product or order, and, for matching, a hashed and irreversibly encoded version of contact details you provide) and are used for the same advertising and measurement purposes.
• Your choices apply equally. Your consent choices in the EU/UK/CH, your U.S. opt-out of sale/sharing, and the Global Privacy Control signal apply to both the in-browser tags and this server-side processing. If you decline or opt out, the server-side advertising events are suppressed in the same way as the in-browser tags.
• Data minimization. We limit the information we transmit to what is needed for measurement and matching, and we strip query-string parameters from the page addresses we send to advertising partners.

Under California law (CCPA/CPRA) and similar state laws, allowing third-party advertising platforms to collect personal information through cookies and pixels for cross-context behavioral advertising may constitute a "sale" or "sharing" of personal information.

Categories we may "share" for targeted advertising:

• Identifiers (hashed email addresses for matching)
• Internet/network activity (browsing behavior, ad interactions)
• Inferences (interest segments)

We do NOT sell personal information in exchange for money. We do not sell or share children's personal information.

Your Opt-Out Rights: You can opt out of the sale/sharing of your personal information for targeted advertising by:

• Clicking "Your Privacy Choices" or "Do Not Sell or Share My Personal Information" on our Site
• Enabling a recognized Universal Opt-Out Mechanism such as Global Privacy Control (GPC) in your browser
• Emailing support@trailies.com with the subject line "Do Not Sell or Share"

We treat valid GPC signals as a "Do Not Sell or Share / Do Not Target" opt-out request for that browser, device, and any logged-in profile. We process opt-out requests promptly and do not discriminate against users who exercise their privacy rights.

U.S. State Rights (CA/CO/CT/VA/TX/etc.)

Depending on your state, you may have the right to:

• Know/Access: Learn what personal information we collect and obtain a copy
• Correct: Request correction of inaccurate information
• Delete: Request deletion of your personal information
• Portability: Receive your data in a portable format
• Opt-Out: Opt out of sale/sharing for targeted advertising
• Appeal: Appeal our decision on your request (CO/CT/VA)

We respond to verifiable requests within 45 days (with one permitted extension if needed). We verify your identity through your account login or by matching information you provide against our records. California residents may designate an authorized agent to make requests on their behalf.

EU/UK/CH Rights (GDPR)

You have the right to:

• Access: Obtain confirmation and a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion ("right to be forgotten")
• Restriction: Limit processing in certain circumstances
• Portability: Receive data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests, including direct marketing
• Withdraw Consent: Withdraw consent at any time (without affecting prior processing)

You may also lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, CNIL in France, etc.).

Our Commitment to Children's Privacy

Trailies takes children's privacy seriously. Our website and Services are designed for adult purchasers such as parents, guardians, and educators, not for children. We are committed to complying with the Children's Online Privacy Protection Act (COPPA) and equivalent international requirements.

9.1 What Children's Information We Collect

During Life School subscription onboarding, parents may optionally provide:

• Child's first name (to personalize story delivery, e.g., "Good morning, Emma!")
• Child's age or age range (to recommend age-appropriate content)

This information is provided by the parent/guardian, not collected directly from the child. Children do not interact with our website or input information themselves.

9.2 How We Use Children's Information

• Personalization only: We use the child's first name and age solely to customize the content experience within Life School.
• No targeted advertising: We NEVER use children's personal information for targeted advertising, behavioral profiling, or marketing purposes.
• No third-party sharing for marketing: We do not sell, share, or disclose children's information to third parties for their own marketing purposes.
• Limited sharing: Children's information may only be shared with service providers who help deliver the Life School service (e.g., email delivery platforms) under strict contractual obligations to use the data only for service delivery and to maintain appropriate security.

9.3 Data Retention for Children's Information

• We retain children's information only as long as necessary to provide the personalized service.
• Upon subscription cancellation or parental request, we delete children's information within 30 days.
• In any case, we do not retain children's information for more than 12 months after the subscription ends or the service is fulfilled.

9.4 Parental Rights

Parents and guardians have the right to:

• Review: Request access to any information we have collected about their child
• Delete: Request deletion of their child's information at any time
• Refuse: Decline to provide children's information (personalization features may be limited)
• Withdraw: Withdraw consent for future collection/use of their child's information

To exercise these rights, email support@trailies.com with subject line "Parental Rights Request" and include your account email and the child's first name.

9.5 Inadvertent Collection

If we learn that we have inadvertently collected personal information directly from a child under 13 (or the applicable age in other jurisdictions) without verifiable parental consent, we will delete that information promptly. If you believe we have collected information from a child, please contact us immediately at support@trailies.com.

9.6 Security for Children's Data

We maintain appropriate technical and organizational security measures for children's information, including access controls, encryption in transit, and limiting access to personnel who need it to provide the service.

9.7 International (EU/UK/CH)

For users in the EU, UK, and Switzerland, where we process children's data and consent is required as the legal basis, we obtain authorization from the parent or guardian where the child is below the applicable digital age of consent (which varies from 13 to 16 depending on the country).

10.1 Service Providers (Processors)

We share personal information with the following categories of service providers, who process data on our behalf under contractual obligations (including GDPR Article 28 data processing agreements and CCPA service provider terms where applicable):

10.2 Advertising Partners

We work with Meta (Facebook/Instagram), Google, TikTok, and Pinterest for measurement, attribution, and targeted advertising. Their tags run on our Site as pixels, and we also send conversion events through their server-side conversion APIs. Where we send identifiers server-side for matching (such as email addresses), they are hashed before transmission. These partners may receive hashed identifiers, browsing and e-commerce events, and conversion values, subject to your consent (EU/UK/CH) and opt-out choices (U.S.).

We do not transmit raw personal information in URLs. Where we share identifiers for matching purposes, we use hashing where applicable. We do not share sensitive personal information with advertising partners.

10.3 Other Disclosures

We may also disclose personal information:

• Legal Compliance: When required by law, subpoena, court order, or government request
• Rights Protection: To protect our rights, privacy, safety, or property, or that of our users or others
• Business Transfers: In connection with a merger, acquisition, bankruptcy, or sale of assets (your data may be transferred to the acquiring entity)
• With Your Consent: When you direct us to share information with a third party

Trailies is based in the United States. If you access our Services from outside the U.S., your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

For EU/UK/Swiss Users: We transfer personal data to the U.S. using one or more of the following mechanisms:

• EU-U.S. Data Privacy Framework (and UK Extension / Swiss-U.S. DPF), if/when we are certified
• Standard Contractual Clauses (SCCs), the European Commission-approved model clauses, supplemented by additional technical and organizational measures where appropriate

We will update this section to reflect our Data Privacy Framework certification status when applicable. You may request a copy of the SCCs we use by contacting us at support@trailies.com.

We implement commercially reasonable (under U.S. law) and appropriate (under GDPR Article 32) technical and organizational security measures to protect your personal information, including:

• Encryption: SSL/TLS encryption for data in transit; encryption at rest for sensitive data where appropriate
• Access Controls: Role-based access limiting data access to authorized personnel on a need-to-know basis
• Secure Payment Processing: Payment data handled by PCI-DSS compliant processors (Stripe); we do not store full card numbers
• Monitoring: Security logging and monitoring for suspicious activity
• Vendor Due Diligence: Security assessments of key service providers
• Incident Response: Procedures for responding to and reporting data breaches as required by law

No Guarantee: While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

We retain personal information for the periods disclosed in Section 2 (Notice at Collection) or, where a specific period is not stated, based on the following criteria:

• The purposes for which we collected the information
• Legal, accounting, or reporting obligations (e.g., 7-year tax record retention)
• Applicable statutes of limitations for potential legal claims
• Your relationship with us (active customer vs. inactive)
• Security and fraud prevention needs

When retention is no longer necessary, we securely delete or de-identify personal information. For deletion requests, we will delete your data within 45 days unless we have a legal obligation or legitimate basis to retain it.

14) Automated Decision-Making & Profiling

We conduct profiling for marketing segmentation, product recommendations, and analytics. We do not engage in solely automated decision-making that produces legal or similarly significant effects on you (e.g., we don't auto-deny orders based on algorithmic scoring alone).

EU/UK users may object to direct marketing profiling at any time by contacting us or using the unsubscribe links in our emails.

15) Financial Incentives (California)

If we offer a loyalty program, referral program, or other program that involves price or service differences in exchange for personal information, we will provide: (a) a description of material terms; (b) categories of personal information involved; (c) opt-in/out methods; and (d) a good-faith estimate of the value of the consumer's data and how we calculated it.

Currently, we do not operate such programs.

16) Marketing Communications

Email: We comply with CAN-SPAM, including providing our physical address and an easy unsubscribe mechanism in every commercial email. This includes abandoned-cart reminder emails, each of which contains an unsubscribe link that we honor promptly. You can unsubscribe at any time by clicking the link in any email or contacting us.

17) Regional Privacy Supplements

California (CCPA/CPRA)

Your California Rights: Access/know, correction, deletion, portability, opt-out of sale/sharing, limit use of sensitive PI (if applicable), and non-discrimination.

We honor Global Privacy Control (GPC) as a valid opt-out signal.

California Shine the Light: California Civil Code § 1798.83 permits California residents to request information about disclosure of personal information to third parties for direct marketing. We do not share personal information with third parties for their own direct marketing purposes.

Exercise your rights via Your Privacy Choices or email support@trailies.com.

Colorado, Connecticut, Virginia, Texas & Other States

Residents of states with comprehensive privacy laws have similar rights to access, correct, delete, and opt-out of targeted advertising.

We provide an appeals process for denied requests (CO/CT/VA). To appeal, email support@trailies.com with "Privacy Appeal" in the subject line.

We honor recognized Universal Opt-Out Mechanisms where required by state law.

EU/UK/Switzerland (GDPR & ePrivacy)

Non-essential cookies and ad personalization require your prior consent. Refusing consent is as easy as accepting it. You can withdraw consent at any time via Cookie Settings.

You have the rights described in Section 8 and may contact your local supervisory authority with complaints.

For EU/UK data protection inquiries, contact us at support@trailies.com.

18) Third-Party Links

Our Site may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any personal information.

19) Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the "Last Updated" date at the top and may provide additional notice (such as a banner on our Site or an email notification).

For changes requiring consent under applicable law (e.g., new non-essential cookies in the EU/UK/CH), we will obtain your consent before implementing those changes.

We encourage you to review this Privacy Policy periodically.

© 2024-2026 Trailies LLC. All rights reserved.