Privacy policy
Effective: 17 October 2026 Last updated: 15 October 2026
Imperfects ("we", "us") operates imperfects.com. This policy explains what personal information we collect, why, who we share it with, and the choices you have.
The short version
- We collect what we need to run the store — your order, your account, and how you use the site.
- We show a cookie banner and do not set advertising or analytics cookies until you accept.
- We share data with advertising partners for targeted advertising. You can opt out at any time, and we honour Global Privacy Control signals automatically.
- We do not sell your information other than the limited sales described in this policy.
- Our sharing partners are named below.
1. Information we collect
You give us: name, email, postal address, phone, order and payment details (processed by Shopify — we never store full card numbers), marketing preferences, customer service correspondence, and returns or exchange requests.
Collected automatically: IP address, browser and device type, operating system, screen dimensions, referring URL, pages viewed, products viewed, search terms, cart activity, and cookie identifiers.
We may also receive information about you from advertising and analytics partners, for example data about your interactions with ads we run on other platforms.
We do not collect precise geolocation, biometric data, or knowingly collect information from children under 16.
2. Why we use it
Fulfilling orders and returns · customer support · fraud prevention and site security · site functionality and personalisation · measuring how the site performs · marketing communications you have opted into · advertising, including targeted advertising on other platforms · meeting legal obligations.
We do not use your personal information to train our own artificial intelligence or machine learning models.
3. Cookies and tracking
We use cookies and similar technologies. Strictly necessary cookies load on arrival; all others wait until you accept them via our cookie banner. You can change your choice at any time using "Manage preferences" in the banner.
Complete inventory as of 8 September 2026.
Strictly necessary — always active
| Cookie | Set by | Purpose | Expiry |
|---|---|---|---|
_shopify_essential |
Shopify | Core store function | ~1 year |
_secure_session_id |
Shopify | Secure session | Session |
cart, cart_currency
|
Shopify | Cart contents and currency | 2 weeks – 3 months |
localization |
Shopify | Country and language preference | ~1 year |
shopify_client_id |
Shopify | Store client identifier | ~1 year |
_shopify_s, _shopify_y
|
Shopify | Session and unique-visitor counting | 30 min – 1 year |
_shop_app_essential |
Shopify (Shop) | Shop Pay and order tracking | ~1 year |
Analytics — only after you accept
| Cookie | Set by | Purpose | Expiry |
|---|---|---|---|
_shopify_analytics |
Shopify | Store analytics | ~1 year |
_ga, _ga_X0GMD17GPH, _ga_42CVM1V5LC
|
Google Analytics 4 | Usage measurement | ~14 months |
Marketing and advertising — only after you accept
| Cookie | Set by | Purpose | Expiry |
|---|---|---|---|
_shopify_marketing |
Shopify | Marketing attribution | ~1 year |
_fbp |
Meta | Advertising and measurement | ~3 months |
_gcl_au |
Google Ads | Conversion measurement | ~3 months |
_ttp, ttcsid, ttcsid_*
|
TikTok | Advertising and measurement | ~1 year |
_pin_unauth, _pinterest_ct_ua
|
Advertising and measurement | ~1 year | |
__kla_id |
Klaviyo | Email and SMS marketing attribution | ~1 year |
VISITOR_INFO1_LIVE, YSC, __Secure-YNID, __Secure-ROLLOUT_TOKEN, VISITOR_PRIVACY_METADATA
|
YouTube (Google) | Embedded video playback | Session – ~18 months |
Browser storage. Our returns and support provider, Redo, stores a randomly generated identifier and service configuration in your browser's local storage to operate the returns and support widget. This is not a cookie but functions similarly, and we disclose it for completeness. Under our configuration this identifier remains in your browser and is not transmitted to Redo unless you interact with the widget.
4. Who we share information with
We share information with the categories of partners described below. The specific partners named are current as of the date of this policy and are reviewed and revised, as needed, with each update.
| Recipient | What they receive | Why |
|---|---|---|
| Shopify | Order, account, browsing and payment data | Our ecommerce platform and host |
| Meta (Facebook, Instagram) | Browsing and purchase events, cookie identifiers | Advertising and measurement |
| Google (Analytics, Ads, Merchant Center, YouTube) | Browsing and purchase events, cookie identifiers | Analytics, advertising, embedded video |
| TikTok | Browsing and purchase events, cookie identifiers | Advertising and measurement |
| Browsing and purchase events, cookie identifiers | Advertising and measurement | |
| Klaviyo | Email and SMS contact details, browsing and purchase events | Email and SMS marketing |
| Redo | Order and returns data, support conversations | Returns, exchanges and customer support. Where you use the support chat, conversation content may be processed by Redo's approved AI providers |
| accessiBe | Page interactions needed to run the accessibility widget | Website accessibility |
| DataShips | Marketing opt-in choices at checkout | Region-appropriate consent capture |
| FlavorCloud | Shipping and address data for international orders | International delivery |
Some partners receive data server-to-server as well as from your browser. We also disclose information to payment processors, shipping carriers, and where required by law. Our service providers may use your information only to provide services to us. Our advertisers may use the information they receive as described in section 5. Service providers, including advertisers, may derive aggregated, de-identified statistics that do not identify you to improve their own services.
Text messaging. If you opt in to SMS marketing, we collect your mobile number and your opt-in choice. Mobile opt-in information and consent are shared only with our messaging service provider, Klaviyo, to send the messages you asked for; they are not shared with any third party for that party's own marketing or promotional purposes. Reply STOP to any message to opt out.
5. "Sale" and "sharing" of personal information
Some of the data sharing described in this policy — such as disclosing your browsing and purchase information to advertising platforms so they can show you ads on other sites and apps — counts as "sharing" for cross-context behavioural advertising, and can also count as a "sale" even though no money changes hands. We do this, and you can opt out.
We share personal information with advertising and measurement platform partners for this purpose — currently Meta, Google, TikTok and Pinterest. The categories involved are identifiers, internet activity, and commercial information.
Our other providers — including ecommerce, marketing, returns, accessibility, consent management, and delivery partners such as those listed in section 4 — act as service providers or processors under contract, using your information only to deliver services to us. Disclosures to a service provider are not a sale or a share.
We do not otherwise sell personal information, for example for money to data brokers. We do not sell or share sensitive personal information. We do not sell or share the personal information of anyone we know to be under 18.
To opt out: use our Do Not Sell or Share My Personal Information page, linked in the footer of every page, and we will confirm on screen when your opt-out has been applied. You may also decline marketing cookies in the cookie banner. If your browser sends a Global Privacy Control signal, we treat that as an opt-out for that browser automatically.
We do not use automated decision-making that produces legal or similarly significant effects about you.
6. Global Privacy Control
We honour GPC. If your browser sends a Global Privacy Control signal, we treat it as a valid request to opt out of the sale and sharing of your personal information, automatically and without further action from you. This applies in every region where we offer the opt-out.
We do not currently respond to browser "Do Not Track" signals, which are different from GPC.
7. Your privacy rights
California (CCPA/CPRA)
You have the right to know what we collect and disclose · access a copy and receive it in a portable format · delete · correct · opt out of sale or sharing · limit the use of sensitive personal information · and not be discriminated against for exercising any of these.
We collect the following CCPA categories: identifiers; customer records; commercial information; internet or network activity; geolocation inferred from IP address; and inferences drawn for personalisation.
For each of these categories, we obtain the information from you directly, from your browser and device, and from the advertising and analytics partners named in section 4; we use it for the purposes listed in section 2; and we disclose it to the service providers and other recipients described in section 4 and, for identifiers, internet activity and commercial information only, to the advertising partners named in section 5. Retention periods are in section 8.
The sensitive personal information we collect is limited to account log-in credentials and payment details. We use it only to provide the products and services you request, to maintain security and prevent fraud, and for the other purposes permitted by California law, so we do not offer a "Limit the Use of My Sensitive Personal Information" option. We do not sell or share sensitive personal information.
Other US states
A growing number of US states provide comparable rights, including access, correction, deletion, portability, opt-out of targeted advertising, opt-out of profiling where it produces legal or similarly significant effects, and the right to know what inferences have been drawn about you.
If we decline a request, you may appeal by replying to our decision or writing to the contact below. We will respond to an appeal within 45 days and, if we deny it, tell you how to raise the matter with your state Attorney General.
EEA, UK and Switzerland
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time. Our lawful bases are contract performance (orders), consent (marketing and non-essential cookies), legitimate interests (security, fraud prevention, service improvement), and compliance with a legal obligation (for example, tax and regulatory record-keeping).
Where we use your information for advertising on other platforms, we rely on your consent. Providing your name, delivery address and payment details is necessary to enter into a contract with us; other information is optional.
If you have a complaint about how we handle your personal information, please contact us first using the details in section 12. If you are not satisfied with our response, you may complain to your local supervisory authority. Your right to complain to a supervisory authority does not depend on contacting us first.
Canada
You may request access to and correction of personal information we hold about you, and you may withdraw your consent to our processing at any time, subject to legal or contractual restrictions.
Brazil
You may confirm whether we process your personal information, request access, correct incomplete or inaccurate data, request anonymisation, blocking or deletion of unnecessary data, request data portability, obtain information about entities with which we have shared your data, and withdraw consent at any time.
Australia
You may request access to and correction of personal information we hold about you, and you may request details about how any automated decisions affecting you were made. If you are not satisfied with how we handle your complaint, you may refer the matter to the relevant privacy regulator.
Other jurisdictions
Depending on where you live, you may have additional rights under applicable law. Contact us using the details in section 12 and we will respond in accordance with applicable requirements.
How to exercise any of these
Email the address in section 12, or write to us at the postal address given there. We will verify your identity before acting, and respond within the timeframe your jurisdiction requires, typically within 30 to 45 days. Where permitted, we may extend this period and will let you know if we do. An authorised agent may act on your behalf with proof of authorisation.
We will not discriminate against you for exercising any of your privacy rights.
8. How long we keep information
| Category | How long we keep it |
|---|---|
| Order and transaction records | 7 years, for tax, accounting, warranty and returns history |
| Customer accounts | For as long as your account remains open. If you ask us to close it, we delete or anonymise your account information within 90 days, except records we are required to keep for tax purposes |
| Marketing contacts | Until you unsubscribe. After that we keep only the minimum needed to honour your unsubscribe, so we do not contact you again in error |
| Customer service and returns correspondence | 5 years from the last message in systems we control. Records held by our returns and support provider are retained under their own policy — currently for the duration of our engagement with them and up to 6 years afterwards |
| Cookie and analytics data | As set out in the expiries in section 3 |
We delete or anonymise information once it is no longer reasonably necessary for the purpose it was collected for.
9. International transfers
We are based in the United States and our service providers may process your information in the United States and elsewhere. For transfers from the EEA, UK and Switzerland we rely on recognized transfer mechanisms, including adequacy frameworks and standard contractual clauses with the applicable addenda, as incorporated into our agreements with those providers. You can ask us for a copy of these safeguards using the contact details in section 12.
10. Security
Payment card data is encrypted and handled under PCI-DSS by Shopify and its payment gateways; we never store full card numbers. We apply access controls and encryption in transit. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Children
This site is not directed at children under 16 and we do not knowingly collect their personal information. We do not knowingly direct targeted advertising to, or sell or share the personal information of, anyone we know to be under 18. If you believe a child has given us information, contact us and we will delete it.
12. Changes and contact
We will post any changes here and update the "Last updated" date. For material changes, we will notify you by email or by a prominent notice on our website before the change takes effect.
Imperfects is the controller of your personal information for the purposes of applicable data protection law.
Imperfects 4887 Voltaire Street, San Diego, CA 92107 support@imperfects.com