Document № A · Privacy

Privacy Policy.

In plain English: what we collect, why we collect it, who we share it with, and how to ask us to delete it. Written by the founder, reviewed by counsel.

Effective date: 27 May 2026. Last updated: 27 May 2026.

Pupproper, Inc. ("Pupproper," "we," "our," or "us") operates the website at pupproper.com and sells dog grooming products through it. This Privacy Policy explains what personal information we collect about you, what we do with it, who we share it with, and what rights you have over it. If anything here is unclear, write to us at hello@pupproper.com and we will rewrite it more clearly.

Section IWho we are

Pupproper, Inc. is a Delaware corporation based in Brooklyn, New York. We sell two dog grooming products — Resurrection Dry Wash and Confession Stain Remedy — and a bundle of the two called The Confessional. Our products are built from GRAS-listed ingredients, each named on the bottle.

Our website runs on Vercel, our payments run through Stripe, our analytics run through Google Analytics 4 and Plausible, and our advertising runs through Meta. We treat the personal information we collect as if it belonged to a member of our own household.

Section IIWhat we collect

From every visitor (automatic)

  • Device + browser information: what browser and operating system you use, what screen resolution, what language preference. We use this to make the site work correctly on your device.
  • IP address and approximate location: derived from your IP — country, region, city. We do not store street addresses derived from IP.
  • Pages viewed and interactions: which pages you visited, in what order, how long you stayed, which buttons you clicked, whether you scrolled to the end. Captured by Google Analytics 4, Plausible, and the Meta Pixel.
  • Referrer: which website or ad you came from.
  • Cookies and similar tracking: see Section VII below.

From customers (when you purchase)

  • Name, shipping address, billing address, phone number, email address — entered by you at checkout on Stripe.
  • Payment method information: handled entirely by Stripe. Pupproper does not see or store your credit card number, CVV, or bank account details. We see only the last four digits and the card brand.
  • Order history: what you bought, when, for how much, and where it was shipped.
  • Customer service correspondence: if you email us, we keep the email thread so we can pick up the conversation if you write again.

From subscribers (if you opt in)

  • Email address if you join the waitlist or newsletter.
  • Engagement signals: whether you opened our emails, which links you clicked.

Section IIIWhat we do with it

We use your information for one of six reasons:

  1. To fulfil your order. Names, addresses, and email addresses are used to make and ship the bottle to you, and to email you the order confirmation and tracking link.
  2. To provide customer service. If you write to us, we use what you tell us to answer your question.
  3. To improve the website. Aggregate analytics — how many people visited, how many added to bag, how many completed checkout — help us decide which sections of the site to rewrite, which photographs to swap, which pages to remove.
  4. To send you marketing emails, only if you have explicitly opted in. You can unsubscribe with one click at any time, from any email we send.
  5. To advertise to you on Meta and Google. We use the Meta Pixel and Google Analytics to identify customers who have visited Pupproper but not yet purchased, so we can show them an ad later. You can opt out — see Section VIII.
  6. To comply with the law. If a court order, subpoena, or other lawful request asks us to disclose information, we will respond to the extent legally required and notify you whenever doing so is legally permissible.

We do not sell your personal information to anyone. Ever. We do not rent lists. We do not trade data.

Section IVWho we share it with

We share specific pieces of your information with specific third-party services we use to run the business. Every party below has signed a data processing agreement with us and is contractually limited to using your information only to provide the service we hire them for.

  • Stripe — payment processing. Receives your name, email, shipping address, billing address, and payment method. See Stripe Privacy Policy.
  • Vercel — website hosting. Receives your IP and browser metadata as part of serving the page. See Vercel Privacy Policy.
  • Google Analytics 4 — site usage analytics. Receives anonymized usage data. See Google Privacy Policy.
  • Plausible Analytics — privacy-first site analytics. Stores no personal data and no cookies. See Plausible Privacy Policy.
  • Meta (Facebook + Instagram) — advertising attribution and audience building. Receives event data — page views, product views, add-to-bag, purchase — via the Meta Pixel and our server-side Conversions API. Customer email and phone are hashed (SHA-256) before transmission so Meta cannot read them in plaintext. See Meta Privacy Policy.
  • Klaviyo (when enabled) — email marketing. Receives your email and engagement signals only with your explicit opt-in. See Klaviyo Privacy Notice.
  • Third-party fulfilment — ShipBob or equivalent 3PL. Receives your name, shipping address, and the SKU you ordered to pack and ship your bottle.

We do not share your information with anyone else, for any other reason.

Section VHow long we keep it

Different categories of information have different retention periods:

  • Order records: 7 years (for tax and accounting compliance under IRS rules).
  • Customer service correspondence: 3 years from your last interaction.
  • Email subscription: until you unsubscribe. After unsubscribe, we keep a suppression record (your email + date of unsubscribe) indefinitely so we never accidentally re-add you.
  • Analytics: Google Analytics retains data for 14 months by default; Plausible retains aggregate-only data for 24 months.
  • Meta Pixel events: 180 days for custom audience eligibility; ad event data retained per Meta's own retention policies.
  • Account / session cookies: see Section VII.

Section VIHow we secure it

We use industry-standard security practices: TLS/HTTPS on every page of pupproper.com; access controls and least-privilege permissions on our internal systems; encrypted secrets management for API keys; signed webhooks from Stripe; SHA-256 hashing of customer identifiers before sending to third-party advertising platforms.

Pupproper never stores credit card numbers, CVV codes, or bank account details. Those are handled by Stripe, which is PCI DSS Level 1 certified. We see only the last four digits of the card and the card brand for receipt purposes.

If we ever experience a data breach that affects your personal information, we will notify you by email within 72 hours of discovering it, in compliance with GDPR Article 33 and state notification laws.

Section VIICookies and tracking

We use cookies and similar tracking technologies for three purposes:

  1. Essential cookies — required to make the site work. The Vercel session cookie and the Stripe checkout cookie fall into this category. You cannot opt out of these without breaking the site.
  2. Analytics cookies — Google Analytics 4 sets cookies to count unique visitors and measure engagement. Plausible does not use cookies.
  3. Advertising cookies — the Meta Pixel sets cookies (`_fbp`, `_fbc`) to attribute purchases to ads.

You can disable cookies in your browser settings. You can opt out of Meta tracking at facebook.com/ads/preferences. You can install Google Analytics Opt-Out at tools.google.com/dlpage/gaoptout. We respect the Global Privacy Control browser signal — if your browser sends it, we treat it as an opt-out of sale/share under CCPA.

Section VIIIYour rights

If you are in the European Economic Area, the UK, or Switzerland (GDPR)

You have the right to: access the personal information we hold about you; correct it; delete it; restrict our processing of it; object to processing for marketing purposes; receive a copy in a portable format; and lodge a complaint with your supervisory authority.

If you are in California (CCPA / CPRA)

You have the right to: know what categories of personal information we collect, sell, or share; access the specific information we have collected; delete it; correct it; opt out of "sale" or "sharing" for cross-context behavioural advertising; limit the use of sensitive personal information; not be discriminated against for exercising your rights.

If you are anywhere else

We extend the same rights to every customer, regardless of jurisdiction. To exercise any right, write to hello@pupproper.com with the subject line "Privacy request." We will respond within 30 days.

Section IXChildren

Pupproper is intended for adults purchasing dog grooming products. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, write to hello@pupproper.com and we will delete it.

Section XInternational transfers

Pupproper is based in the United States. If you are visiting from outside the U.S., your information will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses (the EU-approved data transfer mechanism) for transfers from the EEA / UK to the U.S.

Section XIChanges to this policy

If we change this policy materially, we will notify you by email (if you are a customer or subscriber) and post a notice on this page for 30 days. The "Last updated" date at the top of this page always reflects the most recent revision.

Section XIIHow to reach us

Privacy questions, requests, or complaints:

PUPPROPER, INC.
ATTN: PRIVACY
BROOKLYN, NY
hello@pupproper.com

DOCUMENT № A · PRIVACY POLICY · v1.0 · EFFECTIVE 2026-05-27