Privacy policy

Last updated: July 11, 2026

This Privacy Policy explains how CUDL COMPANY LLC, doing business as CudlCozy ("CudlCozy," "we," "us"), collects, uses, and shares your personal information when you visit cudlcozy.com, place an order, or contact us (together, the "Services"). We've written it in plain English on purpose. If anything is unclear, email us at contact@cudlcozy.com and a real person will explain.

Who we are

CudlCozy is a small, US-based shop selling bamboo sleepwear for kids.

Our store runs on Shopify, which provides our hosting, checkout, and payments infrastructure. Shopify processes some of your data on our behalf as described below.

Personal information we collect

Depending on how you interact with us, we collect:

  • Contact details — your name, email address, phone number, and shipping and billing addresses.
  • Order and payment information — what you bought, order value, and payment confirmation. Payments are processed by PCI-compliant payment processors (Shopify Payments through our Shopify checkout). We never see or store your full card number on our own systems.
  • Account information — if you create an account: your login details, order history, and saved addresses.
  • Communications — anything you send us by email, phone, or the contact form, so we can help you and keep a record of what we promised.
  • Device and usage data — IP address, browser and device type, pages viewed, and how you arrived at our site, collected automatically through cookies and similar technologies (details in the cookies section below).

How we collect it

  • Directly from you — when you place an order, create an account, sign up for emails, leave a review, or contact us.
  • Automatically — through cookies, pixels, and similar technologies as you browse the site.
  • From service providers — for example, Shopify shares checkout and payment status with us, carriers share delivery status, and Judge.me shares reviews you choose to submit.

How we use your information

  • To fulfill your orders — process payment, ship your package, send order and tracking emails, and handle returns and exchanges.
  • To support you — answer questions and resolve issues, usually within one business day.
  • For marketing — send emails about products and offers if you've signed up, and show you relevant ads. You can opt out of marketing emails anytime via the unsubscribe link, and opt out of ad tracking as described below.
  • To understand and improve the site — analytics on what's working and what isn't.
  • To prevent fraud — protect our checkout and our customers from fraudulent transactions.
  • To comply with the law — tax, accounting, and legal obligations.

Cookies and tracking technologies

We use cookies and similar technologies from a small, specific set of tools. Here's the honest list:

Tool What it does
Shopify Essential cookies that make the site work — your cart, checkout, and security. These can't be turned off without breaking the store.
Google Analytics 4 Analytics — helps us understand how visitors use the site.
Meta (Facebook & Instagram) advertising tools Advertising — includes a pixel on the site and a server-side Conversions API, used to measure ads and show you relevant ones.
Klaviyo Email marketing — powers our email list and the marketing emails you've signed up for.

We use the Shopify Customer Privacy API and Google Consent Mode v2 to honor your tracking choices. For US visitors, the non-essential tools above run by default until you opt out; where state law gives you an opt-out right, we honor it. To opt out of non-essential tracking, you can:

How we share your information

We share personal information only with the parties below, only as needed to run the store:

  • Shopify and payment processors — to host the site and process your payment securely.
  • Shipping carriers and fulfillment partners — your name and address, so your order actually arrives.
  • Analytics and advertising partners — Google (Analytics) and Meta (advertising), as described in the cookies section.
  • Email service — Klaviyo, to send our marketing emails if you've signed up.
  • Reviews platform — Judge.me, an independent third-party platform that collects and displays our product reviews.
  • Legal and safety — if required by law, court order, or to protect our rights, our customers, or others.
  • Business transfers — if CudlCozy is ever sold or merged, customer information may transfer as part of that transaction, subject to this policy.

We do not sell your personal information for money. However, sharing data with advertising partners for targeted advertising may count as a "sale" or "sharing" of personal information under some state privacy laws. You have the right to opt out of that — use our Your Privacy Choices page.

Your California privacy rights (CCPA/CPRA)

If you're a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you these rights:

  • Right to know and access — request the personal information we've collected about you and how we've used and shared it.
  • Right to delete — ask us to delete your personal information, subject to legal exceptions (for example, records we must keep for tax purposes).
  • Right to correct — ask us to fix inaccurate personal information.
  • Right to opt out of sale or sharing — tell us not to share your data for targeted advertising.
  • Right to limit use of sensitive personal information — we don't use or disclose sensitive personal information for purposes that would require offering this right.
  • Right to non-discrimination — we will never penalize you, deny you service, or charge you differently for exercising any of these rights.

We don't offer loyalty programs or financial incentives in exchange for your personal information.

How to exercise these rights: email contact@cudlcozy.com, use our contact form, or visit the Your Privacy Choices page. To protect your information, we verify requests using details from your order or account. An authorized agent may submit a request on your behalf; we may ask for proof of authorization. We respond within the time required by law; if we ever need more time, we'll tell you.

Other US state privacy rights

If you live in Virginia, Colorado, Connecticut, Texas, or another state with a similar privacy law, you have comparable rights: to access, correct, and delete your personal information, and to opt out of targeted advertising and any sale of your data. Use the same channels — email, the contact form, or the Your Privacy Choices page.

Appeals: if we decline a request and you disagree, reply to our decision and we'll re-review it. We'll explain the outcome of the appeal in writing.

Children's privacy

Our products are made for children, but our Services are directed to their parents and other adults. We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA). If you believe a child under 13 has given us personal information, contact us at contact@cudlcozy.com and we will delete it.

Data retention

We keep personal information as long as we need it to fulfill your orders, support you, and meet our legal and tax obligations. After that, we delete it or de-identify it so it can no longer be linked to you.

Security

We use commercially reasonable safeguards to protect your information. Payment card data is handled entirely by PCI-compliant payment processors and is never stored on our systems. That said, no method of transmission or storage is 100% secure, so we can't guarantee absolute security — no one honestly can.

Third-party links and services

Our site may link to third-party websites or services (for example, a carrier's tracking page or a social media profile). Their privacy practices are governed by their own policies, not this one. We encourage you to read them.

Changes to this policy

If we change this policy, we'll post the updated version on this page with a new "Last updated" date at the top. Material changes may also be announced by email or a notice on the site.

Contact us

Questions, requests, or concerns about your privacy? We're happy to help — most messages are answered within one business day.

You may also lodge a concern with your state attorney general's office.