Join the Curlashes club
Get new product announcements, skincare tips, and exclusive discounts.
Privacy Policy
CCPA / CPRA
We never sell your data for money
Advertising opt-out available
At a glance: Curlashes collects the personal data needed to fulfil your order, provide support, and run our advertising. We never sell your personal information for money. We do use the Meta Pixel, Google Ads tag and Google Analytics, which share limited data with Meta and Google for advertising and measurement — under California and several other state privacy laws this counts as “sharing” for cross-context behavioural advertising, and you have the right to opt out (see Sections 04 and 05). The business responsible for your data is Cancel Culture LLC, 30 N Gould St Ste N, Sheridan, Wyoming 82801, United States. Contact: support@curlashes.com.
This Privacy Policy explains how Curlashes (“we,” “us,” or “our”) collects, uses, stores and protects your personal information when you visit curlashes.com or place an order with us. Curlashes is operated by Cancel Culture LLC, the business responsible for all personal data processed through this website. We serve customers in the United States and we take our privacy obligations under applicable US law seriously.
Business responsible for your data
Cancel Culture LLC — trading as Curlashes
Cancel Culture LLC determines the purposes and means of processing your personal data in connection with the curlashes.com online store. Shopify Inc. acts as a service provider on our behalf for platform and payment functions. Meta and Google receive limited data through the advertising and analytics tags described in Section 04.
Registered entity
Cancel Culture LLC
30 N Gould St Ste N
Sheridan, Wyoming 82801
United States
EIN: 001792795
Privacy contact
For all privacy-related requests:
support@curlashes.com
Subject line: “Privacy Request”
curlashes.com
01
Data We Collect
We collect the personal data necessary to fulfil your order, provide customer support, operate our store lawfully, and measure our advertising. We do not collect data we do not need, and we do not retain data beyond the periods described in this Policy.
Personal Data
Full name
Email address
Shipping address
Billing address
Phone number (if provided)
IP address
Browser type and version
Device type and operating system
Order Data
Items purchased and quantities
Order history
Payment method type (for example Visa or PayPal — not the full card number)
Order number and transaction reference
Shipping carrier and tracking number
We never store full card numbers, CVV codes or card expiry dates
Category
Data collected
Source
Identity & contact
Full name, email address, phone number (if provided)
Provided by you at checkout
Shipping & billing
Street address, city, state, zip code
Provided by you at checkout
Order & transaction
Items ordered, quantities, prices, payment method type, order number, transaction reference
Generated at checkout; payment type from the processor
Payment data
Card type and last four digits only — full card details are processed exclusively by our PCI DSS certified payment processor via Shopify Payments
Received from the payment processor
Automatically collected
Cookies, session data, IP address, browser type, device type, pages visited, referral source
Collected automatically via Shopify, Google Analytics and the Meta Pixel
Advertising identifiers
Cookie and pixel identifiers, ad click identifiers (such as Google’s gclid and Meta’s fbclid), and, where our tags are configured for it, a hashed (irreversibly scrambled) version of your email address used to match your purchase to an ad
Collected via the Meta Pixel, Google Ads tag and Google Analytics
Communications
Emails, support messages, return enquiries and product questions sent to us
Provided by you when contacting us
Marketing preferences
Email marketing opt-in or opt-out status, communication preferences
Provided by you at checkout or via an unsubscribe link
What we do not collect
We do not collect sensitive personal information such as health or medical records, racial or ethnic origin, religious beliefs, precise geolocation, or biometric data. We do not ask about skin or eye conditions, and any information you volunteer in a support email about a reaction to a product is used solely to resolve your case and is not used for advertising. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, contact support@curlashes.com and we will delete it promptly.
02
How We Use Your Data
We use your personal data only for the purposes listed below: to fulfil your order, to support you afterwards, to meet our legal obligations, and to run and measure our advertising.
Order fulfilment
Processing and confirming your order
Payment processing via Shopify Payments and other selected providers
Arranging shipping and providing tracking updates
Managing returns, refunds and product swaps
Customer service
Responding to your enquiries and support requests
Advising on shades, formulas and product suitability
Sending order confirmations and shipping notifications
Investigating and resolving reported product issues
Legal & compliance
Fraud prevention and detection
Tax and accounting obligations
Responding to lawful government or regulatory requests
Site security and abuse prevention
Advertising & marketing
Measuring which ads lead to visits and purchases, so we know what to spend on
Showing you Curlashes ads on Meta platforms and across the Google network, including reminders of products you viewed
Building audiences of people with similar interests to our customers
Sending promotional emails where you have opted in — unsubscribe any time via the link in any marketing email
We do not send marketing emails without your consent
Data Type
Purpose
Basis
Name, address, contact
Order fulfilment, shipping, customer service
Necessary to perform our contract with you
Payment method type
Payment processing, fraud prevention
Necessary to perform our contract with you
Order history
Customer service, returns, legal compliance
Contract / Legal obligation
IP address, device data
Fraud prevention, site security, traffic analysis
Our legitimate business interest
Analytics cookies
Understanding how the site is used so we can improve it
Your consent, where required in your state
Advertising identifiers & pixel data
Ad measurement, retargeting and audience building with Meta and Google
Your consent or your right to opt out, depending on your state
Email address (marketing)
Promotional emails and product updates
Your consent
Transaction records
Tax compliance, accounting records
Legal obligation
03
Data Sharing & Third Parties
We share your personal data with the service providers essential to running our store and fulfilling your order, and with the advertising platforms we use to reach customers. We want to be precise about the difference, because a lot of privacy policies are not.
We never sell your personal data for money
Cancel Culture LLC does not sell, rent or trade your personal information to data brokers or to any third party for monetary payment. We do, however, run advertising tags that share limited data with Meta and Google — which several US state privacy laws classify as “selling” or “sharing”. We would rather tell you that plainly than hide behind a technicality. Section 05 explains exactly how to opt out.
Service providers — acting on our instructions
Shopify Inc. — our e-commerce platform. Processes order, customer and payment data on our behalf under a data processing agreement.
Payment processors (Shopify Payments, PayPal, Amazon Pay) — process your payment securely under PCI DSS compliance. They receive only what is needed to authorise and complete your transaction.
Shipping carriers — your name, delivery address and contact details are shared to deliver your parcel and provide tracking.
Email service provider — receives your email address to send order notifications and, if you opted in, marketing emails.
Advertising partners — this is “sharing”
Meta Platforms, Inc. — the Meta Pixel reports your activity on our site (pages viewed, items added to cart, purchases and order value) so we can measure our Facebook and Instagram advertising and show you relevant ads.
Google LLC (Google Ads) — the Google Ads conversion and remarketing tag reports the same kind of activity so we can measure our Google advertising and show you Curlashes ads across Google’s network.
Google LLC (Google Analytics) — measures site traffic and how visitors move through the store, so we can improve it.
These partners process the data they receive for their own purposes as well as ours, under their own privacy policies. That is why it counts as sharing rather than simple processing.
What our advertising partners do not receive
Your full payment card number, CVV or expiry date — we never hold these ourselves
Your street address
The content of your support emails to us
Any information about a skin or eye reaction you report to us
Who we never share with
Data brokers or data aggregators
Any third party that wants to market its own unrelated products to you
Any purchaser of personal data in exchange for money
Any party outside order fulfilment, support and the advertising partners named above, without your consent or a legal obligation
Shopify as our service provider
Shopify processes your data on our behalf and is bound by data processing obligations.
Shopify Inc. provides the e-commerce platform and payment infrastructure that powers curlashes.com. In this role Shopify acts as a service provider: it processes your personal data on our instructions and subject to a Data Processing Agreement. Shopify maintains its own privacy programme and security infrastructure, including PCI DSS Level 1 compliance for payment data.
What Shopify processes
Order data, customer contact details, payment method information, shipping details and site analytics. Shopify does not use this data for its own marketing or sell it on our behalf.
Data location
Shopify stores data on servers in the United States. Shopify’s privacy policy is available at shopify.com/legal/privacy. Meta and Google likewise process data in the United States and other countries under their own published policies.
04
Cookies & Advertising Technologies
We use cookies and similar technologies on curlashes.com for three things: to make the store work, to understand how it is used, and to run our advertising. Below is the complete list of the third-party tags on this site. There are exactly three, and we do not add others without updating this page.
Tag
Provider & purpose
What it reports
Meta Pixel
Meta Platforms, Inc. — measurement of our Facebook and Instagram advertising, retargeting, and audience building
Pages viewed, items viewed and added to cart, checkout events, purchase and order value, plus cookie and device identifiers. Where advanced matching is enabled, a hashed version of your email address
Google Ads tag
Google LLC — conversion tracking and remarketing for our Google advertising
Ad clicks, pages viewed, purchase and order value, plus cookie identifiers and the gclid click identifier
Google Analytics
Google LLC — traffic and behaviour analysis so we can improve the store
Pages visited, session duration, referral source, approximate location from IP, device and browser type
Shopify essential cookies
Shopify Inc. — core store functionality
Cart contents, checkout session, login session, security and fraud detection tokens
How to opt out
Global Privacy Control: we honour the GPC browser signal. If your browser or extension sends GPC, we treat it as a valid request to stop sharing your data for advertising, with no further action needed from you.
Email us: write to support@curlashes.com with the subject “Do Not Sell or Share My Personal Information” and we will suppress your data from our advertising audiences.
Browser settings: most browsers let you block or delete cookies through their privacy settings.
Google Analytics: install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.
Opt out at the platform
Meta: adjust how your data is used for ads in your Facebook or Instagram account under Settings › Ads › Ad preferences.
Google: manage ad personalisation at myadcenter.google.com, which applies across Google Search, YouTube and the display network.
Industry tools: the Digital Advertising Alliance offers a cross-platform opt-out at optout.aboutads.info.
Opting out of advertising does not affect your ability to browse, order or receive support from us.
Note on essential cookies
Disabling essential cookies may prevent core features from working, including the cart and checkout. We recommend leaving essential cookies enabled. Blocking analytics and advertising cookies has no effect on your ability to shop.
05
US State Privacy Rights
Several US states give residents specific rights over their personal information. California’s law is the most detailed and is set out first, followed by the rights available in other states with comprehensive privacy laws. We extend the core rights below to every US customer regardless of where you live.
California Consumer Privacy Act (CCPA / CPRA)
California residents have meaningful rights over their personal information.
The CCPA, as amended by the CPRA, gives California residents the right to know, delete, correct, and opt out of the sale or sharing of personal information for cross-context behavioural advertising. These rights apply to information collected, used, disclosed or shared by Curlashes (Cancel Culture LLC) in relation to California residents.
Right to Know
Request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the business purposes for collection, and the categories of third parties we share it with.
Right to Delete
Request deletion of the personal information we collected from you, subject to exceptions such as completing a transaction, detecting fraud, or complying with a legal obligation like tax record-keeping.
Right to Correct
Request that we correct inaccurate personal information we hold about you, taking into account the nature of the data and the purposes of the processing.
Right to Opt Out of Sharing
Direct us to stop sharing your personal information for cross-context behavioural advertising. Because we run the Meta Pixel and the Google Ads tag, this right is live and meaningful — see the box below.
Non-Discrimination
We will not discriminate against you for exercising any privacy right. We will not deny you goods or services, charge you a different price, or provide a lower quality of service because you exercised your rights.
Consumers under 16
We do not knowingly sell or share the personal information of consumers under 16 years of age. If we learn that a user is under 16, we exclude their data from our advertising audiences.
Do Not Sell or Share My Personal Information
We do not sell your personal information for money. We do share personal information with Meta and Google for cross-context behavioural advertising through the tags described in Section 04, which California treats as “sharing”. To opt out, either enable the Global Privacy Control signal in your browser, which we honour automatically, or email support@curlashes.com with the subject “Do Not Sell or Share My Personal Information”. We will action your request within 15 business days and you do not need an account to make it.
Other US states
Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, New Jersey and others as those laws come into force — have broadly similar rights: to confirm whether we process their data, to access and obtain a copy of it, to correct it, to delete it, and to opt out of targeted advertising and profiling. Several of these states also require us to honour the Global Privacy Control signal, which we do. Some provide a right to appeal a refused request; if we decline your request, we will explain why and tell you how to appeal. Use the same contact route and we will apply the standard of your state.
How to exercise your rights
Email: support@curlashes.com
Subject line: “Privacy Request” (or “Do Not Sell or Share My Personal Information” for an advertising opt-out)
Include your full name, the email address used on your order, and a description of your request. We may need to verify your identity before we act, usually by confirming details of a recent order.
We acknowledge requests within 10 business days and respond in full within 45 days. If we need more time, up to a further 45 days, we will tell you why before the first period expires.
Authorised agents
You may appoint an authorised agent to make a request on your behalf. Your agent must provide written permission signed by you, and we may still ask you to verify your identity with us directly to confirm the agent’s authority.
We handle privacy requests at no charge, and we will not discriminate against you for making one. If we are unable to fulfil a request, we will tell you the specific reason.
06
Data Retention & Security
We keep personal data only for as long as necessary for the purposes it was collected for, or as required by law. We use industry-standard security measures to protect it against unauthorised access, loss or disclosure.
Order data
Retained for 7 years from the transaction date to meet US federal and state tax and accounting obligations, including IRS record-keeping requirements. After that period data is securely deleted or anonymised.
Marketing data
Retained while you remain subscribed. When you unsubscribe we keep a suppression record of your opt-out so that we do not contact you again — this is required to honour your choice. Records are reviewed after 3 years of inactivity and deleted unless you are an active customer.
Account & customer data
Retained until you ask us to delete your account or personal data, subject to our legal retention obligations. We confirm deletion within 30 days of a valid request.
Analytics & advertising data
Google Analytics data is retained according to the retention period configured in our account, and Google applies its own limits. Data held by Meta and Google from our advertising tags is retained under those companies’ own policies, which we do not control — use their account tools, linked in Section 04, to manage it directly. Session cookies are cleared at the end of each browsing session.
Security measures
Your data is protected by industry-standard technical and organisational controls.
We use Shopify, an e-commerce platform with substantial security infrastructure and a dedicated security team, to store and process your personal information. Payment data is processed exclusively by PCI DSS certified processors — we never see or store your full card details, CVV or expiry date.
Technical measures
SSL/TLS encryption across the site. PCI DSS compliance through Shopify Payments. Access controls and authentication for internal systems. Regular security updates through Shopify’s platform infrastructure.
Organisational measures
Access to personal data is limited to the people who need it to fulfil orders or provide support. Data processing agreements are in place with our service providers. We maintain incident response and breach notification procedures.
Data breach notification
No system is completely secure, and we cannot guarantee absolute security of your personal data. If a breach occurs that creates a real risk of harm to you, we will notify you and the relevant authorities as required by applicable state breach notification law, without unreasonable delay. Our notification will describe the nature of the breach, the data involved, the likely consequences, and what we have done or will do about it.
07
Changes to This Policy & Contact
We review and update this Privacy Policy to reflect changes in our practices, applicable law, and the tools we use. When we make material changes, we will tell you.
Policy updates
The effective date at the top of this page always reflects the current version. For material changes — including adding any new advertising or tracking tag beyond the three named in Section 04 — we will update this page and post a notice on curlashes.com before the change takes effect. We encourage you to review this Policy from time to time.
Governing law
This Privacy Policy is governed by the laws of the State of Wyoming, United States, without regard to conflict of law principles, except where superseded by mandatory consumer privacy law applicable where you live, including the CCPA for California residents.
Privacy contact
Cancel Culture LLC — Curlashes
For privacy enquiries, access requests, correction requests, deletion requests, advertising opt-outs or complaints, contact us using the details below. We take every privacy request seriously and will respond promptly and fairly.
Mailing address
Cancel Culture LLC
30 N Gould St Ste N
Sheridan, Wyoming 82801
United States
EIN: 001792795
Contact details
Email: support@curlashes.com
Website: curlashes.com
Subject line: “Privacy Request”
Response times: advertising opt-outs are actioned within 15 business days. Access, correction and deletion requests are acknowledged within 10 business days and answered in full within 45 days, extendable once by a further 45 days where necessary, with notice to you.
We would prefer to resolve directly
We take privacy concerns seriously and will address your query promptly and fairly. You always retain the right to contact your state attorney general, or the California Privacy Protection Agency if you are a California resident, but we ask that you contact us first at support@curlashes.com so we have the chance to put things right.
Privacy questions?
We action advertising opt-outs within 15 business days and answer other privacy requests within 45 days.
support@curlashes.comThis Privacy Policy applies to the processing of personal information of individuals in the United States, including California, by Curlashes (Cancel Culture LLC) via curlashes.com. It is effective from 18 September 2026. California residents are covered by the CCPA as amended by the CPRA; residents of other states with comprehensive privacy laws hold equivalent rights as described in Section 05. Cancel Culture LLC, 30 N Gould St Ste N, Sheridan, Wyoming 82801, United States, EIN 001792795.