United States & California Privacy Policy

Last updated: 17 August 2026

This United States and California addendum describes VUNRO’s notice at collection, sale/share disclosures and privacy choices. It supplements our Global Privacy Policy.

Scope

This addendum applies to United States residents. We provide the controls described here whether or not every statutory threshold applies, while any specific statutory right applies to the extent required by the law of your state. “Sale”, “sharing” and “targeted advertising” have the meanings given by applicable US privacy law.

Notice at collection

During the preceding 12 months, and depending on how you used the store, we collected or processed the following categories. We retain them using the periods or criteria in the Global Privacy Policy.

Category	Examples we handle	Main purposes
Identifiers and customer records	Name, postal and email address, telephone number, IP address, account and cookie identifiers.	Orders, accounts, delivery, support, security, privacy requests and marketing choices.
Commercial information	Products viewed, cart activity, purchases, returns, refunds and order history.	Transactions, fulfilment, support, reporting, personalisation and service improvement.
Internet or network activity	Browser, device, referring page and interactions with the store.	Store operation, security, analytics, attribution and, subject to choices, advertising.
Approximate geolocation	General location inferred from IP address; we do not intentionally request precise location through the store.	Market selection, security, analytics and store operation.
Communications and preferences	Support messages, reviews, privacy requests and marketing choices.	Support, compliance, communications and service improvement.
Inferences	Likely interests or preferences inferred from store activity.	Recommendations, measurement and, where permitted, advertising.
Sensitive personal information	Account-login credentials handled through Shopify and payment credentials handled by payment providers.	Authentication and payment only. We do not use sensitive personal information to infer characteristics.

We do not intentionally collect Social Security numbers, passport or driver-licence numbers, medical information, biometric identifiers or precise geolocation through the store.

Disclosure, sale and sharing

We disclose the categories above to Shopify; payment, fraud, fulfilment and delivery providers; store, IT, security, support, email and review providers; professional advisers; and authorities where required. These disclosures support the business purposes described above.

We do not sell personal information for money. Disclosures of identifiers, commercial information, internet activity, approximate location and inferences to Shopify Enhanced Services, advertising, social-media and affiliate partners—including Meta, TikTok and participating Shopify services—may constitute “sale”, “sharing” or targeted advertising because they support cross-context behavioural advertising, personalisation or attribution. In the preceding 12 months those categories may have been sold or shared in that legal sense with advertising, social-media, affiliate and commerce-platform partners. We do not knowingly sell or share personal information of people under 16.

US privacy rights

Depending on where you live, you may request access or knowledge, a portable copy, correction, deletion, and information about sources, purposes and recipient categories. You may opt out of sale, sharing or targeted advertising, limit sensitive-information use where that right applies, appeal certain decisions where state law provides an appeal, and receive equal service without retaliation.

We may verify access, correction and deletion requests, but do not require identity verification merely to opt out. An authorised agent may act where permitted; we may request proof of authority. We normally respond within 45 days where that deadline applies and will explain any lawful extension, denial or appeal route. We do not limit a response to a 12-month look-back where applicable law requires a longer period.

How these privacy request forms work

The form sends the email address, request type and legal regime to Avada, our privacy-request form provider. As part of the same deliberate submission, it also sends the same request to VUNRO's Cloudflare-hosted fallback for secure logging and Freshdesk case handling. This fallback send happens for every deliberate submission and is not conditional on Avada confirming or failing delivery. Cloudflare Turnstile processes security signals to protect the form from automated abuse; VUNRO does not use those signals for advertising.

Avada may separately create its own request record and send a confirmation or identity-verification message. The request is reviewed manually. Submitting it does not instantly export, correct or delete data, show request history, or complete a sale or sharing opt out.

Request record retention: Security HMAC rate records are kept for no more than 2 hours. Semantic deduplication and delivery metadata are kept for no more than 30 days. Encrypted actionable request data held by Cloudflare is erased promptly after confirmed delivery to Freshdesk or an audited manual handoff; unresolved requests remain encrypted until handled. A Freshdesk compliance case may be kept for up to 6 years after closure where needed for legal, regulatory, dispute or audit purposes, and is deleted sooner when no longer needed.

Submit a privacy request

These controls create a request with our privacy-service provider. We may ask for information reasonably necessary to verify identity for access, correction or deletion. You can also email support@getvunro.com.

Access or receive a copy

Ask whether we hold information about you and request a copy where applicable.

Access account information

Enter your email to submit this request

Enter a valid email address.

Submit

Correct information

Ask us to correct inaccurate or incomplete account information.

Edit account information

Enter your email to submit this request

Enter a valid email address.

Submit

View existing requests

Ask to view privacy requests associated with your email address.

Show all requests

Enter your email to submit this request

Enter a valid email address.

Submit

Delete information

Ask us to delete eligible information. Legal, security and transaction records may need to be retained.

Delete account information

Enter your email to submit this request

Enter a valid email address.

Submit

Opt out of sale, sharing or targeted advertising

Where the law gives you this right, use the Your Privacy Choices link in the store footer or send a recognised Global Privacy Control signal. Shopify treats a valid GPC signal as an opt-out for the browser or device and, where it can associate the signal with a Shopify account, for that account. No identity verification is required merely to opt out.

The email opt-out form is shown automatically when Shopify identifies the visitor as being in an applicable US sale-of-data region. Market or currency selection alone does not determine that region.

BladeClub first-order offer

BladeClub may offer a 15% discount on an eligible first purchase in return for optional email-marketing enrolment. The material terms are shown at sign-up. Participation is opt-in, is not required to buy, and can be withdrawn at any time by unsubscribing. Withdrawal does not cancel a discount already validly used.

Our good-faith estimate of the value of the information is the value of the benefit provided: 15% of the eligible first-order price (for example, £15 on a £100 eligible order, converted into the market currency). We use this method because the programme collects an email address and marketing preference to support the relationship that funds the discount; actual value varies with whether and how the offer is redeemed.

Global Privacy Control and Do Not Track

We honour Global Privacy Control in regions where an opt-out preference signal is legally recognised. Other legacy “Do Not Track” signals are not interpreted because there is no uniform standard. Subject to your privacy choices, analytics or advertising providers may collect activity over time and across websites.

Children

The store is intended for adults and is not directed to children. If you believe a child has provided personal information, contact us.

Contact