Privacy policy

Privacy Policy

Last updated: November 6, 2026

hoypouches ("we," "us," or "our") respects your privacy. This Privacy Policy explains what personal information we collect, how we use and share it, and the rights and choices available to you. It applies to our website, online store, and related services (the "Services"), and it is written to address the privacy laws that apply to our customers in the United States and Canada.

By using the Services, you agree to the practices described in this Policy. If you do not agree, please do not use the Services.

Quebec residents: You may request a copy of this Privacy Policy in French. Contact our Privacy Officer (Section 16). / Résidents du Québec : vous pouvez demander une copie de cette politique de confidentialité en français.

1. Who We Are (Data Controller)

Company: HAMCL TECHNOLOGY CO., LIMITED.
Email: info@hoypouches.com

2. Information We Collect

We collect the following categories of information:

2.1 Information you provide to us

  • Order & delivery information: name, shipping and billing address, email address, phone number.

  • Account information (if you create an account): name, email, password, order history.

  • Payment information: card/payment details are entered into and processed by our third-party payment processors. We do not store your full card number on our systems; we may receive limited information such as the last four digits, card brand, and transaction status.

  • Communications: messages you send to customer support, feedback, and survey responses.

  • Marketing preferences: whether you opted in to emails/SMS and your preferences.

2.2 Information collected automatically

  • Device & usage data: IP address, device/browser type, operating system, pages viewed, referring URLs, and interactions with the Services.

  • Cookies & similar technologies: see Section 9.

2.3 Information from third parties

From our service providers (e.g., payment processors, shipping carriers, analytics providers, and marketing platforms), such as fraud-prevention signals and delivery status.

We do not intentionally collect the personal information of children (see Section 13).

3. How We Use Your Information

We use your information to:

  • Process and fulfill orders, including payment, packing, shipping, delivery, and returns;

  • Provide customer support and respond to inquiries;

  • Communicate about your orders, account, and our Services;

  • Send marketing (only where you have opted in / where permitted) — see Section 10;

  • Improve our products, website, and services (analytics, troubleshooting);

  • Prevent fraud, abuse, and security incidents, and protect our legal rights;

  • Comply with legal obligations (tax, accounting, consumer-protection, and record-keeping).

4. Legal Bases (Canada) & Lawful Purposes (US)

4.1 Canada (PIPEDA / Quebec Law 25)

We collect, use, and disclose personal information with your consent, or as otherwise permitted by law. Consent may be express (e.g., checking a box to receive marketing) or implied (e.g., providing an address to ship an order). You may withdraw consent at any time, subject to legal and contractual restrictions (see Section 11).

4.2 United States

We process information as permitted by applicable federal and state laws for the purposes described in Section 3, including for performing a contract, for our legitimate business operations, and to comply with law.

5. How We Share Your Information

We do not sell your personal information (see Section 7). We share information with the following categories of service providers / third parties, who process it on our behalf or as otherwise described:

  • E-commerce platform: Shopify (hosting, storefront, order management);

  • Payment processors: e.g., Stripe, PayPal, Shopify Payments (payment authorization and processing);

  • Shipping carriers & fulfillment: e.g., USPS, UPS, FedEx, DHL eCommerce, Canada Post, Purolator (delivery of your orders);

  • Email/SMS marketing platforms: e.g., Klaviyo / Mailchimp / SMS provider (order and marketing messages);

  • Analytics & advertising tools: e.g., Google Analytics (website analytics and measurement);

  • Customer support tools: e.g., helpdesk / live-chat software;

  • Professional advisers & authorities: lawyers, accountants, auditors, and government/tax authorities, where required.

We require service providers to protect your information under contractual confidentiality and security obligations. We may also disclose information where required by law, legal process, or to protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).

6. Cross-Border Data Transfers

6.1 Some of our service providers may store or process personal information outside of your province, state, or country — including in the United States, Canada, and other countries.

6.2 Where personal information is transferred across borders, we use contractual protections and safeguards (such as data-processing agreements with appropriate data-protection clauses) to protect it, and we require service providers to provide a comparable level of protection.

6.3 Quebec residents (Law 25): Before sending personal information outside Quebec, we conduct a Privacy Impact Assessment (PIA) as required, and we disclose the possibility that information may be communicated outside the province and that it may be subject to the laws of other jurisdictions.

7. Sale & Sharing of Personal Information (US — CCPA/CPRA and Other State Laws)

7.1 We do not sell your personal information, and we do not "sell" or "share" personal information for cross-context behavioral advertising in a way that would be considered a "sale" under the CCPA/CPRA, as those terms are defined. We have not sold personal information in the preceding 12 months.

7.2 Do Not Sell or Share My Personal Information / Opt-Out of Targeted Advertising. Even though we do not sell personal information, if you wish to limit data sharing for advertising, you may:

  • Use the "Do Not Sell or Share My Personal Information" link on our website (or email us);

  • Use browser/device opt-out tools (see below).

7.3 Global Privacy Control (GPC). We recognize Global Privacy Control opt-out preference signals. When we detect a GPC signal, we will treat it as a request to opt out of the sale/sharing of personal information (to the extent applicable).

7.4 Sensitive information. We do not use or disclose sensitive personal information for purposes beyond those permitted without a right to limit.

7.5 California "Shine the Light." California residents may request information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing. To make a request, contact us (Section 11).

8. Your Privacy Rights

8.1 US residents

(California — CCPA/CPRA, and applicable state laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with similar laws): Subject to applicable law, you have the right to:

  • Know / Access the personal information we collect and how we use/share it;

  • Delete personal information we have collected (with exceptions);

  • Correct inaccurate personal information;

  • Opt out of the sale/sharing of personal information (see Section 7);

  • Non-discrimination — we will not discriminate against you for exercising your rights;

  • Data portability — receive a copy of your data in a portable format (where applicable);

  • Limit use of sensitive personal information (where applicable).

8.2 Canadian residents

(PIPEDA and Quebec Law 25): Subject to applicable law, you have the right to:

  • Access your personal information and request details about how it is used and disclosed;

  • Correct inaccurate personal information;

  • Withdraw consent (subject to legal/contractual limits);

  • Data portability — receive personal information you provided in a structured, commonly used technological format, and (Quebec) request that it be transferred to another organization where technically feasible;

  • Request information about automated decision-making and the possibility of cross-border transfers;

  • (Quebec) request de-indexing / cessation of dissemination of personal information under certain conditions.

9. Cookies & Tracking Technologies

9.1 We use cookies and similar technologies (pixels, tags, local storage). They fall into three categories:

  • Strictly necessary: required for the site to function (cart, checkout, security). These cannot be switched off via our consent tool.

  • Analytics/performance: help us understand site usage (e.g., Google Analytics).

  • Marketing/advertising: used to measure and deliver relevant ads.

9.2 Managing cookies.

  • US customers: you can control cookies through your browser settings and our cookie preference tool.

  • Quebec / Canada customers: for non-essential cookies (analytics and marketing), we use an opt-in approach — non-essential cookies are disabled by default and are only activated after you consent through our cookie banner. You may change or withdraw your cookie choices at any time via the cookie settings / banner.

9.3 Disabling cookies may affect certain features of the Services.

10. Marketing Communications & Consent (CASL)

10.1 Canada (CASL — Canada's Anti-Spam Legislation): We send commercial electronic messages (email/SMS) only with your consent. Consent is obtained through a separate, unbundled opt-in checkbox (or another clear affirmative action). We never pre-check the consent box.

10.2 Every commercial message includes a clear unsubscribe / withdrawal mechanism. You may withdraw consent at any time. We will honor unsubscribe requests within 10 business days.

10.3 United States: We send marketing messages in accordance with applicable law (e.g., CAN-SPAM), including a working unsubscribe link.

10.4 You can also opt out of marketing at any time by emailing info@hoypouches.com or using the unsubscribe link in our messages. Transactional/order emails (e.g., order confirmations, shipping notices) are not marketing and will continue as long as you have an order/account.

11. Exercising Your Rights

11.1 To exercise any of your privacy rights, contact us:

Email: info@hoypouches.com

11.2 Identity verification. To protect your information, we will ask you to verify your identity before fulfilling a request (e.g., confirming your email/order details, or additional verification for sensitive requests). We may not fulfill a request if we cannot verify your identity.

11.3 Authorized agents. You may use an authorized agent to submit a request on your behalf, where permitted by law. We may require proof of authorization and may still contact you to verify.

11.4 Response timeframes:

  • US (CCPA/CPRA and similar state laws): we will respond within 45 days of a verifiable request (extendable by an additional 45 days with notice, where permitted).

  • Canada (PIPEDA / Quebec Law 25): we will respond within 30 days of a request (subject to lawful extensions, with notice).

  • Requesting an extension may apply where the request is complex; we will inform you if so.

11.5 Appeals. (US — e.g., Virginia, Colorado, Connecticut): If we decline your request, you may appeal our decision by replying to our response. We will respond to appeals within the timeframe required by law.

11.6 Regulators to contact:

  • United States: your State Attorney General (or the California Privacy Protection Agency for California matters).

  • Canada: the Office of the Privacy Commissioner of Canada (OPC).

  • Quebec: the Commission d'accès à l'information du Québec (CAI).

12. Data Retention

12.1 We retain personal information only as long as necessary for the purposes described in this Policy or as required by law.

  • Order & transaction records: retained for the period required by applicable tax, accounting, and consumer-protection laws.

  • Marketing data: retained until you withdraw consent/unsubscribe, plus a short suppression period to honor your choice.

  • Analytics data: retained per the settings of our analytics providers.

12.2 When personal information is no longer needed, we delete it or anonymize it so that it can no longer be linked to an identifiable individual.

13. Children's Privacy

13.1 The Services are not directed to children. We do not knowingly collect personal information from anyone under 13 in the United States or Canada. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

14. Security

14.1 We use reasonable administrative, technical, and physical safeguards to protect personal information, including:

  • Encryption in transit (HTTPS/TLS);

  • Access controls limiting access to authorized personnel/processors;

  • Secure, reputable third-party processors;

  • Monitoring and periodic review of our practices.

14.2 No method of transmission or storage is 100% secure. While we work to protect your information, we cannot guarantee absolute security.

14.3 Breach notification. If a breach of security affecting your personal information occurs, we will notify affected individuals and/or regulators as required by applicable law.

15. Third-Party Links

The Services may link to third-party websites (e.g., social media). We are not responsible for their privacy practices. Please review their privacy policies.

16. Changes to This Policy & Contact

16.1 Updates. We may update this Policy from time to time. When we make material changes, we will notify you by email and/or by posting a prominent notice on our website, and we will update the "Last updated" date above. Your continued use of the Services after an update means you accept the revised Policy, to the extent permitted by law.

16.2 Contact / Privacy Officer.

Email: info@hoypouches.com
Company: HAMCL TECHNOLOGY CO., LIMITED.