Privacy Policy

CANDID is a deck of playing cards that gets people talking. This policy explains, in plain English, what personal information we collect when you visit getcandidcards.com, buy from us, or write to us; what we do with it; who we share it with; and the choices you have.

"CANDID", "we", "us" and "our" mean John Lif LLC, which owns and runs CANDID. "You" means anyone who visits the site, buys a deck, or contacts us.

The short version

• We collect what we need to sell and ship you cards: your name, email, shipping address, and order details. Payments are handled by Shopify and its payment partners; we never see your full card number.
• We use cookies and similar tools to keep your cart working, to understand how people use the site, and to advertise on Google, Meta (Facebook and Instagram) and Pinterest.
• Some of our analytics tools record how visitors move around the site (clicks, scrolls, taps) so we can fix confusing pages. Details are in "Session recordings and heatmaps" below.
• We do not sell your information for money. Sharing data with ad platforms can count as "selling" or "sharing" under California and other state laws, and you can opt out at any time.
• Email us at support@getcandidcards.com with any question or request. A real person reads it.

1. What we collect

Information you give us

• Contact details: name, email, phone number (if you give one), shipping and billing address.
• Order details: what you bought, prices paid, discount codes used, gift notes, and payment confirmation (not your full card number).
• Customer account details: if you sign in to a customer account, your email and order history. Our accounts use one-time email codes; we do not store passwords.
• Messages: anything you send us by email, contact form, or social media, including wholesale and press inquiries.
• Reviews: if you write a review, your name (as you enter it), rating, text, and any photos you upload.
• Affiliate details: if you join our affiliate program, the information you give our affiliate platform (name, email, social handles, payout details).
• Wholesale details: if you buy for a store, your business name, contact person, address, resale certificate, and order and payment history.

Information collected automatically

When you browse the site, our platform and the tools listed in section 5 collect:

• Device and browser information: IP address, browser type, device type, operating system, language, screen size.
• Approximate location: country, region and city, inferred from your IP address. We do not collect precise GPS location.
• Usage information: pages viewed, products viewed, items added to cart, checkout steps, the website or ad that sent you, search terms on our site, and time on page.
• Interaction information: mouse movements, clicks, scrolls and taps, used for session recordings and heatmaps (see below).
• Identifiers from links and ads: click IDs and tracking parameters (for example gclid, fbclid, utm_ tags, and affiliate referral codes) so we know which ad or affiliate sent you.

Information from others

• Shopify and Shop Pay, if you check out with Shop Pay or use the Shop app, may share your saved address and contact details with us to complete the order.
• Advertising and analytics partners may tell us, in aggregated or pseudonymous form, how our ads performed.
• Affiliates tell us, through our affiliate platform, when an order came from their link or code.
• Marketplaces and AI shopping assistants: if you buy CANDID through a shopping assistant connected to Shopify (for example Microsoft Copilot, Meta AI or ChatGPT), we receive the order details needed to fill it.

If you buy CANDID on Amazon, Faire or in a store, that seller or marketplace is responsible for your information under its own privacy policy. We only receive what we need to ship the order.

2. How we use it

• To sell and ship your order: process payment, calculate tax and shipping, pack and ship through our warehouse, send order and shipping updates, and handle returns.
• To talk to you: answer questions, help with an order, and handle wholesale, press and affiliate requests.
• To send marketing email, if you opt in: new decks, offers, and the occasional story. Every marketing email has an unsubscribe link.
• To ask for and show reviews: after you buy, our review tool may email you once to ask how you liked the deck.
• To improve the site: see which pages work, which confuse people, and test changes (for example, showing two versions of a page to see which is clearer).
• To advertise: measure whether our ads work and show CANDID ads to people likely to enjoy it, including people similar to our customers.
• To pay affiliates: credit the right affiliate for an order and calculate commission.
• To keep things safe and legal: prevent fraud and abuse, keep tax and accounting records, and meet legal obligations.

We use AI-assisted tools to help us read and draft replies to email and to run parts of the business. Those tools act as our service providers and only use your information to do that work for us.

3. Cookies and similar technologies

Cookies are small files your browser stores. We and our partners also use pixels, local storage, and similar technologies. We group them like this:

Our theme also stores ad click IDs and affiliate referral codes in your browser's local storage so the right ad or affiliate gets credit when you check out.

Your choices:

• Use the "Your Privacy Choices" link in the site footer to opt out of analytics and marketing cookies and of the "sale" or "sharing" described in section 6. Where the law requires us to ask first (for example in the UK and EU), Shopify's cookie banner asks for your choice before these cookies run.
• We honor the Global Privacy Control (GPC) signal. If your browser sends it, we treat it as a request to opt out of the "sale" or "sharing" of your information for that browser.
• You can block or delete cookies in your browser settings. The store may not work properly without necessary cookies.
• Google: adssettings.google.com and tools.google.com/dlpage/gaoptout. Meta: your Facebook or Instagram ad preferences. Pinterest: your Pinterest privacy settings. Industry opt-outs: optout.aboutads.info and youradchoices.com.

"Do Not Track": browsers' older "Do Not Track" setting has no agreed standard, so we do not respond to it. We do honor GPC as described above.

4. Session recordings and heatmaps

We use Microsoft Clarity and PostHog to understand how people use the site. These tools record your interactions with our pages: mouse movements, clicks, taps, scrolls, the pages you visit, and your device and browser type. We can replay these sessions and see heatmaps of where people click, which helps us find and fix pages that are confusing or broken.

What we do to limit this:

• Recordings do not capture checkout or payment pages. Checkout runs on Shopify's secure checkout, where these tools do not run.
• Text you type into form fields, and other sensitive content, is masked, so we do not see it in recordings.
• We do not use recordings to identify you personally, and we do not sell them.
• Microsoft keeps Clarity recordings for about 30 days and heatmap data for up to 13 months. Microsoft's privacy statement is at privacy.microsoft.com.

By using the site, you understand that your visit may be recorded this way. You can opt out at any time with the "Your Privacy Choices" link in the footer, by turning on Global Privacy Control, or by blocking cookies in your browser; where the law requires consent (for example in the UK and EU), recording only runs after you accept analytics cookies.

5. Who we share it with

We share personal information only with the companies that help us run CANDID, and only what each needs:

Each of these companies has its own privacy policy for data they collect directly.

6. "Selling" and "sharing" under state privacy laws

We do not sell your information for money. However, when Google, Meta and Pinterest tags on our site collect information to target ads across other sites and apps, some state laws (including California's) call that a "sale" or "sharing" for cross-context behavioral advertising. In the last 12 months, we have "sold" or "shared" in that sense:

• identifiers (IP address, cookie and device IDs, ad-click IDs, hashed email or phone for purchases), and
• internet activity (pages and products viewed, cart and purchase events),

to Google, Meta and Pinterest, and to affiliate networks (BixGrow, and AWIN until that program closes) to credit referrals.

You can opt out with the "Your Privacy Choices" link in the footer or by turning on Global Privacy Control in your browser. We do not knowingly sell or share the information of anyone under 16.

7. Your California privacy rights (CCPA and CPRA)

Many of our customers live in California. We extend these rights to California residents whether or not the law strictly requires it of a business our size.

Categories we collected in the last 12 months

We do not collect sensitive personal information as defined by the CPRA (such as Social Security numbers, precise geolocation, or account passwords), except payment card details, which go straight to our payment processors and are used only to take payment.

Your rights. You have the right to:

1. Know what personal information we collected about you, where it came from, why, and who we disclosed it to.
2. Access a copy of it.
3. Delete it, subject to exceptions (for example, records we must keep for taxes).
4. Correct inaccurate information.
5. Opt out of the sale or sharing of your information, and of targeted advertising.
6. Limit the use of sensitive personal information. We do not use it beyond what the law allows, so there is nothing to limit.
7. Not be discriminated against for using any of these rights. We will not charge you more or give you worse service.

How to make a request. Email support@getcandidcards.com with the subject "Privacy request" and tell us what you want. To protect you, we will ask you to confirm the request from the email address on your order, or give us an order number. You can use an authorized agent; we will ask for proof that you gave them permission. We will confirm within 10 business days and answer within 45 days (we may extend once by another 45 days if needed and tell you why). For opt-outs, the footer link or GPC works immediately; no verification needed.

Shine the Light. California residents may ask once a year whether we shared personal information with third parties for their own direct marketing. We do not. Email us if you want this in writing.

8. Your rights in other U.S. states

Residents of Colorado, Virginia, Connecticut, Utah, Texas, Oregon and other U.S. states with privacy laws have similar rights to access, correct, delete, get a copy of, and opt out of targeted advertising, sale and profiling. Use the same email above. If we deny your request, you can appeal by replying to our answer with "Appeal" in the subject; we will respond within 45 days. If you are still unhappy, you can contact your state attorney general.

9. If you are in the UK, the EU, the EEA or Switzerland

This section applies when the UK GDPR, the EU General Data Protection Regulation (GDPR), or the Swiss Federal Act on Data Protection applies to your information, for example when we ship to you in one of those countries or you visit the site from there.

Who is responsible. John Lif LLC, 447 Broadway, 2nd FL #865, New York, NY 10013, USA, is the controller of your personal information. Contact: support@getcandidcards.com.

Why we are allowed to use your information (lawful bases)

Cookie banner. Visitors from Austria, Belgium, Czechia, Denmark, Finland, France, Germany, Ireland, Italy, the Netherlands, Norway, Poland, Portugal, Spain, Sweden and the UK see Shopify's cookie banner. Analytics, marketing and session-recording tools do not run until you choose "Accept"; if you decline or ignore the banner, only necessary cookies are used. You can change your choice at any time with the "Your Privacy Choices" link in the footer.

Your rights. You have the right to:

• access your information and get a copy;
• correct it if it is wrong or incomplete;
• erase it, unless we must keep it (for example, tax records);
• restrict how we use it while a question about it is resolved;
• data portability: receive the information you gave us in a common machine-readable format, or have it sent to another company;
• object to our use of it based on legitimate interests, and object at any time, without giving a reason, to direct marketing;
• withdraw consent at any time, without affecting what we did before you withdrew it;
• not be subject to decisions based solely on automated processing that significantly affect you. We do not make such decisions.

To use these rights, email support@getcandidcards.com with the subject "Privacy request". We may ask you to confirm the request from the email address on your order. We answer within one month; if a request is complex, we may extend this by up to two more months and tell you why. There is no fee unless a request is clearly unfounded or excessive.

Complaints. We would like the chance to fix any problem first, but you can always complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU or EEA, the authority in your country (edpb.europa.eu lists them); in Switzerland, the FDPIC (edoeb.admin.ch).

International transfers. CANDID is run from the United States, and most of our providers (Shopify, Google, Meta, Microsoft and others in section 5) process data in the United States or other countries outside the UK and EEA. When your information is transferred there, we and our providers rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the provider is certified, or on the European Commission's Standard Contractual Clauses with the UK Addendum, and on additional safeguards where needed. You can ask us for more information about these safeguards.

Do you have to give us your information? You need to give us your name, email and shipping address to buy a deck, because we cannot fill the order without them. Everything else is optional.

10. How long we keep it

11. Children

CANDID is a game for ages 14 and up, and our site is meant for adults buying for themselves or as gifts. We do not knowingly collect personal information from children under 13, and we do not allow anyone under 18 to buy, create an account, or join our affiliate program without a parent or guardian. If you think a child under 13 has given us information, email us and we will delete it.

12. Security

We rely on Shopify's PCI-compliant checkout for payments, use encrypted connections (HTTPS) across the site, and limit access to customer data to the people and providers who need it. No system is perfectly secure, so we cannot promise that your information will never be accessed without permission. If a breach affects you, we will tell you as the law requires.

13. Links to other sites

Our site links to Faire, Amazon, Instagram and other sites. Their privacy practices are their own; read their policies before giving them information.

14. Changes to this policy

We will update this page when our practices change, and change the "Last updated" date at the top. If a change is significant, we will put a notice on the site or email customers who have opted in to email.