Privacy Policy Agreement

CandyVerse Privacy Policy
Effective Date: August 14, 2026
Last Updated: August 14, 2026

1. Introduction

CandyVerse ("CandyVerse," "we," "us," or "our") respects your privacy and is committed to protecting it through our compliance with this policy. This Privacy Policy describes the types of information we may collect from you or that you may provide when you visit mycandyverse.com (the "Website") and purchase our products, and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This policy applies to information we collect on the Website, through the TikTok Shop integration connected to the Website, in email, text, and other electronic communications sent through or in connection with the Website, and when you interact with our advertising on TikTok, Meta (Facebook/Instagram), and other platforms.

This Website and this Privacy Policy are directed to users located in the United States. If you access the Website from outside the United States, you do so on your own initiative, and this policy governs your use of the Website regardless of your location.

Please read this policy carefully. By using the Website, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, do not use the Website.

2. Information We Collect

We collect several types of information from and about users of our Website:

2.1 Information You Provide Directly

Contact information: name, email address, phone number, shipping address, and billing address.
Order information: products purchased, order history, order value, and special instructions.
Payment information: processed directly by our payment processor. CandyVerse does not store full credit or debit card numbers on our own servers.
Account information: if you create an account, your username, password, and order preferences.
Communications: information you provide when you contact customer service, respond to surveys, or enter a promotion.

2.2 Information Received Through the TikTok Shop Integration

mycandyverse.com is connected to TikTok Shop through TikTok's Shop API. This connection syncs order, fulfillment, and customer information associated with your TikTok Shop purchases with our Website systems so we can process, fulfill, and support your order. This may include your name, email address, phone number, shipping and billing address, order history and order contents, order status, and payment/transaction status associated with your order.

Your use of TikTok Shop is also governed by TikTok's own Privacy Policy, which you can review at TikTok's website. We are not responsible for TikTok's data practices outside of this integration.

2.3 Information Collected Automatically

As you navigate the Website, we may use cookies, web beacons, pixels, and similar technologies to automatically collect:

Usage details, such as pages visited, time spent on pages, links clicked, and products viewed.
Device information, including IP address, browser type, operating system, and device identifiers.
Approximate location derived from your IP address.
Referring website or app that directed you to our Website.
If you use the CandyVerse Assistant chat feature, the content of your conversation with it, which is logged and stored in accordance with this policy.

2.4 Information From Third-Party Tools on the Website

We use the following third-party tools on the Website. Except for tools necessary for the Website's basic operation (such as our cookie consent banner itself), these tools are configured to run only after you provide consent through our cookie banner. Each may set its own cookies or collect data directly from your browser or device:

TikTok Pixel: helps us measure the effectiveness of TikTok advertising and build custom audiences for retargeting. Governed by TikTok's Business Tools Terms and Privacy Policy.
Meta Pixel: helps us measure the effectiveness of Facebook and Instagram advertising and build custom audiences for retargeting. Governed by Meta's Business Tools Terms and Privacy Policy.
Google Analytics: helps us understand how visitors use the Website. Google Analytics may set cookies and collect device and usage data. Governed by Google's Privacy Policy. You can opt out using the Google Analytics Opt-out Browser Add-on.
Twipla: provides website analytics and session recording. This may include capturing mouse movements, clicks, page interactions, and technical details about your device and browser to help us understand how visitors use the Website and to improve its design and functionality. Twipla states that it does not use this data to identify you individually or match it with other information about you. Depending on your settings and location, some Twipla features may operate without setting cookies; where cookies are used, they are gated by our cookie consent banner in the same way as our other analytics tools.
Kudobuzz: collects and displays product reviews submitted by customers, which may include your name and review content.
Salesdish Trust Badges: displays trust and security badges on the Website; this tool may load supporting scripts from its provider.
Twism: operates our loyalty and rewards program, if and when offered, and may track your purchases and engagement to administer points and rewards.

2.5 In-Store Video Recording (Shops at Rivercenter Location)

Our physical retail store is monitored by video recording at all times for security, safety, and business purposes. By entering our store, you acknowledge and consent to being recorded. We may use this footage for security and loss prevention, and we may also use footage of general store activity, atmosphere, and events for marketing, promotional, or entertainment content, including on our website, social media, and TikTok. We do not use footage in which an identifiable minor is the clear focus for marketing or promotional purposes without separate parental consent. If you appear in footage and would prefer we not use it in promotional content, contact us using the information in Section 14, and we will make reasonable efforts to honor your request for any footage not yet published.

3. How We Use Your Information

We use information we collect about you or that you provide to us for the following purposes:

To process, fulfill, and ship your orders, and to communicate with you about your orders (including order confirmations and delivery updates).
To provide customer service and respond to inquiries.
To operate, maintain, and improve the Website.
To personalize your experience and show you content and products we think may interest you.
To measure and improve the effectiveness of our advertising on TikTok, Meta, and other platforms.
To detect, investigate, and prevent fraudulent transactions and other illegal activities, and to protect the rights and property of CandyVerse and others.
To send promotional communications about our products and offers, where you have consented to receive them, and to allow you to opt out at any time.
To comply with applicable law, legal process, or enforceable governmental request.

4. Text Messages (SMS)

If you provide your phone number when placing an order, we may use it to contact you about that order — for example, delivery or fulfillment updates and customer service follow-up. This is considered transactional/operational messaging, not marketing, and does not require separate marketing opt-in consent under the Telephone Consumer Protection Act (TCPA).

We do not currently send SMS marketing messages. If we begin doing so in the future, we will collect separate, express written consent at the point of signup, clearly disclose message frequency and that message/data rates may apply, and provide an easy opt-out (for example, by replying STOP).

You may opt out of promotional emails and texts at any time using the unsubscribe link or by replying STOP. You cannot opt out of non-promotional, transactional messages related to your order, account, or a security or policy matter, as these are necessary for us to provide the Website's services to you.

5. Cookies and Tracking Technologies

Cookies are small data files placed on your device. We use cookies and similar technologies (pixels, web beacons, local storage) to recognize your browser, remember preferences, keep items in your cart, analyze traffic, and support advertising on TikTok and Meta.

You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, some parts of the Website may become inaccessible or not function properly. In addition to browser-level controls, we provide a cookie consent banner on the Website that lets you accept or reject non-essential cookies, including advertising cookies, directly — this banner, not browser settings alone, is our primary mechanism for honoring your cookie preferences.

We honor Global Privacy Control (GPC) signals and other recognized "Do Not Track" opt-out preference signals where required by law, treating them as a valid request to opt out of the sale/sharing of personal information for California residents.

6. How We Share Your Information

CandyVerse does not sell your personal information. We do not exchange your personal information for money with data brokers, marketing list resellers, or any other third party, and we have no plans to do so.

We do share information with the categories of third parties below, but only where necessary to run our business, fulfill your orders, and operate the Website — not to generate revenue from your data. Vendors who receive information from us are contractually restricted from using or disclosing it for any purpose other than providing services on our behalf.

TikTok Shop: order and fulfillment data syncs between the Website and TikTok Shop through the API integration described in Section 2.2.
Payment processors: we use Stripe to securely process payments. CandyVerse does not store your full card number on our own servers; Stripe's handling of your payment data is governed by Stripe's own Privacy Policy.
Shipping and fulfillment partners: carriers and fulfillment providers who need your shipping information to deliver your order.
Advertising and analytics partners: TikTok, Meta, and Google, as described in Section 2.4, for advertising measurement and website analytics. Under California law, use of these advertising pixels may be considered "sharing" of personal information even though no money is exchanged; see Section 8.1 for your opt-out rights.
Service providers: vendors who perform services on our behalf, such as website hosting, customer service, and email/SMS communications, under contracts that restrict their use of your data to providing that service to CandyVerse.
Legal and safety: when required by law, subpoena, or legal process, or to protect the rights, property, or safety of CandyVerse, our customers, or others.
Business transfers: if CandyVerse is involved in a merger, acquisition, financing, bankruptcy, reorganization, or sale of some or all of its business assets, your information may be transferred to the parties involved as part of that transaction. This is not a data sale to a data broker or marketer; it is a transfer of business assets, and any acquiring party would remain bound by the commitments in this Privacy Policy unless you are notified of a material change.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, including to provide our services, comply with tax and accounting obligations, resolve disputes, and enforce our agreements. Order and transaction records are generally retained for at least the period required by applicable tax and consumer protection law.

8. Your Privacy Rights

8.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

Know what personal information we have collected, used, disclosed, and shared about you, and to request a copy of it.
Delete personal information we have collected from you, subject to certain exceptions.
Correct inaccurate personal information we maintain about you.
Opt out of the "sharing" of your personal information for cross-context behavioral advertising via pixels such as the TikTok Pixel and Meta Pixel. (CandyVerse does not sell personal information, so there is no sale to opt out of — but pixel-based advertising can still count as "sharing" under California law even without a sale, and you may opt out of it.)
Limit the use of sensitive personal information, where applicable. CandyVerse does not intentionally collect sensitive personal information (such as government identification numbers, health information, biometric data, or precise geolocation) and does not use sensitive personal information for purposes requiring this limitation right; if that changes, we will update this policy accordingly.
Not receive discriminatory treatment for exercising any of these rights.

CandyVerse does not sell or share the personal information of consumers we know to be under 16 years of age.

To exercise these rights, contact us using the information in Section 14 and describe your request. We will confirm receipt and respond within 45 days, as required by California law; if we need more time, we will notify you and may extend our response by up to an additional 45 days. We will verify your request before acting on it, generally by matching the information you provide (such as your name and order or account email) against our records; for certain requests we may ask for additional information to verify your identity. You may also designate an authorized agent to make a request on your behalf. If we decline a request, we will explain why and, where applicable, how you may appeal that decision.

Deleting your information from CandyVerse's own systems does not delete copies of your information held independently by TikTok Shop, Stripe, or other third parties under their own privacy policies. If you want your data removed from those platforms as well, you will need to submit a separate request directly to them.

8.2 Other U.S. State Residents

Residents of Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia have rights under those states' comprehensive privacy laws, including the right to know whether we are processing your personal information, access and receive a copy of it, correct inaccurate personal information, delete your personal information, and opt out of the processing of your personal information for targeted advertising. Oregon residents also have the right to request a list of the categories of third parties with whom we share personal information. Contact us using the information in Section 14 to exercise these rights, and we will respond consistent with applicable law.

CandyVerse currently operates and ships within the United States only. If we begin shipping to or marketing in other countries in the future, we will update this policy to add applicable international privacy disclosures (such as GDPR rights for EU/UK visitors) before doing so.

9. Children's Privacy

The Website is not directed to children under 13. We do not knowingly collect personal information from any visitor we have actual knowledge is under 13 years of age. Because CandyVerse sells candy, we recognize our audience may include younger visitors browsing with a parent or guardian, but we do not knowingly market to, or seek to collect personal information directly from, any user under 13. If we obtain actual knowledge that we have collected personal information from a child under 13 without verified parental consent, we will delete that information promptly. Parents who believe we may have collected information from their child should contact us using the information in Section 14.

10. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction, including encryption of sensitive data in transit (TLS/SSL) and restricted employee access on a need-to-know basis. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected individuals and any required regulators without unreasonable delay and in accordance with applicable law.

12. Third-Party Links

The Website may contain links to third-party websites, including TikTok, Meta platforms, and affiliate sites. We are not responsible for the privacy practices or content of those third-party sites. We encourage you to review the privacy policy of any site you visit.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy on this page with a revised "Last Updated" date. If changes are material, we will provide additional notice, such as an email notification, where required by law.

14. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, or wish to exercise your privacy rights, contact us at:

CandyVerse
849 E Commerce St, San Antonio, Texas 78205
Email: support@mycandyverse.com
Phone: 210-748-4355