Privacy Policy
Effective date: October 20, 2026
The question people actually have is not "what do you collect." It's "who else knows I bought this?"
Most privacy policies answer that with a phrase — trusted service providers — that names nobody and settles nothing. So this one is organized around the parties themselves. If you went to each one and asked what it holds about your order, here is the answer you'd get.
Five parties have something. One category has nothing, deliberately, and that gets a section too.
Plushley LLC is responsible for all of this. Where a company below is acting on our instructions, what it does is on us.
Part 1 — Ask each of them
Ask us
What we'd hand over:
| What | Why we have it | How long we keep it |
|---|---|---|
| Name, billing address, shipping address, email, phone, items ordered, amount paid, order number, date | to take, fill, deliver, and account for the order | 7 years from the end of the tax year, for IRS and state tax records |
| Payment metadata — the last four digits, card type, authorization result, the payment reference | to match payments, issue refunds, answer a chargeback | 7 years, with the order |
| Your emails and support messages; a short written note if you call | to answer you, and to see what we told you if it comes back | 24 months, or 5 years where it concerns a dispute or claim |
| Account email, a hashed password, saved addresses, order history | so you can sign in and check out faster | until you delete the account, plus 30 days for backups |
| Marketing email address, the date and wording of the opt-in, opens and clicks | to send what you asked for and prove we were allowed to | until you unsubscribe — then the address stays on a suppression list indefinitely |
| IP address at order, address-match result, chargeback history | to catch card fraud | 12 months, or 5 years if a chargeback was raised |
| Server logs: IP, browser, device, pages, timestamps | security and troubleshooting | 90 days |
What we do not have: your full card number, the three digits on the back, or your PIN. The card fields at checkout are served by our payment processor and go straight to them. We could not leak your card number, because we never receive it.
Can you have it deleted? Most of it, yes. The tax records are the exception — we are required to keep those, and we'll tell you which part that covers rather than refusing the whole request.
That suppression list is worth explaining, because it looks like a contradiction. After you unsubscribe we keep your email address forever, and we keep it precisely so that we never email you again. It is checked before every send and it is never added to a campaign. The only way to reliably not contact someone is to remember not to.
Ask our payment processor
What it would say it has: your full card number, expiration, security code, billing ZIP, the amount, and its own fraud-screening result.
Why: because it is the business actually moving the money.
What it is to us: not simply a vendor following orders. A payment processor has its own obligations under federal payments and anti-money-laundering law, and for those purposes it is responsible for your data in its own right, under its own privacy policy alongside this one. We could not instruct it to stop, and neither could you.
Ask the carrier
What it would say it has: your name, your shipping address, your ZIP, and one contact — email or phone — for the delivery notification.
What it would not have: what you ordered, what you paid, or anything else about you. A carrier gets a destination, not a customer profile.
And it does not get to use it for its own marketing. That is in our agreement with them.
Ask Google
This is the one most people don't think to ask, and the one with the longest answer.
What it would say it has: that a browser visited our site, which pages it saw, which advertisement it came from, and whether the visit ended in a purchase. This is collected by Google Analytics and Google Ads conversion tracking.
Why: so we know which advertising works and how the site is used.
Here is the part that matters: Google processes some of that data for its own purposes, not only ours. That makes this a "share" of personal information for cross-context behavioral advertising under California law — and it is exactly what your opt-out right is for.
How to stop it: use the "Do Not Sell or Share My Personal Information" link in our site footer, or send a Global Privacy Control signal from your browser. Both work, and the next section explains why.
Ask our email provider
What it would say it has: your email address, the messages we sent you, and whether each was opened or clicked.
Why: to deliver order confirmations and, if you subscribed, the newsletter.
Acting on our instructions only, under a written agreement, with no right to use your address for anything of its own.
Part 2 — The parties with nothing
Data brokers. Nothing. We don't sell to them and we don't buy from them.
Advertisers who bought a list. Nothing. We don't rent, trade, or license our customer list.
Anyone building a profile of you to resell. Nothing.
Other merchants. Nothing. Your details do not travel between stores.
"Sell" and "share," stated properly
A lot of privacy policies say they don't sell personal information "for money." That qualifier is doing work, and not honest work — California's definition of a sale covers disclosure "for monetary or other valuable consideration" (Cal. Civ. Code § 1798.140), and the narrower sentence is written to survive the broader rule.
So, plainly:
We do not sell your personal information, for money or for anything else of value.
We do share it in the statutory sense, with Google, for advertising measurement — see above. That sharing is what the opt-out covers, and turning it off changes nothing about your prices, your delivery, or how we treat you.
Part 3 — Your rights, and how long we have
Depending on where you live, some or all of these apply. We extend all of them to every customer regardless of state, because operating two standards is more work than operating one.
- Know and access — what we collect, why, who gets it, and a copy of it.
- Correct — fix anything inaccurate.
- Delete — subject to the tax-record exception above.
- Portability — your data in a usable, machine-readable format.
- Opt out of sale or sharing — the advertising link above.
- Opt out of targeted advertising and profiling — same mechanism.
- Limit the use of sensitive personal information — we don't collect it for these purposes, so there is nothing to limit, but the right stands.
- Non-discrimination — using any of these rights never affects your price, your delivery, or your service. That is law in California and it is our practice everywhere.
How to use them
Email support@plushley.com with "Privacy" in the subject line, or use the opt-out link in the footer for advertising.
We respond within 45 days. Where a request is genuinely complex we may extend by a further 45, and if we do, we tell you inside the first 45 with the reason.
Verification. We may confirm you are who you say you are, because handing your file to someone else would be the worse failure. We ask for the least that settles it — usually a reply from the email address on the order. We do not ask for a photo ID to answer an email.
Authorized agents. Someone may submit a request for you. We'll ask for proof that you authorized them, and we may ask you to confirm it directly.
Appeals. If we deny a request, we'll tell you why, and you can ask us to reconsider — several state laws give you that right, and we apply it to everyone. You can also contact your state attorney general.
Browser signals
We honor the Global Privacy Control. If your browser or extension sends a GPC signal, we treat it as a valid opt-out of sale and sharing for that browser, automatically, with nothing for you to click.
Your browser's own cookie controls are a separate tool, entirely yours, and they work independently of us.
Part 4 — Four things usually left out
Marketing messages, and the rules on them
Email. You get promotional email only if you asked for it. Every message carries an unsubscribe link and our mailing address, as the CAN-SPAM Act requires, and we honor an opt-out within 10 business days — in practice, immediately.
Text messages. We send marketing text messages only with your prior express written consent, which is the standard the Telephone Consumer Protection Act sets — a checkbox you ticked, not a phone number you once typed into a shipping field. Reply STOP to any message and it ends.
Order emails are not marketing. Confirmations, shipping notices, and replies to your questions are part of the purchase and continue whether or not you're subscribed.
Nothing you buy is ever conditional on accepting marketing.
If there's a data breach
If personal information is lost, stolen, or exposed, we investigate at once and notify affected individuals within 30 days, as the Florida Information Protection Act requires (Fla. Stat. § 501.171). If the breach affects 500 or more Florida residents, the Florida Department of Legal Affairs is notified as well, and we follow every other state's notification law that applies to our customers.
You'll get it in plain language: what happened, what data, what we've done, and what you should do. Not an email about a "security incident" written so that nobody finishes it.
Children
Our store is for adults. We do not knowingly collect personal information from anyone under 13 (Children's Online Privacy Protection Act), and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has given us information, email us and we'll delete it.
Security, honestly
Encryption in transit across the whole site. Card data never on our systems. Passwords stored hashed. Access to order data limited to people who need it to do their job and removed when they don't. Vendors chosen partly on their security posture and bound by written terms.
What we won't tell you is that your data is perfectly safe, because nobody can and the sentence is worthless. It can be well protected, and the above is what we do. If that fails, the paragraph above this one is what happens next.
Changes to this policy
When something changes, the date at the top changes with it. Where a change materially affects what we do with data we already hold, we tell you directly — by email where we have your address — rather than leaving it here to be discovered.
We don't ask you to check back periodically, and we don't treat your continued use of the site as agreement to anything. A privacy policy is a disclosure, not a contract you sign by browsing. Earlier versions are available on request.
Contact
Company name: Plushley LLC
Address: 1700 W International Speedway Blvd, Daytona Beach, FL 32114, United States
Email: support@plushley.com
Phone: +1 386-253-6783
Customer service hours: Monday–Friday, 9:00 AM–5:00 PM ET
Saturday and Sunday: Closed
Response time: Within one business day