Privacy Policy

Draco LLC is the controller of the personal information described in this Policy. Ploopp is a brand of Draco LLC; where you see one name, the other stands behind it.

• Entity: Draco LLC (trading as Ploopp)
• Web: ploopp.com
• Privacy: [email protected]
• General: [email protected]

We collect the following categories of personal information. We collect them because they are necessary — not because they are available.

• Identity and Contact: Your name, email address, postal and billing addresses, and telephone number, supplied when you place an order, open an account, or write to us.
• Order and Transaction Records: The items you purchase, order numbers, dispatch and delivery records, returns, and correspondence regarding them.
• Payment Information: Payment is processed by our providers. We receive confirmation of payment, the card type, and the final four digits — we do not receive or store your full card number.
• Account Credentials: If you create an account, your username and an encrypted form of your password. We never see your password in readable form.
• Personalization Content: Where you order a custom nameplate, the text, pet name, or artwork you submit for engraving. Please note that a pet's name, once engraved, travels with the hardware into the world.
• Correspondence and Subscriptions: Your email address if you subscribe to our mailing list, together with your engagement with those messages and any support enquiries you send.
• Wholesale Partner Details: For retail partners: business name and address, the names and contact details of authorized signatories, resale or tax exemption certificates, and purchase order history.
• Technical and Usage Data: IP address, browser and device type, operating system, referring page, pages viewed, and time spent — collected automatically as you browse.
• Content You Volunteer: Reviews, photographs, comments, or wishlist selections you choose to submit.

We do not knowingly collect sensitive personal information as that term is defined under California law, and we do not use personal information to infer characteristics about you.

• Directly from you: When you order, register, subscribe, request a custom nameplate, scan a product QR code, or contact us.
• Automatically: Through cookies and similar technologies as you use the Site, as described in Section 5.
• From our service providers: Our payment processors, shipping carriers, and accounting platform return confirmations, delivery statuses, and invoice records to us.
• From retail partners: Where a retailer supplies contact details for its authorized representatives in the course of a wholesale relationship.

We use personal information only for the purposes set out below. Each purpose is disclosed at or before the point of collection, and we do not repurpose your information for materially different ends without telling you first.

• To fulfil your order: Processing payment, engraving personalization, dispatching goods, and handling returns, refunds, and warranty claims.
• To maintain your account: Authenticating you, preserving your order history, and honouring your saved preferences.
• To correspond: Answering enquiries and issuing transactional notices such as order confirmations, dispatch alerts, and warranty correspondence.
• To send marketing, with consent: Sharing new releases and offers where you have subscribed. Every such message carries an unsubscribe link, and departure is immediate.
• To administer wholesale accounts: Verifying resale certificates, issuing invoices, applying the correct sales tax, and managing partner relationships.
• To improve: Understanding, in aggregate, how the Site is used so that we may refine it.
• To comply and protect: Meeting tax, accounting, and legal obligations; preventing fraud; and defending our rights where necessary.

For visitors in the European Economic Area and United Kingdom: our lawful bases are performance of a contract (fulfilling your order), consent (marketing and non-essential cookies), legal obligation (tax and accounting records), and legitimate interests (securing the Site, preventing fraud, and modest improvement of our service).

The Site uses cookies and similar technologies. Strictly necessary cookies — those that hold your cart, keep you signed in, and secure the checkout — cannot be declined without the Site ceasing to function. Everything else is yours to refuse.

• Your controls: You may refuse or withdraw consent through our cookie banner, and you may block or delete cookies through your browser settings at any time.
• Global Privacy Control: We honour the Global Privacy Control (GPC) signal. Where your browser transmits GPC, we treat it as a valid request to opt out of any sale or sharing of your personal information.
• Do Not Track: There is no common industry standard for Do Not Track browser signals. We do not respond to them, but we do honour GPC, as stated above.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. Disclosure is limited to the following:

• Payment processors: Stripe and Intuit QuickBooks process payments and issue invoices on our behalf. They receive what is necessary to complete the transaction and handle it under their own privacy policies.
• Shipping carriers: Your name and delivery address, so that your parcel may find you.
• Technology and fulfilment providers: Our website host, e-commerce platform, email delivery service, and engraving partner — each contractually bound to process data only on our instructions and prohibited from using it for their own purposes.
• Professional advisers: Our accountants and legal counsel, where a matter requires their attention.
• Legal compulsion: Where required by law, subpoena, or court order, or where necessary to protect our rights, safety, or property. We disclose the minimum the demand requires.
• Corporate transaction: In the event of a merger, acquisition, or sale of assets, personal information may transfer as part of that transaction. You will be notified, and this Policy will continue to govern until superseded.

We keep personal information only as long as the purpose requires, or as the law compels. In practice:

• Order and tax records: Seven (7) years from the transaction, to satisfy tax and accounting obligations.
• Account information: For the life of your account, and for a brief interval afterwards should you wish to return.
• Marketing subscriptions: Until you unsubscribe, after which we retain a minimal suppression record so that we do not write to you again in error.
• Personalization artwork: Twenty-four (24) months following fulfilment, so that a replacement may be produced without troubling you for the file a second time.
• Analytics data: Twenty-six (26) months, in aggregated or pseudonymized form.

When a retention period expires, we delete the information or irreversibly anonymize it.

We employ administrative, technical, and physical safeguards appropriate to the sensitivity of the information: encryption in transit via TLS, encryption of sensitive fields at rest, access restricted to personnel with a genuine need, hashed passwords, and payment processing delegated to PCI-DSS compliant providers so that card numbers never touch our systems.

We are, however, obliged to be honest with you: no method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. Should a breach affecting your personal information occur, we will notify you and the relevant authorities as required by applicable law — without delay, and without euphemism.

Depending on where you reside, you hold some or all of the following rights. We extend the substance of them to all our customers as a matter of course, regardless of jurisdiction.

• The right to know: To learn what personal information we hold about you, its sources, the purposes of its use, and the parties to whom we disclose it.
• The right of access: To obtain a copy of your personal information in a portable, machine-readable form.
• The right to correction: To have inaccurate information about you set right.
• The right to erasure: To have your personal information deleted, subject to records we are legally obliged to retain.
• The right to opt out: To direct us not to sell or share your personal information. We do neither, but the right stands regardless.
• The right to withdraw consent: To withdraw consent for marketing or non-essential cookies at any time, without affecting the lawfulness of what preceded.
• The right to non-discrimination: To exercise any of these rights without penalty. We will not deny you goods, charge you a different price, or degrade your service because you asserted a right.
• The right to object or restrict: For EEA and UK residents: to object to processing conducted on the basis of legitimate interests, or to request its restriction.

To exercise any right, write to us at [email protected] with the words "Privacy Request" in the subject line. We will verify your identity by reference to information already in our possession — a courtesy to you, as we will not surrender your records to a stranger.

We respond within forty-five (45) days, extendable once by a further forty-five where the request is complex, and within one (1) month for EEA and UK residents. There is no charge unless a request is manifestly unfounded or excessive.

An authorized agent may submit a request on your behalf with written proof of authorization. If you are dissatisfied with our response, you may appeal by replying to our decision, and you retain the right to lodge a complaint with your supervisory authority or state attorney general.

The Site is intended for adults. We do not knowingly collect personal information from children under sixteen (16), and we do not sell or share the personal information of minors under sixteen for any purpose. Should we discover that we have collected such information without verifiable parental consent, we will delete it promptly. A parent or guardian who believes we hold information about their child may write to [email protected], and the matter will be resolved without ceremony.

Draco LLC operates in the United States, and personal information we collect is processed and stored there. If you access the Site from outside the United States, you understand that your information will be transferred to a jurisdiction whose data protection laws may differ from those of your own.

Where we transfer personal information out of the EEA or United Kingdom, we do so under appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. A copy of the relevant safeguard is available on request.

The Site links to third-party destinations — among them our Instagram presence and the sites of our payment providers. Once you depart our Site, this Policy no longer governs. We do not control those destinations and accept no responsibility for their practices. We would gently encourage you to read their policies with the same attention you have shown ours.

We may amend this Policy from time to time. The "Last Updated" date above will reflect any change, and we review this Policy at least annually. Where a change is material, we will provide conspicuous notice on the Site and, where we hold your address and the law requires it, by email. Your continued use of the Site following notice constitutes acceptance of the revised Policy.

Questions, requests, and objections regarding this Policy are welcome and will be answered by a person, not a form letter.

• Entity: Draco LLC (trading as Ploopp)
• Attention: Privacy Officer
• Privacy Email: [email protected]
• General Email: [email protected]
• Web: ploopp.com

For state-specific disclosures, or to submit a request under a particular privacy statute, note the statute in your message and we will route it accordingly.