Privacy policy

Last updated: September 29, 2026

ACORN & ASH, LLC, doing business as Acorn & Ash, operates acornandash.co, shop.acornandash.co, and related online and in-person commerce services. This Privacy Policy explains what personal information we collect, how we use it, when we disclose it, how long we keep it, and the choices that may be available to you.

Information we collect

Depending on how you interact with us, we may collect:

  • contact information, such as your name, email address, phone number, billing address, and shipping address;
  • order and transaction information, such as products you view, place in a cart, purchase, return, or ask us about;
  • payment-related information processed by Shopify and its payment providers. Acorn & Ash does not receive or store your full payment-card number;
  • communications you send to us, including order, product-support, quality, complaint, and safety-related messages;
  • account information if you choose to use a supported Shopify customer account;
  • information you voluntarily provide during an in-person sale, such as contact information for a receipt;
  • device and usage information, such as your IP address, browser, operating system, device information, pages viewed, and interactions with the website or checkout; and
  • information needed to prevent fraud, secure our services, comply with law, and maintain business records.

If you send a product complaint or safety report, your message may include health-related information that you choose to provide. Please provide only the information reasonably needed for us to respond.

How we collect information

We collect information:

  • directly from you when you place an online or in-person order, contact us, request support, or otherwise provide information;
  • automatically through our Cloudflare-protected main website and Shopify-hosted storefront, cart, checkout, security, and related technologies;
  • from payment, shipping, fraud-prevention, and other providers that help complete or protect a transaction; and
  • from a social-media platform only when you choose to communicate or interact with us through that platform, such as by sending a message, commenting, tagging us, or sharing content with us.

The links from our website to Facebook and Instagram are ordinary outbound links. The main website does not currently embed a social feed or social-platform tracking pixel. Simply following an external link does not give Acorn & Ash access to all information in your social-media account.

How we use information

We use personal information to:

  • operate the websites, cart, checkout, payment, account, point-of-sale, and order services;
  • process and fulfill orders, calculate tax and shipping, provide receipts, confirmations and tracking, and handle returns or refunds;
  • respond to customer-service, order, product, quality, complaint, and safety questions;
  • maintain security, prevent fraud and abuse, troubleshoot, and protect our customers and business;
  • keep financial, tax, quality, safety, and other records required for legitimate business or legal purposes; and
  • comply with applicable law, valid legal process, and our contractual obligations.

Acorn & Ash does not currently operate a newsletter, automated abandoned-checkout message program, customer-review request program, or merchant-configured advertising pixel. Order, payment, shipping, fulfillment, account, receipt, and support messages are transactional communications, not marketing subscriptions.

Service providers and commerce platforms

Cloudflare

Cloudflare hosts and protects the Acorn & Ash main website. Cloudflare processes network and request information, including IP address, browser and device information, to deliver the site, protect it from abusive traffic, and maintain security. Cloudflare may set a short-lived security cookie for bot detection.

Microsoft 365

Microsoft 365 and Exchange Online process messages sent to our support email addresses, together with related message and delivery information. This includes order, support, product-feedback, quality, complaint, and safety communications sent by email.

Shopify

Shopify hosts our online store and supports our online and point-of-sale commerce. Shopify processes information to provide the storefront, cart, checkout, payments, Shop Pay, point of sale, fraud prevention, tax and shipping functions, order administration, receipts, security, platform analytics, and related commerce services. Shopify may act as our service provider for some processing and may act separately for Shopify consumer services that you choose to use.

Shopify Network Intelligence is disabled for our store. Shopify states that, after disablement, it does not use additional customer data from the store going forward to power Network Intelligence Enhanced Services. This does not stop ordinary processing needed to host the store, operate checkout, process payments, prevent fraud, provide point-of-sale functions, or provide a Shopify consumer service that you choose to use.

You can learn more in the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal for choices relating to Shopify's own processing.

Cookies and similar technologies

The main website currently uses a Cloudflare security cookie for bot detection and protection. It does not contain a merchant-added analytics, advertising, or social-media pixel.

The Shopify store uses cookies and similar technologies to operate the storefront, remember location and currency, maintain a cart and checkout, secure the service, prevent fraud, and provide platform analytics. Current responses include cookies Shopify classifies as essential, analytics, and marketing. Acorn & Ash has no merchant-configured app pixel or custom pixel in Shopify Customer Events, and Network Intelligence is disabled.

Shopify's current Customer privacy settings display no cookie banner for the store's configured selling regions. This describes the observed configuration, not a determination of Acorn & Ash's legal obligations. We review the setting when selling regions or data practices change. You can control cookies through your browser. Blocking cookies needed for the storefront, cart, checkout, payments, or security may prevent those services from working correctly.

When we disclose information

We may disclose personal information:

  • to Shopify, payment providers, and point-of-sale providers to operate commerce and process transactions;
  • to shipping and fulfillment providers to deliver an order;
  • to Cloudflare, Microsoft, and other technology or security providers that operate and protect our services;
  • to customer-support and professional-service providers acting for legitimate business purposes;
  • when you direct or authorize a disclosure;
  • to comply with law, valid legal process, or a lawful government request;
  • to protect customers, Acorn & Ash, Shopify, or others from fraud, security threats, or unlawful conduct; and
  • in connection with a merger, financing, sale, reorganization, or similar business transaction, subject to applicable requirements.

Acorn & Ash does not sell personal information for money. We do not currently use merchant-configured advertising pixels or an active marketing app to conduct cross-context behavioral advertising.

Retention

We keep personal information for the periods reasonably needed for the purpose for which it was collected, subject to legal holds and longer periods required by law:

  • order, refund, shipping, tax, point-of-sale, and accounting records are generally kept for seven years after the applicable tax year;
  • product-quality, complaint, unexpected-event, and safety records are generally kept for six years from the date the record is created and may be kept longer for an open investigation, continuing safety follow-up, a legal hold, a regulatory request, a claim or dispute, or another period required by law;
  • routine customer-support and social-media messages are generally kept for two years after resolution;
  • privacy requests and our responses are generally kept for 24 months; and
  • security and technical records are kept for the shortest practical period supported by the applicable provider, unless they are needed to investigate an incident or meet a legal obligation.

Payment-card details are retained by Shopify and payment providers under their own requirements. Acorn & Ash does not store full payment-card numbers. When information is no longer needed, we delete, anonymize, or securely dispose of it when reasonably practicable, subject to provider controls, backups, tax, accounting, security, dispute, and legal requirements.

Your rights and choices

Depending on where you live and whether an applicable law covers Acorn & Ash, you may have rights to request access, correction, deletion, or a copy of certain personal information, or to appeal a decision concerning a privacy request. You may also have a right to opt out of certain sale, sharing, or targeted-advertising activity.

To make a request, email support@acornandash.co. We may need to verify your identity and may retain information when permitted or required by law. We will not discriminate against you for making a valid privacy request.

Shopify provides a regional privacy-choice page through our store. Where available, you may use Your Privacy Choices. Shopify also detects supported Global Privacy Control signals and applies them to the current browser for regions configured for that choice. A Global Privacy Control signal is not a request to delete your information and does not disable cookies needed for security, cart, checkout, or payments.

Shopify-related choices may also be available through the Shopify Privacy Portal. Browser-based choices may need to be repeated if you clear cookies or use another browser or device.

Children's information

Our services are not directed to children, and we do not knowingly collect personal information from children in circumstances prohibited by applicable law. If you believe a child has provided personal information to us, contact support@acornandash.co.

Security and processing locations

We use administrative, technical, and organizational measures intended to protect personal information. No method of transmission or storage is completely secure. Shopify, Cloudflare, Microsoft, and other providers may process information in locations other than the state or country where you live, subject to their contracts and applicable safeguards.

External links

Our websites may link to third-party services, including social-media platforms. Their privacy practices are governed by their own policies. A link does not make Acorn & Ash responsible for a third party's privacy or security practices.

Changes to this policy

We may update this Privacy Policy to reflect changes in our services, providers, practices, or legal obligations. We will post the revised policy and update the date above. We will provide additional notice when required.

Contact

For a privacy question or request, email support@acornandash.co.

ACORN & ASH, LLC
Claremore, Oklahoma, United States