Privacy Policy

Effective Date: May 22, 2026

Emi Woo LLC (“Company”, “we”, “our”, or “us”) respect your privacy and are committed to protecting it through our compliance with this policy. This policy describes how we collect, process, retain, and disclose personal data about you when providing services to you through our websites and services that link to this policy (our “Services”) and our practices for using, maintaining, protecting, and disclosing that information. This policy applies to individuals located in the United States, Canada, the United Kingdom, the European Economic Area, Australia, New Zealand, Japan, and other jurisdictions where we offer our Services.

Please read this policy carefully to understand our policies and practices regarding your information and how we treat it. By interacting with our Services or providing us with your information, you agree to the collection, use, and sharing of your information as described in this Privacy Policy. This policy may change from time to time. Your continued use of the Services after we make changes as described here is deemed to be acceptance of those changes, so please check the policy periodically for updates.

Scope

This policy applies only to information we collect:

• Through the Services.
• In communications, including email, text, chat, and other electronic messages, between you and the Services.
• When you interact with our advertising on third-party websites and services, if those applications or advertising include links to this Policy.

It does not apply to information collected by:

• Us through any other means, including on any other website operated by Company or any third party (including our affiliates and subsidiaries) that does not link to this policy; or
• Any third party (including our affiliates and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from or through the Services.

We may provide additional or different privacy policies that are specific to certain features, services, or activities.

Children's and Minors' Data

Our Services are not intended for, and we do not knowingly collect personal data from, children under the age of 16. If we learn that we have collected or received personal data from a child under 16 years old without legally required consent from a parent or guardian, we will promptly delete that information. If you believe we may have collected personal data from a child under 16, please contact us at privacy@emiwoo.com.

The Personal Data That We Collect or Process

We collect personal information only for lawful purposes connected with the operation of our business and the provision of our Services.

“Personal data” is information that identifies, relates to, or describes, directly or indirectly, you as an individual, such as your name, email address, telephone number, home address, or payment information (for example, account information such as name, postal address, and email address, credit card number).

We collect information you provide to us, including:

• Contact details. Your name, address, email address, phone number, username, and other contact information you provide us.
• Payment information. Your credit card or debit card information and information about the payment methods and services (such as PayPal or Venmo) you use in connection with the Services.
• Account history. Information about your account, transactions, purchases, order history, or discounts.
• Demographic information. Your age, gender, income level, education, or family or marital status, if you have consented to such information collection.
• Location information. General geographic location such as country, state or province, or city.
• Messages and preferences. Content and information you elect to provide as part of your profile or in any reviews you make through the Services or emails, chats, or other communications sent to us.

We collect the following information automatically:

• Usage & device data. IP address, device identifiers, operating system and version, preferred language, hardware identifiers, browser type and settings, and other device information.
• Statistics or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal data. For example, we may aggregate personal data to calculate the percentage of users accessing a specific Services feature.
• Technical information. Technical information includes information about your internet connection and usage details about your interactions with the Services, such as clickstream information to, through, and from our Services (including date and time), products that you view or search for; page response times, download errors, length of your visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), or methods used to browse away from a page.

We use cookies and similar technologies (such as pixels, tags, and web beacons) to operate and improve the Services, remember user preferences, and measure the performance of our website. Where required by applicable law, including in the European Economic Area and the United Kingdom, we will obtain your consent before placing non-essential cookies or tracking technologies on your device. These technologies will only be activated after you have provided consent through our cookie consent banner or preference center. You may manage your cookie preferences at any time through the cookie consent tools available on our website or through your browser settings. You may also withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Some of the information identified above may be considered sensitive data under certain laws. If required under applicable law, we will collect and process sensitive personal data only with your consent. Generally, we limit the collection of personal information to what is reasonably necessary to fulfill the purposes identified in this Privacy Policy. If you choose not to provide or allow us to collect some information, we may not be able to provide you with requested features, services, or information.

How We Collect Your Personal and Other Data

You Provide Information to Us

We collect information about you when you interact with our Services, such as when you create or update an account, place an order, subscribe, make a purchase, participate in surveys, sweepstakes, or promotions.

Automatically Through Our Services

As you navigate through and interact with our Services, we may use automatic data collection technologies to collect information that may include personal data. Information collected automatically may include usage details, IP addresses, operating system, and browser type, and information collected through cookies, web beacons, and other tracking technologies including details of your interactions with our Services, such as traffic data, location data, logs, and other communication data, and which resources and Services features that you access and use.

We may use these automatic collection technologies to collect information about your online activities over time and across third-party sites or other online services (behavioral tracking).

Using automatic collection technologies helps us to improve our Services and to deliver a better and more personalized experience.

The technologies we use for this automatic data collection may include:

• Cookies. A cookie is a small file placed on your device when you interact with the Services. You may refuse to accept or disable cookies by activating the appropriate setting on your browser or device. However, if you select this setting, you may be unable to access certain features of the Services.
• Web Beacons. Some parts of the Services and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those parts or opened an email and for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity).

To the extent any of these automated technologies are considered a personal data sale, targeted advertising, or profiling, under applicable laws, depending on where you live, you may opt out from use of these automated technologies for such uses by submitting a request at privacy@emiwoo.com. Please note that some Services features may be unavailable as a result.

When you interact with the Services, there are third parties that may use automatic collection technologies to collect information about your or your device. These third parties may include:

• Analytics companies.
• Your device manufacturer.
• Your internet or mobile service provider.

These technologies may collect information about how users access and use the Services in order to help us operate, maintain, and improve the functionality and performance of the Services.

We use advertising and measurement pixels (currently Meta Pixel, Google Ads, TikTok Pixel, and Pinterest Tag) to measure campaign performance and build audiences for marketing. Under California law, this activity may be considered a "sale" or "sharing" of personal information. You can opt out at any time using the cookie banner, the "Your Privacy Choices" link in the footer, or by enabling the Global Privacy Control (GPC) signal in your browser.

We do not control the tracking technologies used by third parties that support the operation of the Services. If you have questions about the data practices of these providers, you should contact the relevant provider directly.

Where required by applicable law, including the Australian Privacy Principles and the New Zealand Privacy Act 2020, we will take reasonable steps to notify individuals at or before the time personal information is collected about the purposes of collection, the types of personal information collected, how the information will be used, the parties with whom it may be shared, and how individuals may access or request correction of their personal information.

From Business Partners and Service Providers

We may receive personal data about you from other sources and combine that with information we collect directly from you. For example, we may obtain information about you from service providers that we engage to perform services on our behalf, such as email platform providers, content delivery services, payment processors, promotions services, gift card program providers, analytics providers, and security or fraud prevention services. We also may receive personal data from business partners that we engage to share consumer information with us, including your personal preferences and demographic information such as age, gender, and income level so that we can better provide you with a personalized experience, including personalized content, offers and services.

Legal Bases for Processing

If you are located in the European Economic Area, United Kingdom, Canada, Australia, New Zealand, Japan, or other jurisdictions that require a legal basis for processing personal data, we rely on one or more of the following legal bases:

• Performance of a contract: To provide products and services, process transactions, fulfill orders, and manage accounts.
• Legitimate interests: To operate, improve, and secure our Services; prevent fraud; analyze usage; and develop and market our products, provided that such interests are not overridden by your rights.
• Consent: Where required by law, including for sending marketing communications, placing non-essential cookies, or processing sensitive personal data. Where we rely on your consent as the legal basis for processing personal data, you may withdraw your consent at any time by contacting us at privacy@emiwoo.com, by using the consent management tools available on our website, or by following the unsubscribe instructions included in marketing communications.
• Legal obligations: To comply with applicable laws, regulations, legal processes, or government requests, including tax and accounting requirements.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal data, to:

• Provide you with the Services and any contents, features, information, products, or services that we make available through the Services.
• Fulfill and manage purchases, orders, deliveries, payments, returns, and exchanges.
• Fulfill any other purpose for which you provide it.
• Improve our Services, including by analyzing your information and creating aggregated data derived from your information) to develop, maintain, analyze, improve, optimize, measure, and report on our Services and their features and how users interact with them.
• Promote our Services, business, and offerings by publishing advertising on our own Services and by placing ads on third parties' services. We may use your information to model, segment, target, offer, market, and advertise our Services.
• Carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
• Notify you when Services updates are available and about changes to any products or services we offer or provide though them.
• Personalize and measure marketing, including using ad pixels to build/measure audiences—this activity may constitute a “sale” or “sharing” of personal information under California law (see the “Sale” and “Sharing” of Personal Information (California) section).
• Product research and development, including analyzing de-identified or aggregated insights.
• Security, fraud prevention, and compliance with legal obligations.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

Where processing is based on your consent, you may withdraw that consent at any time as described in the “Your Rights and Choices About Your Information” section. We use personal data only for the purposes described in this Privacy Policy or as otherwise disclosed to you at the time of collection. We will not use your personal data for materially different, unrelated, or incompatible purposes without providing notice and obtaining your consent where required by applicable law, including the laws of Japan and other jurisdictions.

The usage information we collect, whether connected to your personal data or not, helps us improve our Services and deliver a better and more personalized experience by enabling us to:

• Estimate our audience sizes and usage patterns.
• Store information about your preferences.
• Speed up your searches.
• Recognize you when you return to our Services.

We may also use your information to contact you about goods and services that may be of interest to you. If you do not want us to use your information in this way, please check the relevant box located on the form on which we collect your data (the order form).

Who We Disclose Your Information To

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may also disclose personal data that we collect or you provide as described in this privacy policy:

• To our subsidiaries and affiliates.

To contractors, service providers, and other third parties we use to support our organization and who are bound by contractual obligations to keep personal data confidential and use it only for the purposes for which we disclose it to them, including:

• Website hosting: Vercel
• E-commerce platform: Shopify
• Site reliability & error monitoring: Sentry
• Analytics: Google Analytics, Google Tag Manager, Plausible (privacy-first, cookie-free)
• Advertising measurement: Google Ads, Meta Pixel, TikTok Pixel, Pinterest Tag
• Server-side event forwarding: Stape
• Email & SMS: Klaviyo
• Consent preferences: Cookiebot
• To service providers located in other countries. Some of our service providers, such as website hosting providers, e-commerce platforms (including Shopify), payment processors, email service providers, and analytics providers, may be located outside your country of residence, including in the United States and other jurisdictions. We take reasonable steps to ensure that these service providers protect personal data in accordance with applicable privacy and data protection laws and use such data only for the purposes for which it was disclosed.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Emi Woo LLC's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by Emi Woo LLC is among the assets transferred.
• To third parties to market their products or services to you if you have not opted out of these disclosures. We contractually require these third parties to keep personal data confidential and use it only for the purposes for which we disclose it to them.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

If personal information of individuals located in Japan is shared with third parties, we will do so in accordance with Japan's Act on the Protection of Personal Information (APPI). Except where permitted by law, we will obtain consent before providing personal data to third parties.

We may also disclose your personal data:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To enforce or apply our terms of use or terms of sale and other agreements, including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our organization, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

International Data Transfers

We are based in the United States and use service providers that operate in the United States and other countries. As a result, your personal data may be transferred to, stored, or processed outside your country of residence, including in jurisdictions that may not provide the same level of data protection as your home country.

When we transfer personal data from the European Economic Area, United Kingdom, Canada, Australia, New Zealand, Japan, or other jurisdictions with cross-border transfer restrictions, we rely on legally recognized safeguards, including:

• Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner, which contractually require recipients to protect personal data;
• Data processing agreements with our service providers, including Shopify, payment processors, email service providers, and analytics providers, requiring them to protect personal data and use it only for specified purposes;
• Transfers to service providers located in countries that have been recognized by applicable authorities as providing an adequate level of data protection, where applicable.

By using our Services, you acknowledge that your personal data may be transferred to and processed in the United States and other jurisdictions in accordance with this Privacy Policy. However, if personal information of individuals located in Japan is transferred to a third party outside Japan, we will take steps required under the Act on the Protection of Personal Information, including providing relevant information about the recipient and obtaining consent where required.

You may request additional information about the safeguards we use for international data transfers by contacting us at privacy@emiwoo.com.

Your Rights and Choices About Your Information

This section describes mechanisms you can use to control certain uses and disclosures of your information and rights you may have under state law, depending on where you live.

Advertising, marketing, cookies, and other tracking technologies choices:

• Cookies and Other Tracking Technologies. You can set your browser to refuse all or some browser cookies or other tracking technology files, or to alert you when these files are being sent. If you disable or refuse cookies or similar tracking files, some Services features may be inaccessible or not function properly. Some browsers include a “Do Not Track” (DNT) setting that can send a signal to the online services you visit indicating you do not wish to be tracked. Because there is not a common understanding of how to interpret the DNT signal, our Services may not respond to all browser DNT signals. Instead, you can use the range of other tools to control data collection and use, including the cookie controls and advertising controls described in this policy.

U.S. State Privacy Rights

Depending on your state of residency (e.g., California, Colorado, Connecticut, Utah, Virginia), you may have certain rights related to your personal data, including:

• Access and Data Portability. You may confirm whether we process your personal data and access a copy of the personal data we process. To the extent feasible, data will be provided in a portable format. Depending on your state, you may have the right to receive additional information and it will be included in the response to your access request.
• Correction. You may request that we correct inaccuracies in your personal data that we maintain, taking into account the information's nature and processing purpose.
• Deletion. You may request that we delete personal data about you that we maintain, subject to certain exception under applicable law.
• Opt Out of Using Personal Data for Targeted Advertising, Profiling, and Sales. You may request that we do not use your personal data for these purposes.

To submit a request to exercise any of these rights or appeal a decision, please email privacy@emiwoo.com. We will verify requests as required and will not discriminate for exercising your rights.

International Privacy Rights

If you are located in Canada, the United Kingdom, the European Economic Area, Australia, New Zealand, Japan, or another jurisdiction with applicable privacy or data protection laws, you may have certain rights regarding your personal data, subject to applicable legal limitations and exceptions.

These rights may include:

• Right to Access. You have the right to request confirmation of whether we process your personal data and to obtain access to the personal data we hold about you, as well as information regarding how we collect, use, and disclose such data.
• Right to Correction. You have the right to request that we correct or update inaccurate, incomplete, or outdated personal data that we maintain about you.
• Right to Deletion (“Right to Be Forgotten”). You have the right to request the deletion of your personal data in certain circumstances, including where:
• The personal data is no longer necessary for the purposes for which it was collected or processed;
• You withdraw consent on which the processing is based and there is no other legal basis for the processing;
• You object to the processing and there are no overriding legitimate grounds for the processing;
• The personal data has been unlawfully processed; or
• The personal data must be erased in order to comply with a legal obligation under applicable law.

Please note that we may retain certain information where necessary to comply with legal obligations, resolve disputes, enforce agreements, or where otherwise permitted by applicable law.

• Right to Withdraw Consent. Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing conducted prior to the withdrawal. You may withdraw consent by adjusting your account settings, using available cookie preference tools, unsubscribing from marketing communications, or contacting us at privacy@emiwoo.com.
• Right to Restrict Processing. You may have the right to request that we restrict or limit the processing of your personal data under certain circumstances, such as while we evaluate or respond to a request to correct your personal data.
• Right to Object to Processing. You may have the right to object to our processing of your personal data where such processing is based on our legitimate interests or is used for direct marketing purposes.
• Right Related to Automated Decision-Making and Profiling. We do not engage in automated decision-making that produces legal effects or similarly significant effects concerning individuals. We may use limited profiling or audience segmentation for marketing analytics, advertising measurement, and personalization of content, but these activities do not result in decisions that significantly affect you.
• Right to Data Portability. Where applicable, you may request a copy of your personal data in a structured, commonly used, and machine-readable format, and may request that we transmit such data to another organization where technically feasible.
• Right to Information Regarding Cross-Border Transfers. You may request additional information regarding the safeguards we use when transferring personal data outside your country of residence.
• Right to Lodge a Complaint. You have the right to lodge a complaint with your local data protection or privacy authority if you believe that our processing of your personal data violates applicable law. Relevant authorities may include, without limitation, supervisory authorities in the EEA, the UK Information Commissioner's Office, the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner, the Office of the Privacy Commissioner of New Zealand, or Japan's Personal Information Protection Commission.
• Right to Anonymity and Pseudonymity (Australia). Where practicable, individuals located in Australia may choose to interact with us anonymously or by using a pseudonym. However, in some circumstances it may not be possible for us to provide certain services or complete transactions without collecting personal information, such as when processing orders or payments.

To exercise any applicable privacy rights, please contact us at privacy@emiwoo.com. We may take reasonable steps to verify your identity before fulfilling your request. We will respond to requests to exercise your data protection rights within one (1) month, unless the request is particularly complex, in which case we may extend the response period by up to two (2) additional months as permitted under applicable law. We will not discriminate against you for exercising any of your privacy rights.

“Sale” and “Sharing” of Personal Information (California)

We do not sell personal information for money. When we use advertising/measurement pixels (e.g., Meta and Google Ads) to build or measure audiences across different contexts, California law may treat this as a “sale” or “sharing.” If applicable to you, the following privacy procedures apply:

• You may opt out via our “Do Not Sell or Share My Personal Information” link (footer).
• We honor GPC signals as a valid opt-out request.
• We do not knowingly sell/share the personal information of consumers under 16.

Notice at Collection (California)

How We Protect Your Personal Data

We use commercially reasonable administrative, physical, and technical measures designed to protect your personal data from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. However, no website, mobile application, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of your personal data transmitted to, through, using, or in connection with the Services. In particular, email, texts, and chats sent to or from the Services may not be secure, and you should carefully decide what information you send to us via such communications channels. Any transmission of personal data is at your own risk.

The safety and security of your information also depends on you. You are responsible for taking steps to protect your personal data against unauthorized use, disclosure, and access.

In the event of a privacy or data security breach that is likely to cause serious harm or otherwise requires notification under applicable law, we will notify affected individuals and relevant regulatory authorities in accordance with applicable privacy laws, including the New Zealand Privacy Act 2020 and Japan's Act on the Protection of Personal Information, which may include notifying the Office of the Privacy Commissioner (New Zealand) or the Personal Information Protection Commission (Japan) where required.

How We Retain Your Personal Data

We keep the categories of personal data described in this policy for as long as reasonably necessary to fulfill the purposes described or for as otherwise legally permitted or required, such as maintaining the Services, operating our organization, complying with our legal obligations, resolving disputes, and for safety, security, and fraud prevention. This means that we consider our legal and business obligations, potential risks of harm, and nature of the information when deciding how long to retain personal data.

The length of time we retain personal data depends on the type of data and the purposes for which we collected it, including legal, accounting, and operational requirements. Examples of typical retention periods include:

• Account and order information: retained for up to seven (7) years to comply with tax, accounting, and legal obligations.
• Payment transaction records: retained as required by payment processors and applicable financial regulations.
• Marketing and communications data: retained until you unsubscribe, withdraw consent, or request deletion.
• Customer service communications: retained as necessary to resolve inquiries and maintain business records.
• Website usage and analytics data: retained in accordance with our analytics providers' standard retention periods, typically between 14 and 26 months.

When personal data is no longer required for the purposes described above, we will securely delete, anonymize, or de-identify the data, unless retention is required or permitted by law.

Changes to Our Privacy Policy

We may update this policy from time to time, and we will provide notice of any such changes to the policy as required by law. The date the privacy policy was last updated is identified at the top of the page. We will notify you of changes to this policy by updating the “last updated” date and posting the updated policy on the Services. We may email or otherwise communicate reminders about this policy, but you should check our Services periodically to see the current policy and any changes we have made to it.

Contact Information

To exercise your rights or ask questions or comment about this privacy policy or our privacy practices, contact us at:

privacy@emiwoo.com

Emi Woo LLC

1178 Broadway, 3rd Floor #531, New York, New York 10001.

Emi Woo LLC has not appointed a Data Protection Officer, as it is not required to do so under Article 37 of the General Data Protection Regulation (GDPR). However, any privacy-related inquiries may be directed to the contact information above.

This Privacy Policy is available free of charge on our website. If you require a copy of this policy in another format, please contact us and we will take reasonable steps to provide it.