We collect what we need to ship you a mattress, answer your questions, and improve the product. We don't sell your data. We don't trade in personal information. This page describes exactly what we collect, why, and what you can ask us to do with it.
1.Information we collect
We collect information in three ways: what you give us, what we get from your visit, and what our service providers pass along.
| Category | What we collect | Source |
|---|---|---|
| Order | Name, shipping address, billing address, phone, order contents | You, at checkout |
| Account | Email, password (hashed), order history | You, when you sign up |
| Support | Messages, attachments, return reasons | You, when you contact us |
| Browsing | Pages visited, time on page, referrer, device type | Cookies & analytics |
| Marketing | Email engagement (opens, clicks), only with your opt-in | Klaviyo |
2.How we use your information
We use what we collect for narrow, stated purposes:
- Process and ship your order — including delivery tracking, returns, and warranty service.
- Provide customer support — answering questions, resolving issues, following up after delivery.
- Improve the product — understanding which pages get read, where checkout is abandoned, and how the mattress is received.
- Send marketing emails — only when you've opted in. You can unsubscribe at any time, in one click.
- Meet legal obligations — tax records, fraud prevention, regulatory compliance.
We do not use your information for automated profiling that produces legal or similarly significant effects on you.
3.Cookies and tracking
We use a small set of cookies. None of them are sold or shared.
- Essential cookies — keep your cart, remember your session. These are always on.
- Analytics (Google Analytics 4) — anonymized, aggregated, used to understand which pages help and which confuse. You can opt out via your browser or the Do Not Sell or Share form.
- Marketing pixels — only loaded after you opt in to marketing emails or click an ad that takes you here. They are off by default.
4.Sharing with third parties
We share only what is necessary to run the business. We do not sell personal information for money. We do not allow third parties to use your data for their own purposes.
- Shopify — e-commerce platform. Processes orders and stores order history.
- FedEx, OnTrac — shipping carriers. Receive name and address only.
- Stripe, PayPal — payment processors. Handle billing; never see your full card number on our servers.
- Klaviyo — email platform. Only for opted-in subscribers.
- Google Analytics — anonymized website analytics. See opt-out.
5.Data retention
We keep order records for 7 years to meet tax and warranty obligations. Marketing data is kept until you unsubscribe, then deleted from active systems within 30 days. Support correspondence is kept for 3 years. You can request earlier deletion of any of it — see your rights below.
6.Your rights
Depending on where you live, you have some or all of the following rights. We extend the same rights to all U.S. customers, regardless of state.
Ask what we have on you. We'll send a portable copy within 45 days.
Ask us to erase what we have, subject to legal retention requirements.
We don't sell. If anything qualifies as "sharing" under CCPA, you can stop it.
We won't penalize you for exercising any of these rights. Same price, same service.
Tell us when something is wrong, and we'll fix it.
If we ever collect sensitive personal information, you can restrict its use.
California residents can submit requests via our Do Not Sell or Share form. EU and UK residents can email support@prettsun.com — we honor GDPR rights regardless of citizenship.
7.Children's privacy
Our site is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has provided us information, please email support@prettsun.com and we'll delete it.
8.Security
We use TLS encryption in transit, encrypt payment data at rest through our PCI-compliant processors, restrict employee access on a need-to-know basis, and run periodic third-party security reviews. No system is perfect; if we ever have a breach affecting your data, we'll notify you within 72 hours of discovery.
9.International transfers
PrettSun is operated by Hongkong Tseonsek Trading Co., Limited, a company incorporated and registered in Hong Kong, with production and fulfillment operations in Houston, Texas. Your data may be processed in the U.S. or in countries where our service providers operate. We rely on Standard Contractual Clauses for transfers from the EEA, UK, or Switzerland.
10.Changes to this policy
If we change something material, we'll email active customers and post a notice on the homepage for at least 30 days. The "Effective" date at the top always reflects the current version. Previous versions are archived and available on request.
11.Contact us
For any privacy question — to make a request, ask about a specific data practice, or chat with our small privacy team — write to us. We answer in plain language and within five business days.
Privacy questions, requests, or concerns
One email address, one person reading it. (Well, one team of three.)
support@prettsun.comCalifornia residents: submit a Do Not Sell or Share request →