House Plant Shop Privacy Policy
Effective Date: 8.10.26 Last Updated: 8.10.2026 Replaces: “Mobile App Privacy Policy” (undated, previously at /pages/mobile-app-privacy-policy-1)
This Privacy Policy describes how PPC International LLC, doing business as House Plant Shop (“PPC,” “House Plant Shop,” “we,” “us,” “our”), collects, uses, discloses, sells, and shares personal information when you visit or make a purchase from https://houseplantshop.com, use our mobile application (if available), subscribe to our email or SMS programs, contact our customer care team, or otherwise interact with us (collectively, the “Services”).
This Policy is issued in part to satisfy the notice-at-collection and privacy policy requirements of the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”). California residents should read Sections 10 through 13 carefully.
Summary of the most important points:
We use cookies, pixels, and similar technologies from third parties, including Meta, Google, Klaviyo, and Attentive, for analytics and advertising. Details are in Section 5.
Under California law, some of these disclosures constitute “selling” or “sharing” personal information. You can opt out at any time. See Section 11 and our “Do Not Sell or Share My Personal Information” page.
We honor the Global Privacy Control browser signal.
We never sell your name, email, or order history to data brokers in the colloquial sense, and we do not knowingly sell or share the personal information of anyone under sixteen.
1. Who We Are and How to Reach Us
PPC International LLC (d/b/a House Plant Shop) 389 E Olive St, San Marcos, CA 92069, USA Greenhouse and fulfillment locations: San Marcos, California and Mount Dora, Florida Privacy contact: privacy@houseplantshop.com General contact: info@houseplantshop.com
PPC is the “business” (as defined by the CCPA) and the “data controller” responsible for personal information processed under this Policy. Our Services are hosted on Shopify Inc.‘s ecommerce platform, which processes personal information on our behalf as a service provider.
2. Scope
This Policy applies to:
houseplantshop.com and all pages on that domain, including checkout pages hosted by Shopify
Our email and SMS marketing programs
Our customer care channels, including email and our help center
Personal information we receive from marketplaces and retail partners where you buy our products on Amazon, Walmart Marketplace, Temu, and Groupon voucher redemptions
3. Personal Information We Collect Directly From You
Account and order information. When you create an account, place an order, or redeem a voucher, we collect your name, email address, shipping and billing address, telephone number, and account credentials. If you sign in through a social login (Facebook, Google, or Apple) or a one-time code, we receive your email address and basic profile information from that provider.
Payment information. Payments are processed by our payment processors (including Shopify Payments, Shop Pay, PayPal, Apple Pay, Google Pay, and Amazon Pay, depending on the method you choose). We receive confirmation of payment, the payment method type, and the last four digits of your card. We do not receive or store full card numbers.
Communications. When you contact customer care by email or through our help center, we collect the contents of your communications, your contact details, and your order history as needed to respond. Our help center is operated on the Odoo platform.
Photos and user content. If you submit a product review, upload a photo (for example, of a plant that arrived damaged, to process a replacement or refund), or post user-generated content, we collect that content. Reviews and review photos are collected and displayed through our reviews provider, Loox.
Marketing sign-ups. If you join our email list, we collect your email address (processed through Klaviyo). If you join our SMS list, we collect your mobile number and consent records (processed through Attentive). Message frequency varies; message and data rates may apply; reply STOP to cancel.
Gift registry. If you create or purchase from a gift registry, our registry provider MyRegistry collects registry details, recipient information, and gift selections.
Surveys, promotions, and contests. If you participate, we collect the information you choose to provide.
4. Personal Information We Collect Automatically
When you visit the site, we and our third-party providers automatically collect:
Device and connection data. IP address, browser type and version, operating system, device type, screen resolution, language settings, and internet service provider.
Usage data. Pages viewed, products viewed, searches performed on the site (processed in part by our site-search provider, Doofinder), links clicked, referring and exit pages, date and time stamps, and clickstream data.
Approximate location. Inferred from your IP address, used for example to display shipping eligibility, weather-based shipping protection recommendations, and region-appropriate inventory (our inventory location script determines which greenhouse, California or Florida, serves your region).
Identifiers stored on your device. Cookies and similar identifiers described in Section 5.
Accessibility widget data. We use UserWay to provide accessibility features. UserWay processes technical data needed to render its widget and remediation profiles.
5. Cookies, Pixels, and Tracking Technologies
We use first-party and third-party cookies, pixels, tags, scripts, and software development kits. Some are strictly necessary to run the store. Others support analytics, marketing, and advertising, including what California law calls “cross-context behavioral advertising.”
5.1 Technologies currently in use
Strictly necessary. Our store runs on Shopify, which sets cookies required to operate the site: keeping your cart, processing checkout, preventing fraud, remembering your region and currency, and recording your privacy consent choices. Cookies in this group include _shopify_y, _shopify_s, shopify_client_id, cart_currency, localization, and _tracking_consent. These operate at all times and cannot be disabled.
Advertising. We use the Meta Pixel, provided by Meta Platforms, Inc., for advertising measurement and audience building across Meta services such as Facebook and Instagram. It may set the _fbp cookie and, when active, transmit your IP address, browser information, and the pages and products you view to Meta.
Analytics. We use Google Analytics 4, loaded through Google Tag Manager and provided by Google LLC, to understand site traffic, page views, and conversions. It sets the _ga cookie and related ga cookies that recognize your browser across visits.
Email marketing. We use Klaviyo, Inc. to send our email program and to track onsite browsing so emails can be personalized, for example a reminder about a plant you viewed. Klaviyo sets the __kla_id cookie.
SMS marketing. We use Attentive Mobile Inc. to run our text message program, including sign-up, attribution, and onsite event tracking. Attentive sets cookies including __attentive_id and __attentive_session_id.
Store features. Several tools help run specific parts of the shopping experience, and each may set its own cookies: Loox displays product reviews and sends review request emails; Doofinder powers our onsite product search; Conversion Bear displays the free-shipping progress bar; ModeMagic (Mason) displays product badges and sends related usage events to its servers; an Omega chat widget lets you message us through Facebook Messenger and loads Meta chat assets; MyRegistry powers our gift registry; and UserWay provides our accessibility widget.
This list reflects our most recent site audit. We review it whenever we add or remove tools and update this section accordingly.
5.2 Consent and control
Advertising and analytics technologies load in accordance with your consent choices made through our cookie preferences banner, and with applicable law. Strictly necessary technologies always operate. You can revisit your choices at any time through the “Cookie Preferences” link in the site footer. You may also control cookies through your browser settings; general guidance is available at allaboutcookies.org.
We honor the Global Privacy Control (GPC) signal as a valid opt-out of sale and sharing for the browser that transmits it. See Section 11.
5.3 Meta Pixel specifics
Our site includes the Meta Pixel. When active, it can transmit to Meta: your IP address, browser information, the pages and products you view, and identifiers including the _fbp cookie. Meta may use this data as described in its own Privacy Policy, including to match your visit to a Facebook or Instagram account. Where you opt out, or where a valid GPC signal is present, the pixel’s advertising events are not transmitted. [Counsel note: pixel base code loads sitewide today even though event beacons were not observed firing; decide with counsel whether to remove the tag entirely given it has not supported active campaigns since 2022. Removal is the cleanest answer and simplifies this section.]
5.4 Google Analytics specifics
We use Google Analytics 4 to understand how visitors use the site. Google plants cookies that identify your browser across visits. You can opt out via our cookie preferences, GPC, or Google’s browser add-on at tools.google.com/dlpage/gaoptout. [Counsel note: two GA4 property cookies were observed (_ga_YM6388YH2J and _ga_KBXHPEDLCD); confirm whether both properties are intentional and document owners, or remove one.]
6. How We Use Personal Information
We use personal information to:
Process, fulfill, and ship orders, including selecting the fulfillment greenhouse, adding weather-appropriate packaging, and providing tracking
Process payments, refunds, partial refunds, and replacements under our 30-day live plant guarantee, including reviewing damage photos you submit
Create and administer your account
Operate subscriptions, including House Plant Box billing and renewals.
Provide customer care and honor our policies
Send transactional messages (order confirmations, shipping notices, replacement status)
Send marketing email and SMS where you have signed up, and personalize those messages based on your browsing and purchase history
Measure and improve site performance, product assortment, and navigation
Deliver and measure advertising, including cross-context behavioral advertising, subject to your consent and opt-out rights
Detect and prevent fraud, abuse, and security incidents
Comply with legal obligations, including tax, consumer protection, and agricultural shipping regulations
Display product reviews and testimonials you submit
Establish, exercise, or defend legal claims
We do not use personal information for automated decision-making that produces legal or similarly significant effects.
7. How We Disclose Personal Information
Service providers and contractors. We disclose personal information to companies that process it on our behalf under contract: Shopify (platform and hosting), payment processors, shipping carriers, Odoo (help desk and business systems), Klaviyo (email), Attentive (SMS), Loox (reviews), Doofinder (search), UserWay (accessibility), app vendors listed in Section 5.1, and professional advisors.
Advertising and analytics partners. When advertising technologies are active, identifiers and internet activity information are transmitted to Meta Platforms, Inc. and Google LLC as described in Section 5. Under California law these transmissions may constitute “selling” or “sharing.” Section 10 describes the categories involved; Section 11 describes how to opt out.
Marketplaces. If you purchase our products through a third-party marketplace or voucher provider [Amazon, Walmart, Groupon], we receive and process the order information they provide under their terms.
Corporate transactions. In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be disclosed or transferred as part of that transaction, subject to this Policy or successor terms.
Legal. Where required by law, subpoena, court order, or lawful requests by public authorities; to enforce our terms; to protect the rights, property, or safety of PPC, our customers, or others; or to investigate fraud or wrongdoing.
With your direction. For example, gift orders and registries necessarily disclose your name to the recipient.
We do not disclose customer lists to third parties for their own independent marketing by mail or email.
8. Retention
We retain personal information only as long as needed for the purposes above, then delete or de-identify it. Because different records serve different purposes, retention differs by category:
Category Retention: Order and transaction records [7] years (tax and accounting obligations) Account information Life of the account plus [1] year, or upon verified deletion request Customer care correspondence and damage photos [3] years from ticket closure Marketing email and SMS records Until unsubscribe plus [24] months (suppression lists retained to honor the unsubscribe) Analytics and advertising identifiers Per the retention configured with each provider.
9. Security
We use physical, technical, and organizational safeguards appropriate to the nature of the data, including transport-layer encryption on all pages, tokenized payment processing so full card numbers never touch our systems, access controls on customer data, and monitoring for vulnerabilities. No internet transmission is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you and regulators as required by law. Please do not email us sensitive information such as government identifiers or full card numbers; we may delete unsolicited sensitive data on receipt.
10. Notice at Collection for California Residents
In the preceding twelve months we have collected the categories of personal information listed below, as defined in Cal. Civ. Code § 1798.140(v), for the purposes in Section 6, from the sources in Sections 3 and 4:
CCPA category Examples we collect Disclosed for business purpose Sold or shared Identifiers Name, address, email, phone, IP address, cookie and device identifiers Yes Yes (IP address, cookie and device identifiers, to advertising partners) Customer records (§ 1798.80(e)) Name, address, phone, payment method type Yes No Commercial information Orders, products viewed, subscription status Yes Yes (products viewed and purchase events, to advertising partners) Internet or network activity Browsing and search activity on our site, page interactions Yes Yes (to advertising and analytics partners) Geolocation (approximate) Region inferred from IP Yes Yes (as embedded in advertising transmissions) Audio/electronic/visual Customer care emails and chats, photos you submit Yes No Inferences Product and content preferences Yes Yes (audience segments with advertising partners) We do not collect the categories of sensitive personal information enumerated at § 1798.140(ae) except account log-in credentials, which we use only to authenticate you, and we do not use or disclose sensitive personal information for purposes requiring a right to limit under § 1798.121.
We do not knowingly collect, sell, or share personal information of consumers under sixteen years of age.
The criteria for retention are stated in Section 8.
11. Your California Rights and How to Exercise Them
If you are a California resident, you have the right to:
Know and access. Request the categories and specific pieces of personal information we hold about you, the sources, purposes, and the categories of recipients.
Delete. Request deletion of personal information we collected from you, subject to exceptions (for example, completing your transaction, warranty and guarantee service, security, and legal compliance).
Correct. Request correction of inaccurate personal information.
Opt out of sale and sharing. Direct us to stop selling or sharing your personal information for cross-context behavioral advertising. Exercise this right by:
Clicking “Do Not Sell or Share My Personal Information” in the site footer
Setting your choices in “Cookie Preferences”
Enabling Global Privacy Control in your browser; we treat a valid GPC signal as an opt-out for that browser and device
Emailing [info@houseplantshop.com]
Limit sensitive personal information. Not applicable to our current practices, as described in Section 10.
Non-discrimination. We will not deny you goods or services, charge different prices, or degrade quality because you exercised any of these rights.
How requests work. Submit requests to [info@houseplantshop.com] with the subject “California Privacy Request.” We verify identity by matching the information you provide to our records and confirming control of the associated email address; deletion and access requests may require additional verification. We respond within 45 days and may extend once by 45 days with notice. You may use an authorized agent; we require signed written authorization and may verify your identity directly.
Shine the Light. California Civil Code § 1798.83 permits requests about disclosures to third parties for their direct marketing. We do not disclose personal information to third parties for their own direct marketing.
12. Other US State Privacy Rights
Residents of other states with comprehensive privacy laws (including Colorado, Connecticut, Texas, Oregon, and Virginia) may have similar rights of access, correction, deletion, and opt-out of targeted advertising, subject to those laws’ applicability thresholds. You may exercise them through the same channels in Section 11, and you may appeal a refusal by replying to our decision email with “Appeal” in the subject line.
13. Do Not Track and Preference Signals
We honor the Global Privacy Control signal as described in Section 11. Because there is no settled standard for legacy “Do Not Track” browser signals, we do not respond to DNT, but GPC provides you a functioning equivalent.
14. Children
The Services are general-audience and not directed to children under thirteen. We do not knowingly collect personal information from children under thirteen. If you believe a child has provided personal information, contact [privacy@houseplantshop.com] and we will delete it.
15. Mobile Application
Our mobile app is built on the Vajro platform, which receives account and order data needed to operate the app. The app may use analytics tools including Firebase Analytics. Push notifications can be disabled in your device settings.
16. Changes to This Policy
We may update this Policy from time to time. We will post the revised Policy with a new “Last Updated” date, and for material changes we will provide additional notice, such as a site banner or email. The prior “Mobile App Privacy Policy” page is superseded by this Policy and should redirect here.
17. Contact
PPC International LLC, Attn: Privacy 20743 Future Farm Dr, Mount Dora FL 32757, USA info@houseplantshop.com