Privacy.

Dewze is operated by Fawz Holding LLC ("we", "us", "Fawz Holding LLC", "dewze"), a Wyoming limited liability company. We respect your privacy and aim to be plain-spoken about it. This policy explains what we collect, why and what you can do about it.

What we collect

When you visit

• Aggregated, anonymous traffic data such as page views, referrers, country and device type, via Cloudflare Web Analytics. No third-party cookies. No individual tracking.
• Strictly-necessary first-party cookies so your cart persists and checkout works. Listed in the Cookies section below.

When you buy

• Email, shipping address, phone number and contact info needed to fulfill the order.
• Payment information processed by Stripe. We never see or store your card number.
• Order history tied to your account or email.

When you sign up for emails

• Your email address and the source you signed up from (footer, popup, checkout).
• Optional: first name if you give it.

What we do not collect

• Your card number. Stripe holds that, not us.
• Behavioral profiles for advertising at this time. We use first-party data only.
• Anything we do not actively need to ship products or send emails you signed up for.

How we use it

• To ship your order and email you about it.
• To send marketing emails if you opted in. One-click unsubscribe in every email.
• To improve the site based on what people actually use.
• To comply with legal obligations including tax recordkeeping and adverse-event reporting required by the Modernization of Cosmetics Regulation Act of 2022.

Who we share with

• Stripe for payment processing.
• CJ Dropshipping and successor fulfillment partners for order fulfillment.
• Resend for transactional and marketing email delivery.
• Cloudflare for hosting, edge security and cookieless analytics.

We do not currently sell or share your personal information with advertising platforms. If we add server-side ad-network conversion tracking (such as Meta Conversions API or TikTok Events API) in the future, we will update this policy first, you will see the change here and you will be able to opt out via our Do Not Sell or Share My Personal Information page before any data leaves dewze.

Your rights

Whether you are in California, the EU, the UK or any US state with a privacy law (currently Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Tennessee, Nebraska, New Jersey, Minnesota, Maryland and Washington), you have rights over the personal information we hold about you.

• Access. Request a copy of everything we have on you, including the categories of personal information collected, sources, recipients and retention periods.
• Portability. Receive a copy in a structured, commonly used, machine-readable format.
• Correct. Fix anything inaccurate.
• Delete. Request we delete everything we hold on you. We will keep transactional and tax records for the period required by law (typically 7 years).
• Restrict processing. Tell us to stop using your information for specific purposes.
• Object. Object to processing based on our legitimate interests, including direct marketing.
• Opt out of sale or sharing. Tell us not to sell or share your personal information for cross-context behavioral advertising. See Do Not Sell or Share My Personal Information.
• Limit sensitive personal information. If we ever collect categories defined as "sensitive" under CPRA, you can limit our use of them. We do not currently collect sensitive personal information.
• Non-discrimination. We will not deny service, charge different prices or provide a different quality of product because you exercised a right.
• Authorized agent. You can designate someone to make requests on your behalf. We may require proof of authorization and verification of your identity.
• Appeal. If we deny a request, you can appeal by replying to our denial email within 60 days. We will respond within 60 days of receiving an appeal.
• Unsubscribe. One-click from any marketing email.

Email [email protected] with your request. We respond within 30 days for US state privacy laws and within 45 days for CPRA. We honor Global Privacy Control (GPC) browser signals automatically.

Legal bases (GDPR / UK GDPR)

If you are in the EU, UK or EEA, we process your personal information under one of these legal bases:

• Contract. To fulfill orders and provide customer service.
• Consent. For marketing emails you opted into. You can withdraw at any time.
• Legitimate interests. To run and improve the site, prevent fraud and secure our systems. You can object at any time.
• Legal obligation. Tax recordkeeping, MoCRA adverse-event reporting, responding to lawful government requests.

International transfers from the EU/UK/EEA to the US (where Cloudflare, Stripe, Resend and CJ Dropshipping are located) are made under the EU Standard Contractual Clauses or equivalent safeguards.

Cookies

We use only the cookies needed to make the site work. All are first-party and strictly necessary:

• cart remembers what you added. Persists for 14 days.
• session tracks your visit across pages. Expires when you close the browser.
• checkout ties your cart to the Stripe checkout session. Expires after the order completes.
• admin authenticates admin staff. Only set on /admin pages. Expires after 30 days.

We do not use third-party advertising cookies. We do not use Google Analytics or any cookie-based analytics. Cloudflare Web Analytics runs cookieless by design.

Data retention

• Active customer accounts: as long as the account exists.
• Order records: 7 years (US tax requirement).
• Adverse-event records: 6 years (MoCRA requirement).
• Email subscribers: until you unsubscribe.
• Analytics data: aggregated, no individual identifiers, retained by Cloudflare per their policy.

Children

Our products and site are intended for adults. We do not knowingly collect personal information from anyone under 13 (COPPA threshold) or sell or share personal information of anyone under 16 (CPRA threshold). If you are a parent and believe your child has shared data with us, email [email protected] and we will delete it.

State-specific notices

California (Shine the Light, CCPA, CPRA). California residents may request, once per year, a list of third parties to whom we disclosed personal information for their direct marketing purposes. We do not disclose personal information for third-party direct marketing.

Nevada (SB 220). Nevada residents may opt out of the sale of certain "covered information" for monetary consideration. We do not sell covered information.

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Tennessee. Residents have the appeal procedures and rights described in the "Your rights" section above.

Data breach

If we experience a breach affecting your personal information, we will notify you and applicable regulators in accordance with applicable law, typically within 72 hours of discovery.

Changes

If we update this policy, we will update the "Last updated" date at the top. Material changes will be announced on the site and emailed to active customers and our list at least 14 days before they take effect.

Contact

Privacy questions, requests or concerns: [email protected]

Postal mail: Fawz Holding LLC dba Dewze, 30 N Gould St, STE 49028, Sheridan, WY 82801, USA.