Privacy Policy
Table of Contents
- 1. Introduction & Scope
- 2. Information We Collect
- 3. How We Use Your Information
- 4. How We Share Your Information
- 5. Cookies & Tracking Technologies
- 6. Notice at Collection (CCPA/CPRA)
- 7. Your Privacy Rights
- 8. Data Retention
- 9. Data Security
- 10. Children's Privacy
- 11. Third-Party Links
- 12. Email Marketing & Communications
- 13. Changes to This Policy
- 14. Contact Information
1. Introduction & Scope
5th Tree LLC ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and otherwise process your personal information when you:
- Visit our website at 5thtree.com (our "Website")
- Make purchases from our physical store located at CambridgeSide Mall, Space E112, Boston, Massachusetts
- Communicate with us via email, phone, or other channels
- Interact with our social media pages or marketing communications
This Privacy Policy applies to all personal information we collect, regardless of how it is collected. By accessing our Website or doing business with us, you acknowledge that you have read and understood this Privacy Policy.
If you do not agree with our privacy practices, please do not use our Website or provide us with your information.
2. Information We Collect
We collect information about you from various sources to provide you with a better shopping experience and to fulfill your orders. The categories of information we collect include:
2.1 Personal Information You Provide Directly
When you interact with us, you may choose to provide personal information, including:
- Contact Information: Name, email address, phone number, and physical address (including billing and shipping addresses)
- Account Information: Username, password, and account preferences if you create an account on our Website
- Order Information: Details about products you purchase, quantities, prices, and order history
- Communications: Messages you send to us, including customer service inquiries, feedback, reviews, and testimonials
- Payment Information: We do NOT store your credit card or payment card information directly. Payment information is securely processed through Shopify Payments and PCI-DSS compliant payment processors
- Demographic Information: Age, gender, preferences, and other information you voluntarily provide
2.2 Automatically Collected Information
When you visit our Website or interact with our online services, we automatically collect certain information, including:
- Device Information: Device type, operating system, browser type and version, device identifiers, and mobile network information
- Log Information: IP address, pages visited, time and date of access, referring URL, search terms, and click-through data
- Location Information: General location based on IP address (we do not collect precise GPS location without consent)
- Cookies & Similar Technologies: Information collected through cookies, pixels, local storage, and similar tracking technologies (see Section 5)
- Behavioral Information: Pages viewed, products browsed, time spent on pages, and interactions with our Website
2.3 Information from Third Parties
We may receive information about you from:
- Payment Processors: Transaction information from Shopify Payments and other payment service providers
- Shipping Carriers: Delivery and tracking information from UPS, FedEx, USPS, and other shipping partners
- Analytics Providers: Information about your interactions with our Website from Google Analytics
- Marketing Partners: Information from email marketing platforms and social media platforms
- Public Sources: Information from publicly available sources for verification and fraud prevention purposes
- In-Store Customers: Information you provide when shopping at our physical store location
2.4 Aggregated & De-Identified Information
We may collect, use, and share aggregated or de-identified information that cannot reasonably be used to identify you. This includes statistical and analytical data about customer behavior, website usage patterns, and product preferences.
3. How We Use Your Information
We use the information we collect for various business and operational purposes:
3.1 Order Fulfillment & Service Delivery
- Processing and fulfilling your orders
- Sending order confirmations, shipping updates, and delivery notifications
- Managing returns, refunds, and customer service requests
- Verifying your identity and preventing fraud
- Maintaining accurate inventory and product availability information
3.2 Customer Communication
- Responding to your inquiries and customer service requests
- Sending transactional emails related to your account and orders
- Notifying you of changes to our policies, terms, or service
- Conducting surveys, collecting feedback, and gathering customer insights
3.3 Marketing & Promotional Activities
- Sending promotional emails, newsletters, and marketing communications (with your consent)
- Creating targeted advertising campaigns and personalized offers
- Conducting market research and analyzing customer preferences
- Building and maintaining customer loyalty programs
- Retargeting advertisements across other websites and platforms
3.4 Website Optimization & Analytics
- Analyzing Website traffic, user behavior, and engagement metrics
- Improving Website functionality, user experience, and design
- Conducting A/B testing and other analytical activities
- Measuring the effectiveness of marketing campaigns
- Troubleshooting technical issues and maintaining Website security
3.5 Legal Compliance & Fraud Prevention
- Complying with applicable laws, regulations, and legal obligations
- Detecting, preventing, and addressing fraud, abuse, and security incidents
- Enforcing our Terms of Service and other agreements
- Protecting our rights, privacy, safety, or property
- Responding to lawful requests from government authorities
3.6 Legal Basis for Processing (GDPR/CCPA Compliance)
Our processing of your personal information is based on:
- Contract: Performance of our contractual obligations to you
- Consent: Your explicit consent for specific uses (e.g., marketing emails)
- Legitimate Interest: Our legitimate business interests, including fraud prevention, Website optimization, and customer service
- Legal Obligation: Compliance with applicable laws and regulations
6. Notice at Collection (CCPA/CPRA)
This section applies to California residents and complies with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
6.1 Categories of Personal Information Collected
In the 12 months preceding this notice, we have collected the following categories of personal information:
| Category | Examples | Source | Purpose |
|---|---|---|---|
| Identifiers | Name, email, phone, address, account username, IP address | Directly from consumer, automated | Order fulfillment, customer service, fraud prevention |
| Commercial Information | Purchase history, product preferences, spending patterns | Directly from consumer, automatically collected | Marketing, analytics, order processing |
| Biometric Information | None currently collected | N/A | N/A |
| Internet Activity | Browser history, pages visited, search queries, time spent on site | Automatically collected via cookies/analytics | Website optimization, marketing, analytics |
| Geolocation Data | City, state, country level location (IP-based) | Automatically collected | Analytics, fraud prevention, localized content |
| Professional Information | Job title, company name (if provided) | Directly from consumer | Customer communication |
| Education Information | None typically collected | N/A | N/A |
| Inferences | Preferences, interests, shopping behavior, likely demographics | Derived from collected data | Targeted advertising, personalization |
6.2 Purposes for Collection & Use
We collect personal information for the following purposes:
- Performing services and fulfilling orders
- Providing customer service and support
- Marketing and advertising (with consent/opt-out available)
- Analytics and Website optimization
- Fraud prevention and security
- Legal compliance and enforcement
- Business operations and improvements
- Responding to consumer requests and inquiries
6.3 Data Retention
We retain personal information for as long as necessary to fulfill the purposes for which it was collected, or as required by law:
- Account Information: Retained while account is active, plus 3-5 years for legal and tax purposes
- Order Information: Retained for at least 7 years (for tax and legal compliance)
- Marketing Data: Retained until opt-out or account deletion
- Analytics Data: Typically aggregated and anonymized
- Payment Information: Not stored directly; retained by payment processors per their policies
6.4 "Do Not Sell or Share My Personal Information"
Right to Opt-Out: California residents have the right to direct us not to sell or share their personal information.
What Constitutes "Sale" or "Sharing" Under CCPA/CPRA: "Selling" includes sharing personal information with third parties for monetary compensation. "Sharing" includes sharing for cross-context behavioral advertising purposes. This may include:
- Sharing information with marketing partners for targeted advertising
- Using pixel tracking and cookies for retargeting
- Sharing data with analytics providers
- Sharing with advertising networks
How to Opt-Out of Sale/Sharing:
- Click the "Do Not Sell or Share My Personal Information" link at the bottom of our homepage
- Complete the opt-out form with your email address
- We will honor your request within 45 days
- Your opt-out will be valid for 12 months, after which you may need to renew it
6.5 Shine the Light Request (California Civil Code § 1798.83)
California residents may request information about personal information we disclose to third parties for their direct marketing purposes. To make this request, please contact us using the information in Section 14.
7. Your Privacy Rights
We respect your privacy rights and provide mechanisms for you to exercise them. The rights available depend on your location and applicable laws.
7.1 Massachusetts Residents' Rights
Massachusetts Standards for Safeguarding Consumer Information (201 CMR 17.00):
As a Massachusetts resident, you have the right to:
- Right to Notice: Clear notice of our data practices (this Privacy Policy)
- Right to Access: Know what personal information we hold about you
- Right to Correct: Correct inaccurate information
- Right to Data Security: Expect reasonable security measures to protect your data
- Right to Notification: Be notified in case of a data breach affecting your information
- Right to Opt-Out of Marketing: Opt-out of promotional communications
7.2 California Residents' Rights (CCPA/CPRA)
California Consumer Privacy Act (CCPA) & California Privacy Rights Act (CPRA):
Right to Know
You have the right to request what personal information we collect, use, share, and sell about you. You may request:
- The specific pieces of personal information we have collected
- The categories of sources from which information was collected
- The purposes for collection and use
- The categories of third parties with whom we share information
Right to Delete
You have the right to request deletion of personal information we have collected, subject to certain exceptions:
- Information necessary to complete a transaction
- Information required for fraud detection and security
- Information needed for legal compliance
- Information required for internal uses reasonably aligned with your expectations
Right to Correct
You may request correction of inaccurate personal information we maintain about you.
Right to Opt-Out of Sales/Sharing
You may request that we do not sell or share your personal information (see Section 6.4).
Right to Limit Use and Disclosure
You may limit our use of sensitive personal information (such as Social Security Number, financial account information) to necessary business purposes.
Right to Non-Discrimination
We will not discriminate against you for exercising your CCPA/CPRA rights. We will not:
- Deny you goods or services
- Charge different prices or rates
- Provide a different level of service
- Suggest that exercising rights will result in different treatment
7.3 How to Exercise Your Rights
To exercise any of your privacy rights, please submit a request to:
Mail: 5th Tree LLC, CambridgeSide Mall, Space E112, Boston, MA
Subject Line: "Privacy Rights Request"
7.4 Request Verification
To protect your privacy and security, we may require verification of your identity before processing your request. This may include:
- Email address matching our records
- Confirmation of purchase history or account details
- Government-issued ID (for California residents under CCPA)
- Verification through account login
7.5 Authorized Agents
If you use an authorized agent to submit a request on your behalf, the agent must provide:
- Written authorization to act on your behalf
- Their own identification and verification
- Power of attorney or similar legal document
7.6 Response Timeline
We aim to respond to all privacy rights requests within the timeframes required by law:
- Massachusetts: Reasonable timeframe (typically 30-45 days)
- California (CCPA/CPRA): Within 45 days (may extend by additional 45 days if needed)
7.7 Right to Appeal
If we deny your request, you may have the right to appeal. We will provide information about appeal procedures in our denial response.
8. Data Retention
We retain personal information for as long as necessary to fulfill the purposes for which it was collected or as required by law. Our retention practices are as follows:
| Data Type | Retention Period | Reason |
|---|---|---|
| Customer Account Information | While account is active + 3-5 years | Service provision, tax/legal compliance |
| Order History & Transaction Records | Minimum 7 years | Tax purposes, warranty claims, disputes |
| Payment Information | Not stored directly; per processor policy | PCI-DSS compliance, fraud prevention |
| Shipping & Delivery Information | 1-2 years | Dispute resolution, claim handling |
| Marketing & Preference Data | Until opt-out or deletion request | Service delivery, legal opt-out compliance |
| Website Analytics Data | Typically 12-26 months | Analytics, website optimization |
| Email Communications | 1-3 years | Customer service, dispute resolution |
| Cookies & Tracking Data | Session to 24 months depending on type | Website functionality, analytics, marketing |
| Customer Service Inquiries | 2-3 years | Support history, dispute resolution |
8.1 Deletion of Retained Data
When data is no longer needed, we securely delete or anonymize it according to our data retention schedule. If you request deletion of your personal information (subject to legal exceptions), we will honor your request in accordance with applicable laws.
8.2 Backup & Archive Data
Information may be retained in backup or archive systems longer than specified above for disaster recovery, legal hold, or archival purposes. We will maintain appropriate security for all archived data.
9. Data Security
We take the security of your personal information seriously and implement reasonable technical, administrative, and physical safeguards to protect it from unauthorized access, alteration, disclosure, and destruction.
9.1 Security Measures
- Encryption: Data in transit is encrypted using SSL/TLS technology (HTTPS)
- Payment Security: Payment information is processed through PCI-DSS Level 1 compliant processors (Shopify Payments)
- Access Controls: Restricted access to personal information on need-to-know basis
- Authentication: Password protection and two-factor authentication options for accounts
- Monitoring: Regular security audits and vulnerability assessments
- Data Minimization: We collect only the personal information necessary for stated purposes
- Employee Training: Staff training on data protection and privacy practices
9.2 Limitations on Security
While we implement robust security measures, no security system is completely impenetrable. We cannot guarantee absolute security of your information. Please:
- Use a strong, unique password for your account
- Do not share your login credentials
- Monitor your account regularly for unauthorized activity
- Report security concerns to us immediately
9.3 Data Breach Notification
In the event of a data breach that compromises your personal information, we will notify you in accordance with Massachusetts law and other applicable regulations. Notification will be made without unreasonable delay and will include:
- Description of what information was affected
- Steps you should take to protect yourself
- Our contact information for additional information
- Information about available remedies and free monitoring services
9.4 Third-Party Security Practices
We are not responsible for the security practices of third-party service providers. We require all service providers to maintain appropriate security measures through contractual obligations. Please review the privacy policies of third parties (such as Shopify, payment processors, and analytics providers) for details about their security practices.
9.5 Additional Information About Our Security Practices
For more detailed information about our security measures and practices, please see our Security Practices page (or contact us for more information).
10. Children's Privacy
Our Website and services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe we have collected information from a child under 13, please contact us immediately.
10.1 Children's Online Privacy Protection Act (COPPA) Compliance
We comply with the Children's Online Privacy Protection Act (COPPA), which protects the online privacy of children under 13. We:
- Do not knowingly collect personal information from children under 13
- Do not use cookies or tracking technologies that are not essential for Website operation with children under 13
- Do not market to children under 13 without verifiable parental consent
- Do not request sensitive information from children (SSN, financial information, etc.)
10.2 Teens & Young Adults (13-18)
For users under 18 years old, we:
- Limit collection of personal information to what is necessary for service provision
- Provide age-appropriate privacy notices
- Require parental consent for marketing communications
- Implement additional safeguards for minors' data
10.3 Parental Involvement
Parents and guardians who believe their child has provided information to us should contact us at 5thtreebazaar@gmail.com. We will take steps to verify parental authority and promptly delete information about minors upon request.
10.4 In-Store Purchases
When children under 18 make purchases at our physical store location, we may collect minimal information (name, purchase details) as necessary for transaction processing. Parents/guardians have the right to request access to or deletion of this information.
11. Third-Party Links
Our Website may contain links to third-party websites, mobile applications, and online services (including social media platforms, retailers, and service providers). This Privacy Policy applies only to information collected through our Website.
11.1 No Control Over Third-Party Practices
We are not responsible for the privacy practices of third-party websites or services. When you click on a link to a third-party site, you leave our Website and your data is governed by that third party's privacy policy. We encourage you to:
- Review the privacy policies of third-party sites before providing information
- Understand how third parties use cookies and tracking technologies
- Check their data collection and security practices
11.2 Social Media & Third-Party Platforms
If you connect your account to social media platforms (Facebook, Instagram, etc.) or use social login features, those platforms collect and process your information according to their privacy policies. We are not responsible for their practices. Review their privacy policies directly:
11.3 Third-Party Widgets & Embeds
Our Website may contain embedded content (videos, reviews, social media widgets, etc.) from third parties. These third parties may collect information about your interactions with their content. Check their privacy policies for details.
11.4 Affiliate Links & Referral Programs
If we use affiliate links or referral programs, clicking these links may place cookies from third parties on your device. We are not responsible for affiliate partners' data practices.
12. Email Marketing & Communications
We may send you email communications including transactional emails (order confirmations, shipping updates) and marketing emails (promotions, newsletters, product recommendations).
12.1 Transactional Emails
We automatically send transactional emails related to your orders and account, including:
- Order confirmations and receipts
- Shipping and delivery notifications
- Password reset and account security alerts
- Customer service responses
- Policy updates and important notices
You cannot opt-out of transactional emails as they are necessary for account management and legal compliance. However, you can manage your account preferences to update contact information.
12.2 Marketing & Promotional Emails
We send promotional emails only with your explicit consent (opt-in). Marketing emails may include:
- Special offers, discounts, and sales announcements
- New product launches and announcements
- Newsletter content and company updates
- Personalized product recommendations
- Events and promotions
You have the right to opt-out of marketing emails at any time.
12.3 How to Unsubscribe from Marketing Emails
You can opt-out of marketing communications in several ways:
- Click the "Unsubscribe" link at the bottom of any marketing email
- Log in to your account and update email preferences
- Contact us at 5thtreebazaar@gmail.com with "Unsubscribe" in the subject line
Please allow up to 10 business days for your unsubscribe request to take effect. Note that unsubscribing from marketing communications will not affect transactional emails.
12.4 Email Management & Segmentation
We may segment our marketing lists based on:
- Purchase history and product interests
- Geographic location
- Email engagement history
- Account preferences
This allows us to send more relevant emails. You can update your preferences in your account settings.
12.5 Email Frequency
We aim to send promotional emails no more than 2-3 times per month, but frequency may vary based on promotions and season. You can adjust frequency preferences if available in your account settings.
12.6 Email Analysis & Tracking
Marketing emails may include tracking pixels that allow us to see:
- Whether the email was opened
- Links clicked in the email
- Device type used to view email
- Approximate location (city/state)
This information helps us improve email content and measure campaign effectiveness. You can disable pixel tracking by blocking images in your email client.
12.7 CAN-SPAM Compliance
All marketing emails comply with the CAN-SPAM Act, which requires us to:
- Include accurate header and "From" information
- Use clear subject lines that accurately describe content
- Include our physical business address
- Include a clear unsubscribe option
- Honor unsubscribe requests within 10 business days
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Changes will be effective when posted to our Website.
13.1 How We Notify You
If we make material changes to this Privacy Policy, we will:
- Post the updated policy on our Website with a new "Last Updated" date
- Send email notification to registered users of material changes
- Require opt-in consent for material changes affecting your rights (where required by law)
13.2 Your Responsibility
It is your responsibility to review this Privacy Policy regularly for updates. Your continued use of our Website or services after changes are posted constitutes your acceptance of the updated policy.
13.3 Previous Versions
If you would like to view a previous version of this Privacy Policy, please contact us at 5thtreebazaar@gmail.com. We may maintain archived versions of our policies.
14. Contact Information & How to Exercise Your Rights
If you have questions about this Privacy Policy, our privacy practices, or wish to exercise any of your privacy rights, please contact us:
5th Tree LLC
Physical Address:
CambridgeSide Mall, Space E112
Boston, Massachusetts
United States
Email Address:
5thtreebazaar@gmail.com
Website:
https://5thtree.com
For Privacy Requests:
Please include "Privacy Request" or "CCPA Request" in your subject line. Include the type of request (access, deletion, opt-out, etc.) and your email address or account information.
Response Time:
We aim to respond to all inquiries within 30 days. California residents will receive responses within 45 days as required by law.
14.1 California Residents - Additional Contact Information
California Attorney General (Regarding Privacy Matters):
California Department of Justice
Office of the Attorney General
https://oag.ca.gov/privacy
14.2 Massachusetts Residents - Additional Contact Information
Massachusetts Attorney General (Regarding Data Protection):
Massachusetts Office of the Attorney General
Consumer Protection Division
https://www.mass.gov/orgs/massachusetts-attorney-general
14.3 Right to File a Complaint
If you believe we have violated your privacy rights, you have the right to:
- Contact us directly to resolve the issue (Section 14)
- File a complaint with your state's attorney general or privacy authority
- Contact the FTC (Federal Trade Commission) at https://reportfraud.ftc.gov
14.4 CCPA/CPRA - "Do Not Sell or Share My Personal Information"
To exercise your right to opt-out of the sale or sharing of personal information:
- Locate the "Do Not Sell or Share My Personal Information" link on the bottom of our homepage
- Click the link to open the opt-out form
- Enter your email address and any other requested information
- Submit the form
- You will receive confirmation of your opt-out request
Opt-out requests are valid for 12 months. You can submit a new request after 12 months to extend your opt-out choice.
Last Updated: March 1, 2026
Effective Date: March 1, 2026
© 2024-2026 5th Tree LLC. All rights reserved.