Privacy policy

Last Updated: 06/27/2025

Introduction

Hyku Home Inc. dba Canopy, along with its parent and affiliated entities (“Canopy,” "us," or "we"), has adopted this Privacy Policy to reflect our commitment to protecting your privacy and to inform you of our policies and practices regarding the collection, use, and disclosure of any Personal Information we may collect. This Privacy Policy is incorporated in and part of the Terms of Service for our Website. We take the collection of Personal Information from our consumers seriously and are committed to protecting your Personal Information in accordance with this Privacy Policy. Please read below to learn how we collect, use, and disclose Personal Information.

Canopy only seeks to collect Personal Information as necessary to provide the products and services that you request from us and as otherwise disclosed in this Privacy Policy. Our Personal Information collection practices are focused so that we are only collecting and using your Personal Information to provide value to you. This Privacy Policy has been prepared to give you clear notice of:

the categories of Personal Information collected and processed,
the purposes for that processing,
whether we have shared or sold your Personal Information to any third parties, and,
if you are a resident of a state or country that provides you with additional privacy rights, information about those rights and how to exercise them.

For states and countries where you may have additional privacy rights, please see the corresponding portion of the section titled “Your Privacy Rights and Choices.”

If you have any questions that aren’t answered in this Privacy Policy, you can always contact us at [email protected] or by using the other contact information provided in the “Contact Us” section below.

IF YOU DO NOT AGREE TO THE TERMS OF THIS PRIVACY POLICY, INCLUDING THE TERM AND CONDITIONS FOR OUR WEBSITE IN WHICH THIS PRIVACY POLICY IS INCORPORATED, YOU MUST NOTE USE THE WEBSITES AND MUST NOT SUBMIT ANY INFORMATION THROUGH THE SERVICES. BY SUBMITTING INFORMATION THROUGH THE SERVICES (AS DEFINED BELOW), INCLUDING ANY PERSONAL INFORMATION, YOU ACKNOWLEDGE AND AGREE THAT WE MAY PROCESS YOUR PERSONAL INFORMATION AS DESCRIBED IN THIS PRIVACY POLICY.

Where This Privacy Policy Applies

This Privacy Policy applies to your use of getcanopy.co/(the “Website”), including any interactions on the website; (b) your participation in the Canopy mobile messaging service, if you opt-in; (c) your participation in Canopy’s Affiliate Program, Ambassador Program, Hairstylist Pro Program, and other similar programs made available by Canopy from time to time, if you are invited and opt-in; and, (d) sweepstakes, contests, promotions, and, consumer satisfaction surveys (each, a “Service” and collectively the “Services”). For more information, please see the “Personal Information Collected Via Technology” and “Links To Other Sites” sections below.

If a particular service provided by or on behalf of Canopy refers to or links to a different privacy policy, then that privacy policy applies. We encourage you to review the privacy policies and terms and conditions of use for all third-party services or links provided by or on behalf of Canopy.

Contents of this Notice

Section	What can you find there?
The Types of Information We Collect	This section describes the categories and examples of Personal Information that Canopy collects from you, as well as the categories of data subjects to which the collection practices apply. We also describe information that does not constitute Personal Information that may be collected by Canopy, including publicly available information, deidentified or aggregated consumer information, or information that is excluded from the scope of applicable privacy laws.
Personal Information Collected Via Technology	Our Website and Services use automated collection technologies, such as cookies and invisible pixels, to collect Personal Information from you. This section describes what automated collection technologies are used, the purposes of that collection, and how you can manage the use of automated collection technologies.
How We Use Your Personal Information	Read this section to learn more about how Canopy uses your Personal Information. This section also describes how you can opt-out of direct marketing emails, how we handle automated decision making, and our practices with respect to deidentified information.
How We Share Your Personal Information	This section describes Canopy’s practices with respect to the sharing of your Personal Information to third parties, including the categories of third-party recipients in connection with disclosures for business purposes or sales of Personal Information. Read this section to learn more about our Personal Information sharing practices for the prior 12 months. We share Personal Information with our affiliates, service providers (including social media websites, payment processors, ordering and delivery service providers, and website analytics providers), contractors, and as otherwise described in this Privacy Policy in order to provide you with products and services, when necessary for our service providers or contractors to provide services to us, or for the other reasons listed in this section.
Sales of Personal Information	The section describes Canopy’s sales of Personal Information for the prior 12 months. Some states interpret the sharing of personal information with third party service providers for online advertising may be considered a “sale” of information. Except for this kind of sharing, Canopy does not sell your personal information and does not receive monetary compensation or other financial benefits from any sharing we engage in.
Additional Legal Notices	We have created this section to provide you with additional notices about our privacy practices, including notices about the security measures we take to protect your Personal Information, how we handle Personal Information for children under the age of 16, links to other websites that might be available through our Website, and how we notify you regarding updates to our Privacy Policy.
Your Privacy Rights and Choices	This section only applies to the residents of the states that give additional privacy rights. As of the date this Privacy Policy was posted, that includes California, Texas, Nebraska, and Nevada. In this section, you can learn more about those privacy rights and the options Canopy has made available for you to exercise those rights.
Contact Us	If you would like to contact us with any questions regarding our Privacy Policy or privacy practices, you can find our contact information here. If you live in a state or country that gives you additional privacy rights, you can find out more information about exercising those rights in the corresponding portion of the section titled “Your Privacy Rights and Choices.”

The Types of Information We Collect

We collect information that identifies, relates to, is reasonably capable of being associated with a particular living person or household (“Personal Information”). Privacy laws around the world describe Personal Information using a number of different terms, including personal data and personally identifiable information. For the purposes of this Privacy Policy, we use the term Personal Information with the intention that it be interpreted to mean the same thing as these other terms. If there is a specific type of Personal Information that has its own definition, we will provide that definition and use that name specifically (such as Sensitive Personal Information).

Various privacy laws exclude certain types of information from the respective definitions of Personal Information. For your awareness, Personal Information does not include:

Publicly available information from government records;
Deidentified or aggregated consumer information; or,
Information excluded from the scope of applicable privacy laws (including the CCPA and GDPR), like:
- health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
- Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

The privacy laws also refer to the individuals or households from which Personal Information is collected a number of ways, including as data subjects or consumers. We use the term “consumer” in this Privacy Policy to avoid using unnecessarily abstract terms, but that term, as we use it, has the same meaning as the term “data subject” and includes customers and, where applicable, job applicants and our business-to-business contacts. Please note that if you are an employee of Canopy, or their dependent or emergency contact, a separate privacy policy applies to you and is available through Canopy’s human resources information systems. If you do not have access to those systems, please contact us for assistance by using the information in the “Contact Us” section below.

We have chosen to disclose this information broadly so that all of Canopy’s consumers are aware of our privacy practices, however, subject to the law where you reside, only certain categories of consumers may be able to exercise the rights described in the “Your Privacy Rights and Choices” section below.

The below chart contains a category of Personal Information labelled “Sensitive Personal Information.” Under the applicable privacy laws, Sensitive Personal Information means Personal Information that reveals: (1) a consumer’s social security, driver’s license, state identification card, or passport number; (2) a consumer’s account log-in, financial information, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (3) a consumer’s precise geolocation (within a circle with a radius of 1,750 or less); (4) a consumer’s racial or ethnic origin, religious of philosophical beliefs, or union membership; (5) the contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication; or, (6) a consumer’s genetic data. Sensitive Personal Information also include: (a) the processing of biometric information for the purpose of uniquely identifying a consumer; (b) Personal Information collected and analyzed concerning a consumer’s health (mental or physical); and, (c) Personal Information collected and analyzed concerning a consumer’s sex life or sexual orientation. In Texas and Nebraska, Sensitive Personal Information also includes Personal Information collected from a known child younger than 13 years of age and information related to a consumer’s citizenship or immigration status.

Regardless of what state you live in that regulates the collection and use of Sensitive Personal Information, Canopy does not use the types of information listed in the “Sensitive Personal Information” definition, above, to develop inferences about you.

In particular, in the prior 12 months we have collected the following categories of Personal Information from the listed categories of consumers:

Category of Personal Information	Examples	Sources of Information	Types of Consumers Affected
Identifiers	First and last name (or initials), postal address, Internet Protocol (IP) address, email address, phone number, account name, payment information, Social Security Number, or other similar identifiers	Directly from you From third parties on your behalf, such as when they provide your name and email to refer you for a job Indirectly from you, such as through automated collection technologies From service providers or contractors, such as social media sites, payment processors, ordering and delivery service providers, advertising networks, and analytics companies or from the service provider or contractor when the consumer is an employee or contractor of a service provider being engaged by Canopy From publicly available sources, such as public records and social media sites	Website users Customers Job applicants Contractors (and their employees) Service providers (and their employees)
Personal Information under California Civil Code Section 1798.80(e)	Name, signature, Social Security Number, address, telephone number, bank account name and number, other financial information, and other information described under this law Note that some Personal Information described in this category overlaps with other categories.	Directly from you From service providers or contractors, such as payment processors, ordering and delivery service providers, advertising networks, and analytics companies or from the service provider or contractor when the consumer is an employee or contractor of a service provider being engaged by Canopy From publicly available sources, such as public records and social media sites	Website users (if you provide this information to us) Customers (if you provide this information to us) Job applicants Contractors (and their employees) Service providers (and their employees)
Protected Classification Characteristics	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information)	Directly from you From service providers or contractors, such as background check companies or from the service provider or contractor when the consumer is an employee or contractor of a service provider being engaged by Canopy	Job applicants Contractors (and their employees) Service providers (and their employees)
Commercial Information	Records of products or services purchased or considered, or other purchasing history or tendencies	Directly from you Indirectly from you, such as through automated collection technologies From service providers or contractors, such as such as payment processors, ordering and delivery service providers, advertising networks, and analytics companies	Customers
Biometric Information	Genetic, physiological, behavioral, and biological characteristics, or other activity patterns used to extract a template or other identifier such as fingerprints	We do not collect this data from consumers.	None.
Internet or Other Similar Network Activity	Browsing history, search history, information on a consumer’s interaction with the Website, Canopy’s mobile messaging service (if you opt in), or advertisements	Indirectly from you, such as through automated collection technologies From service providers or contractors, such as social media sites, advertising networks, and analytics companies Internet service providers Mobile phone and text messaging service providers	Website users Customers Job applicants
Geolocation Data	Physical location or movements	Directly from you Indirectly from you, such as through automated collection technologies From service providers or contractors, such as social media sites, advertising networks, and analytics companies or from the service provider or contractor when the consumer is an employee or contractor of a service provider being engaged by Canopy (if permitted or required by applicable contract) From publicly available sources, such as public records and social media sites	Website users Customers Contractors (and their employees) if permitted or required by applicable contract Service providers (and their employees) if permitted or required by applicable contract
Sensory Data	Audio, electronic, visual, thermal, olfactory, or similar information including COVID-19 related temperature checks, call monitoring, and video surveillance	We do not collect this data from consumers.	None.
Professional or Employment-Related Information	Current or past job history or performance evaluations	Directly from you From service providers or contractors, including background check providers or from the service provider or contractor when the consumer is an employee or contractor of a service provider being engaged by Canopy From publicly available sources, such as social media sites	Job applicants Contractors (and their employees) Service providers (and their employees)
Non-Public Education Information	Education records related to a student maintained by an educational institution or a party action on its behalf, such as grades, transcripts, class lists, schedules, financial information, or disciplinary records	We do not collect this data from consumers.	None.
Inferences	Profile information reflecting a consumer’s preferences, characteristics, behavior, attitudes, or other similar information	We generate this information internally From service providers or contractors, such as analytics companies or background check providers	Website users Customers Job applicants Contractors (and their employees) Service providers (and their employees)
Sensitive Personal Information	Social Security Number, driver’s license, state identification card, or passport number, racial or ethnic origin, union membership, information related to a consumer’s citizenship or immigration status	Directly from you From service providers or contractors, such as background check providers or from the service provider or contractor when the consumer is an employee or contractor of a service provider being engaged by Canopy We do not use this information to draw Inferences.	Job applicants Contractors (and their employees) Service providers (and their employees)

Please note that there are places on our Website where a third party can provide your Personal Information (or you can provide a third party’s Personal Information), such as through the “Get a Free Filter” link which allows you to refer a friend through a website operated by a trusted third-party service provider. If you provide a third party’s Personal Information through the use of these features, you are making a representation that you have that third party’s permission to provide their Personal Information and that they have agreed to the terms of this Privacy Policy. Where such features are made available, Canopy will only use that information for the purpose for which it is given and does not otherwise store or use that information.

Personal Information Collected Via Technology

When you visit the Canopy Website, including our web forms, we and our service providers acting on our behalf automatically collect certain information using tracking technologies like cookies, web beacons, and similar technologies. We use this information to understand how visitors to our websites use them and which pages and features of the websites are most popular. This helps us understand how we can improve our websites and track performance of our advertisements and marketing emails that are sent to you. In addition, we use tracking technologies to help improve the navigation experience on the Website.

A cookie is a piece of data contained in a very small text file that is stored in your browser or elsewhere on your hard drive. Cookies allow us to identify your device as you navigate our websites or your account. This makes navigating and interacting with our websites or your account more efficient, easy, and meaningful for you.

By themselves, cookies do not identify you specifically. Rather, they recognize your web browser. So, unless you identify yourself specifically to Canopy, such as by signing into your account, we do not know who you are just because you visited our website. We use both session and persistent cookies. Session cookies are cookies that disappear from your computer or browser when you turn off your computer. Persistent cookies stay on your computer even after you have turned it off. Additionally, the cookies on our websites fall into five categories: (1) Strictly Necessary Cookies, (2) Functional Cookies, (3) Performance Cookies, (4) Social Media Cookies, and (5) Targeting Cookies. To learn more about each category of cookie, you can visit our cookie consent tool by clicking on the “Cookie Preferences” link on cookie banner for the Website you are visiting. If you have already selected your cookie preferences, you can clear cookies through your browser and revisit the Website, which will cause the cookie banner to reappear. You can also manage your cookie preferences by clicking the green “Manage Allowed Cookies” button in the lower lefthand corner of our Website.

In addition to cookies, Canopy uses "pixels" to enable certain cookies or advertisements on the Website and to track the number of times a link or advertisement is served on a webpage. A pixel is a tiny image that is loaded when you visit our Website or open our marketing emails, but instead of calling up an image, it causes a cookie or application to be downloaded. Pixels can be used to track user activities, track the number of times a user has viewed a particular link or advertisement, track and optimize website traffic, display advertisements, keep track of advertising commissions, and otherwise collect data for online marketing and website analysis. As with cookies, our Website utilize both session pixels and persistent pixels.

We also use cookies and tracking/marketing pixels for four general purposes: (1) to ensure the functionality, optimization, and ease of use of our Website; (2) to ensure and maintain the security of our Website; (3) to collect anonymous, statistical data regarding how visitors interact with the Website; and, (4) for marketing purposes. We also utilize the tools available through Google Analytics in order to monitor site flow and statistical data regarding our Website users.

The cookies that we use for functionality and security purposes are considered Functional or Strictly Necessary cookies, without which the Site would not function properly. These cookies allow some of the basic functions of our Website to work properly, such as remembering your preferences as you navigate the Website. In addition, these cookies help us secure the Website by preventing cross-site request forgery attacks and by throttling excessive request rates.

We also use cookies to collect statistical information regarding how visitors interact with our Website and to track repeat visits to our Website. While these cookies collect information regarding how you use our Website in order to help us understand site flow and improve our website, all such statistical data is anonymous and does not personally identify you. These types of cookies are Performance Cookies.

Finally, we use both cookies and pixels on our Website for marketing purposes, including: to check whether your browser supports the use of cookies, to deliver general advertisements from third party advertisers, to present targeted advertisements to particular Website visitors, to track the particular advertisements that have been displayed to you, to collect data regarding how you interact with YouTube videos across different websites, to track your browser activity across devices and marketing channels, to track the actions you take after viewing an advertisement in order to measure the efficacy of the advertisement, and to display particular advertisements in order to re-engage visitors that are likely to convert to customers based on those visitors’ online behavior across websites. These types of cookies are either Social Media or Targeting Cookies.

Specifically, the automated collection technologies that Canopy currently uses include the following:

Cookie Name	Function
Strictly Necessary Cookies
_ab	Used in connection with access to admin.
_secure_session_id	Used in connection with navigation through a storefront.
cart	Used in connection with shopping cart.
cart_sig	Used in connection with checkout.
cart_ts	Used in connection with checkout.
checkout_token	Used in connection with checkout.
secret	Used in connection with checkout.
secure_customer_sig	Used in connection with customer login.
storefront_digest	Used in connection with customer login.
_shopify_u	Used to facilitate updating customer account information.
locale or shopify_country	Used to store user preferences like language and region.

Performance Cookies





Targeting Cookies





Social Media Cookies

Depending on where you live, our Website may place cookies on your devices after you have interacted with the cookie banner made available on the Website you are visiting. In some regions, you will be required to opt-in to use of cookies by our Website, with the exception of Strictly Necessary Cookies, which are always in use and are required for our Website to operate. In other regions, you will have the option to opt out of the use of cookies by our Website (except with respect to Strictly Necessary Cookies, which are required for our Website to operate). Regardless of where you reside, you have the option to manage the cookies we use in connection with the Website through the cookie consent settings and preferences centers made available to you on the Website. If you have previously accepted cookies but wish to change that preference, you will need to clear your browser’s cookies before revisiting the website and making a new selection about the types of allowed cookies. Using the preference centers to manage cookies without clearing the saved cookies through your browser settings will stop new cookies from downloading to your device in accordance with your preference election, but it will not delete any cookies that have previously been downloaded. You need to take the step to delete your cookies because they are downloaded to your browser or device and our Website and the cookie banners on them do not have the ability to perform those deletions on your behalf. If you want to accept more types of cookies, you can simply interact with the cookie preference center without a need to clear the preexisting saved cookies. If you have previously interacted with the cookie banner and made an election about your cookie preferences, you will not see the cookie banner again until the permissions expire with respect to the accepted cookies.

You can use your browser settings to opt out of most categories of cookies, with the exception of Strictly Necessary Cookies. Some browsers allow a “do not track” (DNT) setting that requests that a web application disable its tracking of an individual user. When you choose to turn on the DNT setting in your browser, your browser will send a special signal to websites, analytics companies, ad networks, plug-in providers, and other web services you encounter while browsing and stop tracking your activity. To set up DNT, you can visit the All About DNT page. Please note that this may impact the functionality of our Website or your account.

You can opt out of targeted advertising by:

Facebook - https://www.facebook.com/settings/?tab=ads
Google - https://www.google.com/settings/ads/anonymous
Bing - https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads

Several of the companies that utilize cookies or other tracking or monitoring mechanisms also enable you to opt out of advertising through mechanisms established by trade groups. To learn more about how to opt out of targeting and advertising cookies, you can go to the Network Advertising Initiative page and/or the Digital Advertising Alliance’s Consumer Choice page. These opt-out tools are provided by third parties, not Canopy. We do not control or operate these tools or the choices that advertisers and others provide through these tools.

Global Privacy Control (GPC) is a technical specification that you can use to inform websites of your privacy preferences in regard to ad trackers. To set up GPC, you can visit the Global Privacy Control page. If you do choose to set up GPC, we will automatically turn off all non-required cookies on Canopy’s Website for you. Please note that this may impact the functionality of our Website.

For more information about third party cookies used on our Website, please read the following:

Google Analytics

Our Website use Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies,” which are text files placed on your computer, to help the Website analyze how users use the site. The information generated by the cookie about your use of the Website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the Website, compiling reports on activity on our Website, and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however, please note that if you do this you may not be able to use the full functionality of these Website. By using our Website, you consent to the processing of data about you by Google in the manner and for the purposes set out above. To find out more information about how Google may use your information, we encourage you to visit: https://www.google.com/policies/privacy/partners/.

Facebook Pixel

Our Website use the Facebook Pixel, a web analytics service provided by Meta Platforms Inc. (previously, Facebook Inc.) (referred to, for convenience, as “Facebook”). The Facebook Pixel functions in the way described in the section labelled “Personal Information Collected Via Technology” above. You may refuse the use of technologies like the Facebook Pixel by selecting the appropriate settings on your browser, however, please note that if you do this you may not be able to use the full functionality of these Website. By using our Website, you consent to the processing of data about you by Facebook in the manner and for the purposes set out above. To find out more information about how Facebook may use your information, we encourage you to visit: https://www.facebook.com/business/m/privacy-and-data.

How We Use Your Personal Information

We may use or disclose the Personal Information we collect for one or more of the following purposes:

To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to ask a question about our products or services, we will use that Personal Information to respond to your inquiry. If you provide your Personal Information to purchase a product or service, we will use that information to process your payment and facilitate delivery. If you provide Personal Information to enter a contest or sweepstake, we will use that information to process your entry and to contact you to fulfill the terms of that contest or sweepstake if you win. We may also save your information to facilitate new product orders or process returns. If you provide Personal Information to apply for a job with Canopy, we will use that information to review and process your application.
To provide, support, personalize, and develop our Services, products, and services.
To process your requests, purchases, transactions, and payments and prevent transactional fraud.
To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
To personalize your experience on our Services and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Services, third-party sites, and via email or text message (with your consent, where required by law).
To provide you with Canopy related information, promotions, offers, products, or services that you request from us or that you have consented to receive via email direct marketing.
To help identify fraud and maintain the safety, security, and integrity of our Services, products and services, databases and other technology assets, and business.
For testing, research, analysis, and product development, including to develop and improve our Services, products, and services.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
As described to you when collecting your Personal Information or as otherwise set forth in applicable privacy laws.
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us about our consumers is among the assets transferred.

We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you advance notice.

Please note that we do engage in fully automated decision-making that has a legal or otherwise significant effect using customer data. Our processor Shopify uses limited automated decision-making to prevent fraud that does not have a legal or otherwise significant effect on you. Services that include elements of automated decision-making include:

Temporary denylist of IP addresses associated with repeated failed transactions. This denylist persists for a small number of hours.
Temporary denylist of credit cards associated with denylisted IP addresses. This denylist persists for a small number of days.

The following list describes in detail the purposes for which we and our services providers and contractors collect and use each category of Personal Information. Each number below corresponds to the specific purpose listed above:

Category of Personal Information	Purposes for Collection and Use
Identifiers	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11
Personal Information under California Civil Code Section 1798.80(e)	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11
Protected Classification Characteristics	1, 4, 9, 10, 11
Commercial Information	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11
Biometric Information	We do not collect this data from consumers.
Internet or Other Similar Network Activity	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11
Geolocation Data	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11
Sensory Data	1, 4, 9, 10, 11
Professional or Employment-Related Information	1, 4, 7, 9, 10, 11
Non-Public Education Information	We do not collect this data from consumers.
Inferences	1, 4, 7, 9, 10, 11
Sensitive Personal Information	1, 4, 7, 9, 10, 11

Canopy may periodically engage in direct marketing as described above, however, you will be able to opt out at any time by following the instructions included in every e-mail sent to you via the “Unsubscribe” link. You may not opt out of non-promotional communications from Canopy, including confirmation messages regarding successful order requests. Please note, regardless of your communication settings, we may continue to communicate with you regarding changes to terms and conditions, Privacy Policy updates, data breaches, or other significant information related to your Personal Information for as long as it is retained by Canopy.

Consent to receive automated marketing text messages is not a condition of any purchase. If you have enrolled in the Canopy Mobile Messaging Program, you can opt-out at any time by replying STOP to +18774505794 or click the unsubscribe link (where available) in any text message to cancel. You may receive an additional mobile message confirming your decision to opt out. You understand and agree that the foregoing options are the only reasonable methods of opting out. You acknowledge that Canopy’s text message platform may not recognize and respond to unsubscribe requests that alter, change, or modify the STOP keyword command, such as the use of different spellings or the addition of other words or phrases to the command, and agree that Canopy and its service providers will have no liability for failing to honor such requests. You also understand and agree that any other method of opting out, including, but not limited to, texting words other than those set forth above or verbally requesting one of Canopy’s employees to remove you from Canopy’s list, is not a reasonable means of opting out. For support or assistance related to Canopy’s Mobile Messaging Program, text HELP to +18774505794 or email klaviyo_machine_user+VJkcjy195cc09ae1eb071c1169a5b3da5e1a_write@klaviyo.com.

We may create Deidentified Information records from Personal Information by excluding information (such as your name and/or IP address) that would allow someone to identify a specific individual. "Deidentified Information" means information that is not associated with or linked to your Personal Information, including any feedback you may provide, which cannot be reidentified with your Personal Information. Deidentified Information does not permit the identification of individual persons. We may use this Deidentified Information to analyze request patterns and usage patterns so that we may enhance our products and services. Canopy reserves the right to use and disclose Deidentified Information to third parties in its discretion, however, we will maintain and use the information in deidentified form and will not attempt to reidentify the information, or authorize any third party to reidentify the information, except in connection with determining whether the deidentification processes satisfy the requirements of applicable privacy laws.

California Notice of Financial Incentive

Under California law, the Canopy Rewards Beta program might be interpreted as a “financial incentive” program as it involves the collection of personal information and rewards that can be exchanged for items of financial value are granted in connection with activities you undertake as part of your participation in the program, although, such rewards do not have an independent financial value. We do not assign a monetary value to the information we collect. Based on our reasonable estimate, the value of your personal information to us is related to the value of the free or discounted products or services that you obtain when you redeem points. This value is based on the expense related to offering those free or discounted products or services. Canopy uses the information collected in connection with the Canopy Rewards Beta program for the purposes of operating that program, does not sell Personal Information collected in connection with the program, and otherwise uses and shares that information in accordance with this Privacy Policy.

How We Share Your Personal Information

We may disclose your Personal Information to a third party for a business purpose, specifically to enable and support the uses of your Personal Information described in the “How We Use Your Personal Information” section above. When we disclose Personal Information for a business purpose, we enter into a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any purpose except performing the contract.

While Canopy does not typically sell Personal Information, some states interpret the sharing of Personal Information with third party service providers for online advertising may be considered a “sale” of information. For example, we allow third parties, such as Facebook and Google, to place technologies (such as cookies) on our websites for purposes of marketing to users of our websites. Except for this kind of sharing, Canopy does not sell any of your information. In the interest of full disclosure, we have indicated when your Personal Information may be considered a “sale” in certain states, such as California, but want to assure you that most states do not consider this sharing a sale and otherwise we do not sell Personal Information. For more details, please read the “Sales of Your Personal Information” section below.

In the prior 12 months, Canopy has disclosed for a business purpose and/or sold Personal Information to the categories of third parties indicated in the chart below.

Category of Personal Information	Category of Third-Party Recipients
Category of Personal Information	Business Purpose Disclosures	Sales	Use for Targeted Advertising
Identifiers	Service providers and contractors, such as payment processors, ordering and delivery service providers, advertising networks, analytics companies, and background check providers Affiliates of Canopy Government agencies (subject to valid legal processes)	Service providers, such as advertising networks and analytics companies	Service providers, such as payment processors, ordering and delivery service providers, advertising networks and analytics companies
Personal Information under California Civil Code Section 1798.80(e)	Service providers and contractors, payment processors, ordering and delivery service providers, advertising networks, analytics companies, and background check providers Affiliates of Canopy Government agencies (subject to valid legal processes)	Service providers, such as advertising networks and analytics companies	Service providers, such as payment processors, ordering and delivery service providers, advertising networks and analytics companies
Protected Classification Characteristics	Service providers and contractors (only if such service provider is providing services relevant to this information) Affiliates of Canopy Government agencies (subject to valid legal processes or as required by law)	We do not sell this data.	We do not disclose this data for targeted advertising.
Commercial Information	Service providers and contractors, such as payment processors, ordering and delivery service providers, advertising networks, and analytics companies Affiliates of Canopy	Service providers, such as advertising networks and analytics companies	Service providers, such as payment processors, ordering and delivery service providers, advertising networks and analytics companies
Biometric Information	We do not collect this information from consumers.	We do not collect this information from consumers.	We do not collect this information from consumers
Internet or Other Similar Network Activity	Service providers and contractors, such as payment processors, ordering and delivery service providers, advertising networks, and analytics companies Affiliates of Canopy	Service providers, such as advertising networks and analytics companies	Service providers, such as payment processors, ordering and delivery service providers, advertising networks and analytics companies
Geolocation Data	Service providers and contractors, such as payment processors, ordering and delivery service providers, advertising networks, analytics companies, and background check providers Affiliates of Canopy	We do not sell this data.	Service providers, such as payment processors, ordering and delivery service providers, advertising networks and analytics companies
Sensory Data	Service providers and contractors Affiliates of Canopy	We do not sell this data.	We do not disclose this data for targeted advertising.
Professional or Employment-Related Information	Service providers and contractors, such as background check providers Affiliates of Canopy	We do not sell this data.	We do not disclose this data for targeted advertising.
Non-Public Education Information	We do not collect this information from consumers.	We do not collect this information from consumers.	We do not collect this information from consumers
Inferences	Affiliates of Canopy	We do not sell this data.	We do not disclose this data for targeted advertising.
Sensitive Personal Information	Affiliates of Canopy	We do not sell this data.	We do not disclose this data for targeted advertising.

To our knowledge, any sharing of Personal Information does not knowingly involve information related to children under the age of 16.

We may share some or all of your Personal Information with "Affiliates" (parent company, subsidiaries, joint ventures, or other companies under common ownership and/or control), in which case we will require our Affiliates to provide at least the same degree of protection for your Personal Information as we do under this Privacy Policy. If our company or our assets are acquired by another company, that company will possess the Personal Information collected by us and it will assume the rights and obligations regarding your Personal Information as described in this Privacy Policy.

If we disclose your Personal Information to Affiliates or third parties as identified in this section, we agree to be liable for violations of your privacy rights by the Affiliates and third parties to which we have disclosed your Personal Information.

Disclosures to Affiliates of Canopy

We disclose your Personal Information to Affiliates of Canopy as described above in the section labelled “How We Use Your Personal Information,” specifically:

- To fulfill or meet the reason you provided the information.
- To provide, support, personalize, and develop our Services, products, and services.
- To process your requests, purchases, transactions, and payments and prevent transactional fraud.
- To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
- To personalize your experience on our Services and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Services, third-party sites, and via email or text message (with your consent, where required by law).
- To provide you with Canopy-related information, promotions, offers, products, or services that you request from us or that you have consented to receive via email direct marketing.
- To help identify fraud and maintain the safety, security, and integrity of our Services, products and services, databases and other technology assets, and business.
- For testing, research, analysis, and product development, including to develop and improve our Services, products, and services.
- To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
- As described to you when collecting your Personal Information or as otherwise set forth in applicable privacy laws.
- To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us about our consumers is among the assets transferred.

Disclosures to Service Providers and Contractors

We will also disclose your Personal Information to service providers and contractors that help us run our business by processing Personal Information on behalf of Canopy for the purposes identified in the section labelled “How We Use Your Personal Information.” Such companies include providers of customer support services (including those that record or store communications), providers of analytics technologies that record and analyze your interaction with our websites to help us improve your experience including payment processing services, fraud monitoring and prevention, detecting and preventing deceptive or illegal activity or misuse of our Services, products, services, email, social media, and other marketing platforms and service providers, and hosting services.

Disclosures to Government Agencies

We disclose your Personal Information to government agencies to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations. We may also disclose your Personal Information to government agencies as necessary if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to detect, prevent, or protect against such fraudulent, deceptive, or illegal activity, misuse of our Services, products, or services, or security or technical issues, or where it is reasonably necessary to protect from harm the rights, property or safety of Canopy and our employees, our users, children, or the public as required or permitted by law.

In addition to the above, we may share your Personal Information with any third party at your instruction or request. That kind of sharing is not for our business purposes, though, and is not included in the above chart.

In certain circumstances, we may be required to disclose your Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements, as well as to prevent crime or fraud.

Sales of Your Personal Information

Canopy allows certain companies, who are service providers to Canopy pursuant to written contracts, to place tracking technologies like cookies and pixels on our sites, which allow those companies to receive information about your activity on Canopy’s Website that is associated with your browser or device. The companies may use that data to serve you with more relevant ads on our sites or others. Under some state laws, sharing data for online advertising like this may be considered a “sale” of information. Except for this kind of sharing, Canopy does not sell any of your information.

To our knowledge, any sales of Personal Information do not knowingly involve information related to children under the age of 16.

You always have full control over whether these technologies work on your devices. You can disable them entirely using our cookie consent preference tools (for instructions, see the section above labelled “Personal Information Collected Via Technology”), or by clicking the “Your Privacy Choices” link on in the footer our websites.

Additional Legal Notices

How We Protect Your Information

To protect your Personal Information, Canopy has adopted reasonable technical and organizational precautions in addition to following industry best practices to make sure it is not inappropriately lost, misused, accessed, disclosed, altered, or destroyed.

Canopy has implemented industry-standard organizational and electronic means of protecting your Personal Information. We store Personal Information behind a firewall, which is a barrier designed to prevent outsiders from accessing our servers. In addition, Canopy protects your Personal Information from unauthorized physical access by storing your Personal Information in a controlled facility. Except as provided elsewhere in this Privacy Policy, Canopy limits access to Personal Information, regardless of if it is stored electronically or in physical form, to those persons (including employees and contractors) in Canopy’s organization who have a business need for such access.

Even though we have taken significant steps to ensure that your Personal Information is not intercepted, accessed, used, or disclosed to or by unauthorized persons, you should know that Canopy cannot completely eliminate security risks associated with Personal Information.

The safety and security of your information also depends on you. If you choose, or are provided with, a user name, password, or any other piece of information when you create an account as part of our security procedures, you must treat such information as confidential, and you must not disclose it to any other person or entity. You also acknowledge that your account is personal to you and agree not to provide any other person with access to that account, or any portion thereof, using your user name, password, or other security information. You agree to notify us immediately of any unauthorized access to or use of your user name or password or any other breach of security. You also agree to ensure that you exit from your account at the end of each session. You should use particular caution when accessing your account from a public or shared computer or device so that others are not able to view or record your password or other Personal Information. You are entirely responsible for maintaining the confidentiality of the information you hold for your user name, password, or other information related to your account. You may be held liable for losses incurred by us as a result of your failing to keep your login information secure and confidential.

Data Retention

We will only keep your information, including any personal information, for as long as necessary to fulfill the purposes for which we collected it, to comply with our legal obligations, or to enforce our legal rights (or as required so others may enforce their legal rights).

Generally, the length of time we keep your information will depend on the type of information and the purpose for which we are processing it. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we are processing it and whether we can achieve those purposes through other means, and any applicable legal requirements.

At the end of the appropriate retention period, we will either delete your information from our systems completely or anonymize it so it can be used without identifying you and so we no longer have the ability to re-associate the anonymized information with you in the future, such as by aggregating the information.

If you would like more information about our retention practices, please contact us using the information provided in the “Contact Us” section below.

Notice Regarding Children

We do not target our Website or Services toward or intentionally gather Personal Information about visitors who are under the age of 16. Furthermore, we do not intentionally allow visitors under the age of 18 to place orders via our Website or Services. If a child under 16 submits Personal Information to us and we learn that the Personal Information is the information of a child under 16, we will attempt to delete that Personal Information as soon as possible. If you believe that we might have any Personal Information from a child under 16, please contact us using the information in the below “Contact Us” section.

By using the Services, you represent that you are at least the age of majority in your state, province, or country of residence, or that you are the age of majority in your state, province, or country of residence and you have given us your consent to allow any of your minor dependents to use the Services.

Links To Other Sites

If we have provided a link to any other website or location, it is for your convenience and does not signify our endorsement of such other website or location or its contents. We have no control over, do not review, and cannot be responsible for these outside websites or their content. Please be aware that the terms of our Privacy Policy do not apply to these outside websites.

Once you leave our Website or are redirected to a third-party website or application, you are no longer governed by this Privacy Policy or our Website’ Terms of Service. For your convenience, we may provide pop-up banners or notices in some instances when you leave our Website or are directed to a third-party website or application, but we make no representations that we will provide such notice for all third-party links on our Website.

When you click on links on our store, they may direct you away from our Website. We are not responsible for the privacy practices of other sites and encourage you to read their privacy statements.

Shopify

Our store is hosted on Shopify Inc. They provide us with the online e-commerce platform that allows us to sell our products and services to you. Your data is stored through Shopify’s data storage, databases and the general Shopify application. They store your data on a secure server behind a firewall.

If you choose a direct payment gateway to complete your purchase, then Shopify stores your credit card data. It is encrypted through the Payment Card Industry Data Security Standard (PCI-DSS). Your purchase transaction data is stored only as long as is necessary to complete your purchase transaction. After that is complete, your purchase transaction information is deleted.

All direct payment gateways adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of credit card information by our store and its service providers. For more information about how Shopify handles and uses your personal information, please review their Terms of Service (https://www.shopify.com/legal/terms) and Privacy Policy (https://www.shopify.com/legal/privacy).

Privacy Policy Updates

We reserve the right to amend this Privacy Policy at our discretion and at any time. If we change the way we collect, use, or disclosure your Personal Information that requires us to make changes to this Privacy Policy, we will post a notice on this page and update the Privacy Policy’s effective date. Your continued use of our Services following any posted updates to the Privacy Policy constitutes your acceptance of such changes. If you object to any of the changes to our Privacy Policy, you must stop using the Services.

Your Privacy Rights and Choices

The below section describes the privacy rights made available in various states. To exercise any of the rights that are applicable to you, please follow the link under “Exercising US Privacy Rights and Choices” and provide the requested information.

California

As modified by the California Privacy Rights Act, the California Consumer Privacy Act ensures that California consumers have the following rights with respect to the collection, use, sharing, sale, and other processing of their Personal Information:

The right to know what Personal Information has been collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, and the specific pieces of Personal Information we have collected about you;
The right to access the Personal Information, including to obtain a copy that can easily be sent to another data controller;
The right to request the deletion of your Personal Information, subject to certain exceptions;
The right to correct inaccurate Personal Information;
The right to opt-out of the sale or sharing of your Personal Information;
The right to request the limitation of the use and disclosure of your Sensitive Personal Information;
The right to opt-in to sale or sharing of your Personal Information (if you have previously affirmatively opted-out); and,
The right not to be discriminated against for exercising any of your rights with respect to your Personal Information.
Other California Privacy Rights

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Services that are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please send an email to [email protected] or contact us using the information provided in the “Contact Us” section.

Other US State Privacy Laws

Nebraska and Texas

The privacy laws applicable to consumers who reside in Nebraska or Texas ensure that consumers have the following rights with respect to the collection, use, sharing, sale, and other processing of their Personal Information:

The right to confirm whether a controller is processing Personal Information about the consumer and to access that Personal Information, including to obtain a copy that can easily be sent to another data controller;

The right to correct inaccurate Personal Information;
The right to delete the Personal Information possessed by the controller;
The right to opt-out of the processing of Personal Information for the purposes of targeted advertising, sales of Personal Information, or profiling in furtherance of decisions that product legal or similarly significant effects concerning you as a consumer;
If your request is denied, the right to appeal that refusal; and,
The right not to be discriminated against for exercising any of your rights with respect to your Personal Information.

Nevada

If you are a resident of the State of Nevada, you have the right to request that Canopy not sell the Personal Information we currently have about you or that we might collect about you in the future. Although it is currently Canopy’s policy not to sell our consumers’ Personal Information as a “sale” is defined under Nevada law, if you would like to register an email address with Canopy to request that we not sell your Personal Information now or in the future, please follow the link under “Exercising US Privacy Rights and Choices” and provide the requested information.

Appeals Process

If you are a resident of Nebraska or Texas and you believe that any request you have submitted has been denied in error, you are entitled to appeal that decision by submitting a request using the [email protected] email address listed under “Exercising US Privacy Rights and Choices” and providing the below information. We strive to provide this information at the time of a denial but understand that you may have additional questions. Specifically, you will need to provide:

Your name, contact information, and state of residence;
If we have provided with you with any identifier related to the request you are appealing, that identifier; and,
Your reason for requesting an appeal.

After receiving your appeal, members of our Privacy Team will review your appeal, the rationale for denying the initial request, and will respond to you within the time period mandated by applicable law regarding any clarifications or additional information needed, as well as any action taken, if any, and the reasons for those actions or inaction. If your appeal is denied, we will provide you with information by which you can contact the respective state’s Attorney General in order to submit a complaint.

Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. Unless permitted by applicable law, we will not:

Deny you goods or services;
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
Provide you a different level or quality of goods or services; or,
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Exercising Your Privacy Rights and Choices

If you are a resident of California, Nebraska, Nevada, or Texas and would like to exercise any of the privacy rights made available in the state where reside, please submit a verifiable consumer request to us by either:

Calling us at (877) 680-8790; or,
Submitting your request by email to [email protected] as described in this section;

Please keep in mind that, if you would like to submit multiple types of requests, you may need to do so in an appropriate sequence. For example, if you submit a deletion request and later submit a data portability request, we may have already deleted your Personal Information from our systems and will be unable to fulfill your data portability request.

Additionally, if you have an account on our Website, you may immediately access some of the information that we have collected about you by logging into your account on the Website and navigating to your user profile. Viewing your information through your account on our Website may not provide you with all of the information to which you are entitled.

Only you, or where allowed by applicable law someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. If you are a parent or legal guardian, you may also make a verifiable consumer request on behalf of your minor child if your state allows such requests. If you are a resident of a state that allows you to designate an authorized agent, you must authorize that agent to act on your behalf and the authorized agent must provide a copy of that written authorization when submitting their request on your behalf. For your information, authorized agents can be used by California residents to submit any rights request. Authorized agents are permitted to be used by residents of Texas for the purpose of submitting a request to opt-out of the processing of your Personal Information as permitted in each state. Nebraska also permits the use of an authorized agent to submit opt-out requests in connection with the processing of your Personal Information for the purposes of targeted advertising and sales of Personal Information. We may contact you or the authorized agent to ensure that you have given them the authority to act on your behalf.

Additionally, if you are a guardian or conservator of a consumer subject to a guardianship, conservatorship, or other protective arrangement and who resides in Nebraska, you may also exercise the rights of the consumer on that consumer’s behalf regarding the processing of Personal Information. Where authorized to act on behalf of a consumer, guardians and conservators will be required to verify their capacity to act on behalf of the consumer subject to the guardianship, conservatorship, or other protective arrangement.

The verifiable consumer request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative, which may include:
- Your first and last name;
- Email address(es);
- Street address; and,
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Based on the information you have provided, we will make commercially reasonable efforts to verify your identity against the information already in our systems. In the event we cannot verify your identity, we may request additional information from you so that we may complete your request in compliance with the requirements of applicable law. Please note that if you do not provide the required information, we may not be able to complete your rights request and will be required to deny it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

You do not need to create an account with us to exercise the rights made available to you the applicable privacy laws. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Contact Us

If you have any general questions about our Privacy Policy or questions about how we collect, use, or share your Personal Information, or would like to exercise your rights with respect to your Personal Information as permitted by certain laws applicable to consumers as described in greater detail below, please do not hesitate to contact our Privacy Officer at:

Phone: (877) 680-8790

Privacy Policy Location: https://getcanopy.co/policies/privacy-policy

Email: [email protected]

Mailing Address:

Hyku Home Inc. dba Canopy

ATTN: Privacy Officer

411 Post Road Drive

Austin, TX 78704-7017

Cart (0)

Your cart is empty.