Privacy Policy

LOLA BLANKETS PRIVACY POLICY

Posted Date: 8/17/26

Effective Date: 8/17/26

Lola Blankets, LLC (“Company,” “we,” “us,” or “our”) operates the website lolablankets.com and http://lolablankets.com/en-ca (the “Site”) and related mobile applications (collectively, the “Services”) for the sale of blankets and related products. This Privacy Policy describes how we collect, use, share, and protect your information when you use our Services. By using the Services, you agree to the terms of this Privacy Policy and our Terms of Service (available at https://lolablankets.com/policies/terms-of-service). We only offer our products and Services to residents of the United States and Canada. We do not intentionally market or sell to individuals outside these jurisdictions.

This Privacy Policy applies to users in the United States and Canada. For users in Canada, we comply with applicable federal and provincial private-sector privacy laws, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, for Québec residents, the Act respecting the protection of personal information in the private sector, as amended (“Québec's Law 25”). Canadian residents have rights to access, correct, and, in certain circumstances, request the portability of their personal information, as described in Section 9 below.This Privacy Policy does not apply to information collected by third-party websites or services that may link to or be accessible from our Site, including payment processors. We encourage you to review the privacy policies of those third parties. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Table of Contents

Interpretation and Definitions
What Information Do We Collect?
How Do We Use Your Information?
Will Your Information Be Shared with Anyone?
How Long Do We Keep Your Information?
Transfer of Your Information
How Do We Keep Your Information Safe?
Do We Collect Information from Minors?
What Are Your Privacy Rights?
Additional Privacy Rights for Residents of Certain US States
Controls for Do-Not-Track Features and Opt-Out Preference Signals
Do We Make Updates to This Policy?
Links to Other Websites
How Can You Contact Us About This Policy?

Interpretation and Definitions

The words with an initial capital letter have meanings defined under the following conditions. These definitions shall have the same meaning regardless of whether they appear in singular or plural.

For the purposes of this Privacy Policy:

Account: A unique account created for you to access our Services or parts of our Services.
Business: For the purpose of applicable state privacy laws, refers to Lola Blankets, LLC as the legal entity that collects consumers’ personal information and determines the purposes and means of the processing of consumers’ personal information, or on behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers’ personal information.
Company: Refers to Lola Blankets, LLC (referred to as either “the Company,” “We,” “Us,” or “Our” in this Privacy Policy).
Consumer: A natural person who is a resident of a state with an applicable comprehensive consumer privacy law.
Country: Refers to the United States (with applicability to users in Canada as noted).
Device: Any device that can access the Services, such as a computer, cellphone, or digital tablet.
Do Not Track (DNT): A concept promoted by US regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing internet users to control the tracking of their online activities across websites.
Loyalty Program: Our points-based rewards program described in Section 2 below, currently offered to U.S. customers only.
Personal Data (or “Personal Information”): Any information that relates to an identified or identifiable individual. For the purposes of applicable state privacy laws, Personal Data means any information that identifies, relates to, describes, or is capable of being associated with, or could reasonably be linked, directly or indirectly, with you.
Services: Refers to the Site and the e-commerce and related services provided by Lola Blankets, LLC.
Service Provider: Any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Services, to provide the Services on behalf of the Company, to perform services related to the Services, or to assist the Company in analyzing how the Services are used.
Third-party Social Media Service: Any website or social network website through which a User can log in or create an account to use the Services.
Usage Data: Data collected automatically, either generated by the use of the Services or from the Service infrastructure itself (for example, the duration of a page visit).
You: The individual accessing or using the Services.

What Information Do We Collect?

Information You Provide

In Short: We collect personal information that you voluntarily provide to us when you register on the Services, place an order, contact us, or participate in our Loyalty or Ambassador programs.

The personal information that we collect and store when you use our Services may include:

Name (first and last)
Email address
Phone number (mobile or landline)
Billing and shipping address
Payment information (collected and processed directly by our third-party payment processor; we do not store or retain full payment card details on our systems)
Account credentials, such as username and password
Demographic information (e.g., age, gender), if voluntarily provided
Purchase history and order information
Product preferences, wishlist items, and browsing behavior on the Site
Communications (e.g., customer service messages, feedback, reviews)
Loyalty program activity, such as points earned and redeemed and tier status, as described further below
Ambassador program information, such as social media handles, referral link activity, and payment information for payouts

Personal Data Automatically Collected

In Short: Some information, such as IP address and/or browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as:

Your IP address and approximate geolocation
Browser and device characteristics
Operating system
Language preferences
Referring URLs
Device name
Country and location
Information about how and when you use our Services
Other technical information

This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Loyalty Program

In Short: Our Loyalty Program collects the information needed to track points, tier status, and redemptions, and is currently offered to U.S. customers only.

We offer a Loyalty Program that allows customers to earn points on purchases and redeem those points for discounts, with additional benefits available at higher membership tiers. In connection with the Loyalty Program, we collect your name, email address, purchase history, points balance, tier status, referral activity, and shipping address. Our Loyalty Program is powered by a third-party vendor, Rise.

The Loyalty Program is not currently available to customers in Canada. If we expand the Loyalty Program to Canadian customers, we will update this Privacy Policy to describe the additional consent and disclosure obligations that will apply under Quebec’s Law 25 and Canada’s Anti-Spam Legislation (“CASL”).

If you enroll in the Loyalty Program, we and our marketing partners may send you email and SMS communications about the program, such as point balances, tier status, and related promotions, in accordance with your marketing preferences and Section 5 below.

Information Collected Through Our Apps

In Short: We may collect certain device, usage, and location information when you use our mobile applications, if any.

If you use our mobile applications, we may also collect the following information:

Device information, such as unique device identifiers, hardware model, and operating system version
Usage data, such as app interactions, crash reports, and session duration
Location data (with your consent, for features like order tracking)
Push notification preferences

Information from Cookies and Tracking Technologies

In Short: We and certain third parties use cookies and similar technologies on the Site for functionality, analytics, and advertising purposes.

We use cookies, web beacons, pixels, and similar technologies to collect usage data for analytics, functionality, and advertising. These technologies help us understand how you interact with our Services, remember your preferences, and, where applicable, deliver relevant advertising. The following third-party tracking technologies are currently in use on the Site: e-commerce platform and hosting providers (such as Shopify), email and SMS marketing platforms (such as Klaviyo and Postscript), advertising and analytics partners, customer service platforms, loyalty program administrators, data enrichment and analytics providers.

Essential Cookies: Necessary for the Site and Services to function properly, e.g., to keep you logged in, maintain shopping carts across sessions, and process secure transactions. These cookies do not require consent and are typically first-party.
Analytics Cookies: To understand how users interact with our platform. We use tools such as Google Analytics and Heap/ContentSquare to compile insights that help us improve site performance and user experience.
Preference Cookies: To remember your preferences for a personalized experience, such as saved wishlist items or product recommendations.
Advertising Cookies: To deliver targeted advertising based on your interests, such as through the Meta Pixel and Google Ads. These may involve cross-site tracking and are shared with ad networks. We do not sell personal information for money through these cookies.

You can manage cookies through your browser settings. However, disabling cookies may affect functionality, such as preventing checkouts or personalized features. We are in the process of implementing a cookie banner and preference center to allow you to manage your cookie preferences. Until that tool is live, we honor Global Privacy Control (“GPC”) signals where required under applicable law, and you may object to the use of a specific tracking technology by contacting us using the information in Section 14 below.

Information from Third Parties

We may collect information from third-party sources. If you register or log in using a Third-party Social Media Service (e.g., Google, Facebook), we may collect Personal Data associated with that account, such as your name and email address. We may combine information collected automatically with other data we have about you.

How Do We Use Your Information?

In Short: We process your information for purposes based on legitimate business interests, the fulfillment of our contract with you, compliance with our legal obligations, and/or your consent.

We use personal information collected via our Services for a variety of business purposes described below, in reliance on our legitimate business interests, in order to enter into or perform a contract with you, with your consent, and/or for compliance with our legal obligations. Under U.S. and Canadian privacy laws, such as the CPRA and PIPEDA, we rely on these bases to process your information lawfully.

For Canadian users, we collect, use, and disclose your personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and we obtain your consent before using your information for a new purpose not identified at the time of collection, except where permitted by law.

We use the information we collect or receive to:

Facilitate account creation and the logon process, including through linked third-party accounts.
Fulfill and manage your orders, payments, returns, and exchanges.
Administer the Loyalty Program, including tracking points, tier status, and redemptions.
Administer the Ambassador program, including tracking referral activity and processing payouts.
Send you marketing and promotional communications by email and SMS, in accordance with your marketing preferences and applicable law, including CAN-SPAM (U.S.) and Canada's Anti-Spam Legislation (“CASL”). For Canadian recipients, we obtain your express or implied consent before sending commercial electronic messages, and each message identifies our business and includes a working unsubscribe mechanism that we will honor within 10 business days. You can opt out of our marketing communications at any time (see “What Are Your Privacy Rights” below).
Send administrative information to you, such as changes to our terms, conditions, and policies.
Deliver targeted advertising to you, subject to your opt-out or consent rights under applicable law.
Request feedback and respond to your inquiries.
Protect our Services, including for fraud monitoring and prevention.
Enforce our terms, conditions, and policies, and respond to legal requests.
Analyze usage trends, measure Service effectiveness, and develop new features.
Comply with applicable law and protect against malicious, deceptive, fraudulent, or illegal activity.

We process sensitive information only with your consent or as necessary for the Services. In aggregated or de-identified form, we may use data for any purpose, such as reporting or marketing, without identifying individuals.

Will Your Information Be Shared with Anyone?

In Short: We only share information with your consent, to comply with laws, to provide you with services, to protect your rights, or to fulfill business obligations.

We may process or share data based on the following legal bases: consent; legitimate interests; performance of a contract; legal obligations; and vital interests, including to investigate suspected fraud or threats to safety, or as evidence in litigation. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes; this excludes text messaging originator opt-in data and consent, which will not be shared with any third parties.

More specifically, we may share your personal information in the following situations:

Vendors, Consultants and Other Third-Party Service Providers. We share data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf, including: Shopify (e-commerce platform and hosting); Klaviyo (email marketing and website tracking); Postscript (SMS marketing); Meta/Facebook and Instagram, and Google (advertising and analytics); Loop (returns and exchanges); Gorgias (customer service); Rise (loyalty program); and Decile (customer data enrichment for analytics and segmentation).

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.

Affiliates. We may share information with our affiliates under common control with us, only to the extent necessary for the purposes described in this Policy.

Third-Party Advertisers. We may use third-party advertising companies to serve ads when you visit the Services. These companies may use information contained in cookies and other tracking technologies to provide advertisements about goods and services of interest to you.

We do not sell personal information in exchange for money. However, some state laws define “sale” or “sharing” broadly to include the disclosure of data (such as through analytics or advertising cookies) for targeted advertising. Under those definitions, we may “share” personal information for these purposes, subject to your opt-out rights described in Section 10 below.

Some of the service providers listed above are located in, or may process personal information in, the United States or other jurisdictions outside Canada. See Section 6 below for more information about cross-border transfers.

How Long Do We Keep Your Information?

In Short: We currently retain your information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer period is required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because your information has been stored in backup archives), we will securely store it and isolate it from further processing until deletion is possible.

Transfer of Your Information

Your information, including Personal Data, is processed at our operating offices and in any other places where the parties involved in the processing are located. This means that your information may be transferred to and maintained on computers located outside of your state, province, or country. For Canadian residents, your information may be transferred outside your province or Canada to the United States, where it may be subject to different privacy laws. By using our Services, you consent to such transfers.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place.

How Do We Keep Your Information Safe?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We implement reasonable administrative, technical, and physical safeguards designed to protect the security of any personal information we process, including:

Encryption of payment card data in transit, handled by our third-party payment processor rather than stored on our own systems
Use of HTTPS/TLS encryption across the Site
Role-based access controls limiting employee and vendor access to personal information to those who need it to perform their job functions
Password and account authentication protections for administrative access to Shopify and connected platforms (e.g., Klaviyo, Postscript, Rise, Gorgias)
Reliance on the security measures maintained by our hosting and platform provider, Shopify, and other third-party service providers, as described in their respective security documentation
Periodic review of third-party vendor access and permissions

However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

In the event of a data security incident affecting your personal information, we will notify you and the appropriate authorities as required by applicable law and take steps to remediate the situation.

Do We Collect Information from Minors?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

Our Services are intended for individuals 18 years of age or older. We do not knowingly collect personal information from children under 13 (the U.S. COPPA standard) or under 14 in Quebec. By using the Services, you represent that you are at least 18 years of age. If we learn that personal information from a user under 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we have collected from a child under 18, please contact us at legal@lolablankets.com to request deletion.

What Are Your Privacy Rights?

In Short: You may review, change, or delete your account information at any time. Depending on your location, you may have additional rights.

You can access, correct, update, or delete your personal information by logging into your account or emailing legal@lolablankets.com. You can opt out of marketing communications at any time via the unsubscribe link in our emails or by replying STOP to our SMS messages.

Canada Residents (PIPEDA and Law 25). If you are located in Canada, you have the right to access, correct, or challenge the accuracy of your personal information, withdraw consent to our collection, use, or disclosure of your personal information (where applicable and subject to legal or contractual restrictions), and file a complaint with the Office of the Privacy Commissioner of Canada or, for Québec residents, the Commission d'accès à l'information.

Québec residents also have the right to request that computerized personal information we collected from you be provided in a structured, commonly used technological format, and to have it transmitted to another person or body, where technically feasible.

As described in Section 2 above, we use cookies and similar technologies that may allow you to be identified, located, or subject to profiling.

We are in the process of assessing and updating the means by which Canadian users, including Québec residents, can activate or deactivate these technologies; until that assessment is complete, you may contact us using the information in Section 14 below to ask about or object to a specific tracking technology's use.

Our current privacy contact can be reached using the information in Section 14 below. To exercise these rights, contact us at legal@lolablankets.com. We may verify your identity before responding, and we will comply with all applicable legal requirements regarding response times.

Additional Privacy Rights for Residents of Certain US States

This section applies to residents of US states with comprehensive consumer privacy laws, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Delaware (DPDPA), Indiana, Iowa (ICDPA), Texas (TDPSA), Oregon (OCPA), Tennessee (TIPA), and Minnesota (MCDPA). Additional states may enact laws, and we will comply as applicable. California residents should also review the Notice to California Residents Section 10.6 below for additional disclosures specific to California law.

Categories of Personal Information Collected

In the last 12 months, we have collected the following categories of personal information: identifiers (name, email address, phone number, postal address, IP address, account name); commercial information (purchase and order history); protected characteristics (age, gender, if voluntarily provided); internet or network activity (browsing history, interactions with our Services); geolocation data (approximate, from IP address); inferences (preferences derived from other data); and, where applicable, sensitive personal information (such as precise geolocation, only with consent). We do not collect biometric information, sensory data, or non-public education information.

Sources of Personal Information

We collect personal information directly from you (e.g., orders, communications), indirectly from your activity on our Services, automatically (e.g., cookies, device information), from Service Providers (e.g., analytics providers, payment processors), and from third parties (e.g., social media logins).

Disclosure and Sale of Personal Information

We do not sell personal information for money. However, some state laws (e.g., California, Colorado) define “sale” broadly to include sharing with third parties, such as analytics or advertising partners, for valuable consideration. Under this definition, we may have “sold” or “shared” identifiers, commercial information, internet activity, and geolocation data in the last 12 months for purposes such as targeted advertising through the tools described in Section 2 above.

Your Rights Under State Privacy Laws

If you are a resident of a state with a comprehensive privacy law, you may have some or all of the following rights (variations exist by state):

The right to know and access the personal information we have collected about you.
The right to delete your personal information, subject to certain exceptions.
The right to correct inaccurate personal information.
The right to opt out of the sale or sharing of your personal information for targeted advertising.
The right to limit the use of sensitive personal information.
The right to data portability.
The right to non-discrimination for exercising these rights.
The right to appeal a denied request.

How to Exercise Your Rights

To exercise these rights, email legal@lolablankets.com and specify your state and the right you are exercising. We will verify your identity or residency before responding and will respond in accordance with applicable legal requirements regarding response times. If we deny a request, we will provide instructions on how to appeal.

Notice to California Residents

This section supplements the disclosures above and applies specifically to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”).

Categories of Personal Information and Sensitive Personal Information. In the preceding 12 months, we have collected the categories of personal information identified above. We do not use or intentionally collect sensitive personal information for the purpose of inferring characteristics about you. To the extent any information we collect could be considered sensitive personal information under applicable law, for example, precise geolocation data collected through location-based features in our mobile application, where offered, we do not use or disclose it for any purpose requiring an opt-in right to limit, except as you may direct.

We use sensitive personal information only for the purposes permitted under Cal. Civ. Code § 1798.121(a) and do not use or disclose it for purposes requiring an opt-in right to limit, unless you direct us to do so.

Retention. We retain each category of personal information for the period described in Section 5 above.

Sale and Sharing of Personal Information. We do not sell personal information for monetary consideration. As described in Section 4 above, we may “share” personal information (as that term is broadly defined under the CCPA) with third-party advertising and analytics partners for cross-context behavioral advertising purposes.

The following table identifies the categories of personal information that we sold or shared to third parties in the 12 months preceding the Effective Date of this Privacy Policy, and the categories of third parties to whom we sold or shared that information:

Category of Personal Information	Category of Third Parties
Identifiers (name, email, IP address, device info)	Advertising networks (Meta, Google); analytics providers (Google Analytics, Heap/ContentSquare)
Internet/network activity (browsing, session data, clicks)	Analytics providers (Heap/ContentSquare); advertising networks (Meta, Google)

We disclosed the following categories of personal information for a business purpose in the same period, to the following categories of recipients:

Category of Personal Information	Category of Recipients
Identifiers, commercial information	Service providers (e-commerce platform and hosting, email/SMS marketing, customer service, loyalty program administration, returns/exchanges)

Your California Privacy Rights. In addition to the rights described in Section 10.4 above, California residents have the right to:

Know and access the specific pieces of personal information we have collected about you;
Request correction of inaccurate personal information;
Request deletion of personal information, subject to certain exceptions;
Opt out of the sale or sharing of personal information for cross-context behavioral advertising; and
Limit the use and disclosure of sensitive personal information to that which is necessary to perform the services reasonably expected by an average consumer.

Right to Limit Use and Disclosure of Sensitive Personal Information. If applicable, California residents have the right to limit our use or disclosure of sensitive personal information for purposes other than those allowed under the CCPA. You may submit such a request by emailing legal@lolablankets.com with the subject line 'Limit Use of Sensitive Personal Information

Opt-Out of Sale/Sharing. We are in the process of implementing a Consent Management Platform and a “Do Not Sell or Share My Personal Information” mechanism to allow California residents to exercise this right directly on our Site. Until that mechanism is live, you may exercise this right by emailing legal@lolablankets.com with the subject line “California Opt-Out Request,” and we will process your request and cease sharing your personal information for cross-context behavioral advertising purposes in accordance with applicable law.

Authorized Agents. You may designate an authorized agent to submit a CCPA request on your behalf. We may require proof of the agent’s authorization and may still require you to verify your own identity directly with us.

Non-Discrimination. We will not discriminate against you for exercising any of these rights.

Shine the Light Law.

We do not knowingly disclose personal information obtained through our Site or Services to third parties for those third parties’ own direct marketing purposes. We share personal information with service providers who process it on our behalf, as described above, but we have not authorized any such party to use your personal information for their own independent marketing purposes.

California Notice at Collection

At or before the point we collect personal information from you, we provide notice of the categories of personal information we intend to collect and the purposes for which each category will be used. The categories of personal information we collect and our purposes for collecting them are described in this Policy.

Notice of Financial Incentive

From time to time, we may offer a discount or other financial incentive in exchange for your personal information. For example, we offer a discount on your first order in exchange for your email address and/or phone number. The categories of personal information collected in connection with this offer include your phone number and/or email address. Participation is voluntary, and you may withdraw at any time by contacting us at legal@lolablankets.com. Withdrawing will not affect any discount you already received. The value of this incentive is reasonably related to the value of the personal information provided, based on the anticipated value of the customer relationship established.

Controls for Do-Not-Track Features and Opt-Out Preference Signals

Our Services do not respond to Do Not Track browser signals given the lack of a uniform technology standard. We do recognize the Global Privacy Control (“GPC”) signal for residents of states that require it, and will treat a GPC signal as a valid request to opt out of the sale or sharing of your personal information for targeted advertising. You will need to enable the GPC signal for each supported browser or browser extension you use.

Do We Make Updates to This Policy?

In Short: Yes, we will update this Policy as necessary to stay compliant with relevant laws.

We may update this Privacy Policy from time to time to reflect changes to our information practices, legal requirements, or business operations. Each updated version will include a new Posted Date at the top of the Policy. Minor or non-material changes take effect immediately upon posting. For material changes that significantly affect your privacy rights, we will provide at least 30 days’ advance notice via email and/or by posting a prominent notice on our Site, and such changes will become effective 30 days after notice is provided, unless otherwise required by law. Continued use of our Services after the effective date of any changes constitutes your acceptance of the updated Policy.

Links to Other Websites

Our Services may contain links to other websites not operated by us. We strongly advise you to review the privacy policies of those third-party sites, as we have no control over and assume no responsibility for their content or practices.