California Privacy Rights

Effective Date: November 6, 2025

This California Privacy Rights Notice supplements the information in our Privacy Policy and applies solely to California residents. This notice describes how Sugar & Stix LLC dba SugarSkin ("SugarSkin," "we," "us," or "our") collects, uses, discloses, and protects personal information as required by the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act (CPRA).

Your California Privacy Rights

As a California resident, you have the following rights under California law:

Right to Know

You have the right to request that we disclose:

• The categories of personal information we have collected about you
• The categories of sources from which we collected your personal information
• Our business or commercial purpose for collecting or selling your personal information
• The categories of third parties with whom we share your personal information
• The specific pieces of personal information we have collected about you

Right to Delete

You have the right to request that we delete any personal information about you that we have collected, subject to certain exceptions allowed by law.

Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

Right to Opt-Out of Sale or Sharing

You have the right to opt-out of the sale or sharing of your personal information. We do not sell your personal information and do not share it for cross-context behavioral advertising purposes.

Right to Limit Use of Sensitive Personal Information

You have the right to limit our use and disclosure of your sensitive personal information to only what is necessary to perform the services or provide the goods you requested.

Right to Non-Discrimination

You have the right not to receive discriminatory treatment for exercising your California privacy rights. We will not deny goods or services, charge different prices, or provide a different level of quality based on your exercise of these rights.

Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information from California consumers:

Identifiers

Examples: Name, email address, postal address, phone number, IP address

Purpose: To process orders, communicate with you, and provide customer service

Disclosed to: Payment processors (Stripe), shipping carriers, email service providers

Commercial Information

Examples: Purchase history, product preferences, shopping behavior

Purpose: To fulfill orders, provide recommendations, improve our products and services

Disclosed to: Payment processors, analytics providers

Internet/Network Activity

Examples: Browsing history on our website, interaction with our website

Purpose: To improve website functionality and user experience

Disclosed to: Website hosting providers, analytics services

Geolocation Data

Examples: General location based on IP address

Purpose: To provide localized content and shipping options

Disclosed to: Shipping carriers

Sources of Personal Information

We collect personal information from the following sources:

• Directly from you: When you make a purchase, create an account, contact us, or sign up for our newsletter
• Automatically: Through cookies and similar technologies when you visit our website
• From third parties: Payment processors, shipping carriers, and analytics providers

Business or Commercial Purposes for Collection

We use your personal information for the following business and commercial purposes:

• Processing and fulfilling your orders
• Communicating with you about your orders, account, and customer service inquiries
• Sending marketing communications (with your consent)
• Improving our website, products, and services
• Detecting and preventing fraud and security incidents
• Complying with legal obligations
• Internal research and analytics

How We Share Personal Information

We may disclose your personal information to the following categories of third parties:

• Service Providers: Companies that perform services on our behalf, such as payment processing (Stripe), shipping, email delivery, and website hosting
• Business Partners: With your consent, we may share information with business partners for joint marketing purposes
• Legal Authorities: When required by law or to protect our rights and safety

We do not sell your personal information to third parties.

Sensitive Personal Information

We do not collect or process "sensitive personal information" as defined by the CPRA, such as Social Security numbers, financial account information with access credentials, precise geolocation, racial or ethnic origin, religious beliefs, genetic data, biometric information for identification, health information, or information concerning sex life or sexual orientation.

Retention of Personal Information

We retain your personal information for as long as necessary to fulfill the purposes outlined in this notice and our Privacy Policy, unless a longer retention period is required or permitted by law. Retention periods vary based on:

• The nature of the information
• Why it was collected and processed
• Legal or operational retention needs

How to Exercise Your Rights

To exercise any of your California privacy rights described above, please submit a verifiable consumer request to us by either:

Verification Process

To protect your privacy and security, we will verify your identity before processing your request. The verification process may require you to:

• Provide identifying information such as name and email address
• Confirm information we have on file about you
• For deletion or correction requests, provide additional verification

We will respond to verifiable consumer requests within 45 days of receipt. If we require more time (up to 90 days total), we will inform you of the reason and extension period in writing.

Authorized Agents

You may designate an authorized agent to make a request on your behalf. To do so, you must:

• Provide the authorized agent written permission to submit the request
• Verify your identity directly with us
• Directly confirm with us that you provided the authorized agent permission to submit the request

California "Shine the Light" Law

California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not share your personal information with third parties for their direct marketing purposes without your consent.

California Minor Privacy Rights

Our website is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If you are under 18 and have created an account or made a purchase, you may request removal of your information by contacting us at hello@bysugarskin.com.

Do Not Track Signals

Our website does not currently respond to "Do Not Track" signals from web browsers. However, we provide you with the ability to control cookies through your browser settings and our Cookie Policy.

Changes to This Notice

We reserve the right to amend this California Privacy Rights Notice at our discretion and at any time. When we make material changes to this notice, we will post the updated notice on our website and update the "Effective Date" at the top.

Contact Information

If you have any questions or concerns about this California Privacy Rights Notice or our privacy practices, please contact us:

Effective Date: November 6, 2025
This California Privacy Rights Notice applies to all California residents and supplements our general Privacy Policy.