Privacy Policy

Last Updated: September 11, 2026

SHEPHERD ("SHEPHERD," "we," "our," or "us") respects your privacy and is committed to protecting it through this Privacy Policy. This Policy describes how we collect, use, disclose, retain, and safeguard personal information when you access or use our website located at shepherdskin.com (the "Site"), create an account, communicate with us, or purchase our products.

By accessing or using the Site, you acknowledge that you have read and understood this Privacy Policy.

1. Scope & Definitions

For purposes of this Privacy Policy:

"Personal Information" means information that identifies, relates to, describes, or could reasonably be linked to an identifiable individual.

"Sensitive Personal Information" has the meaning provided under applicable privacy laws (including the California Privacy Rights Act ("CPRA")). SHEPHERD does not intentionally collect or use Sensitive Personal Information except as necessary to fulfill a transaction, comply with law, or provide requested services.

"Service Providers" means third parties that process Personal Information on our behalf pursuant to written contractual obligations that limit their use of such information.

2. Information We Collect

We collect information through three primary channels: (A) information you provide directly, (B) information collected automatically, and (C) information from service providers.

A. Information You Provide Directly

We may collect the following Personal Information when you place an order, create an account, subscribe to communications, or contact us:

• Full name
• Email address
• Billing and shipping address
• Telephone number (used solely for transactional or service-related communications)
• Account login credentials
• Order history and purchase details
• Customer service communications and correspondence

Payment Information

All payments are processed by third-party payment processors. SHEPHERD does not store full credit or debit card numbers.

B. Account Information

If you create an account, we retain your account information to:

• Authenticate account access
• Maintain order history and preferences
• Provide customer service
• Improve Site performance and user experience

You may request account deletion at any time, subject to legal, regulatory, and operational retention requirements.

C. Information Collected Automatically

When you interact with the Site, we may automatically collect:

• IP address
• Device identifiers
• Browser type and version
• Operating system
• Pages viewed, time spent, and interaction data
• Referring URLs
• Cookies, pixels, and similar technologies

This information is used for Site functionality, security, analytics, fraud prevention, and operational integrity.

SHEPHERD does not collect biometric identifiers or biometric information as defined under applicable law.

We do not intentionally record keystrokes, screen activity, or session replays that capture sensitive input such as passwords or payment details.

3. Cookies & Tracking Technologies

We use cookies and similar technologies to:

• Enable essential Site functionality
• Maintain security and prevent fraud
• Analyze Site usage and performance
• Support limited marketing analytics

These technologies may be provided by trusted Service Providers, including analytics and advertising partners, and are configured to operate in a manner consistent with applicable privacy laws.

You may control cookies through your browser settings. Disabling cookies may impair certain Site features.

Certain features of the Site may use aggregated interaction data (such as page navigation and engagement metrics) to improve Site performance and user experience. Such data does not include the intentional recording of keystrokes, passwords, or payment information.

Cookie Categories

The Site deploys cookies in the following categories:

• Strictly Necessary Cookies: Required for core Site functionality, including shopping cart, checkout, and account authentication. These cookies cannot be disabled.
• Performance & Analytics Cookies: Used to understand how visitors interact with the Site, including page views, traffic sources, and engagement metrics. These are provided by third-party analytics services.
• Marketing Cookies: Used to support limited advertising analytics and measure the effectiveness of marketing campaigns. These may be set by third-party advertising partners.

You may manage your cookie preferences through our cookie consent banner displayed upon your first visit to the Site, or at any time through the "Cookie Preferences" link in the Site footer. You may also control cookies through your browser settings.

Do Not Track

The Site does not currently respond to browser "Do Not Track" signals, as no uniform industry standard has been adopted.

Global Privacy Control (GPC)

SHEPHERD is committed to honoring Global Privacy Control (GPC) signals as valid opt-out requests regarding the sale or sharing of Personal Information as defined under the CPRA. The detection and processing of GPC signals is managed through our third-party e-commerce platform provider (currently Shopify), which is configured to recognize GPC signals and adjust cookie and tracking behavior accordingly on our behalf. SHEPHERD relies on its platform provider's technical infrastructure to effectuate this opt-out. No further action is required from the user beyond enabling GPC in their browser or browser extension.

Advertising & Analytics Tracking Technologies

The Site uses third-party tracking technologies, including pixels, tags, and similar code provided by advertising and analytics platforms, to measure advertising performance, optimize campaigns, and analyze Site usage. These technologies may transmit certain data—including browsing activity (pages viewed, products viewed, add-to-cart and purchase events), device identifiers, IP address, and cookie identifiers—to the following categories of third-party platforms:

• Advertising Platforms (e.g., Meta/Facebook Pixel, and any future advertising platform integrations): Used to measure the effectiveness of advertising campaigns, build advertising audiences, and support ad optimization and retargeting. These platforms may use the data received to provide measurement and analytics services to SHEPHERD and, depending on the user's settings on those platforms, for their own advertising purposes.
• Analytics Platforms (e.g., Google Analytics): Used to analyze aggregate Site traffic, user behavior, traffic sources, and engagement patterns. Google Analytics may use cookies and device identifiers to collect this data. Google's use of data collected through Google Analytics is governed by the Google Privacy Policy and the Google Analytics Terms of Service.

Under the California Privacy Rights Act (CPRA), the transmission of identifiers and browsing data to advertising platforms via pixels and similar technologies may constitute "sharing" of Personal Information for purposes of cross-context behavioral advertising. SHEPHERD discloses this practice in accordance with CPRA requirements.

You may opt out of this sharing through any of the following methods:

• Enabling a Global Privacy Control (GPC) signal in your browser, which SHEPHERD honors through its platform provider as described above.
• Adjusting your cookie preferences through the cookie consent banner or the "Cookie Preferences" link in the Site footer.
• Adjusting your advertising and privacy settings directly on the applicable third-party platform (e.g., Meta Ad Preferences, Google Ad Settings).

When a valid opt-out is detected (including via GPC signal), advertising and analytics tracking technologies classified as non-essential will be suppressed through the consent management infrastructure provided by our e-commerce platform (currently Shopify). SHEPHERD relies on its platform provider to effectuate the suppression of these technologies.

SHEPHERD does not use data collected through advertising pixels or analytics platforms for purposes unrelated to advertising measurement, campaign optimization, or Site performance analysis. SHEPHERD does not sell Personal Information.

4. How We Use Personal Information

We use Personal Information strictly for legitimate business purposes, including:

• Processing and fulfilling orders
• Managing customer accounts
• Providing customer support
• Communicating about transactions, shipping, or service updates
• Improving Site functionality and user experience
• Detecting fraud, security threats, and misuse
• Complying with legal, regulatory, and tax obligations

We do not knowingly:

• Sell Personal Information
• Share Personal Information for cross-context behavioral advertising as defined under the CPRA, except as disclosed in the Advertising & Analytics Tracking Technologies section of this Policy
• Use Personal Information for medical diagnosis, treatment, or health determinations
• Engage in automated decision-making or profiling that produces legal or similarly significant effects

5. Marketing Communications

We send marketing emails only where:

• You have affirmatively opted in, or
• Permitted by applicable law

We do not engage in SMS or text message marketing.

You may opt out of marketing emails at any time via the unsubscribe link or by contacting support@shepherdskin.com. Transactional or service-related communications will continue as necessary.

6. Disclosure of Personal Information

We disclose Personal Information only as necessary and only to trusted Service Providers, including:

• E-commerce platform providers (including Shopify)
• Payment processors
• Shipping and fulfillment partners
• Website analytics, advertising, and security providers (including providers of website performance analytics and fraud prevention services)

All Service Providers are contractually obligated to protect Personal Information and to use it solely for authorized purposes consistent with this Privacy Policy.

We may also disclose Personal Information:

• To comply with applicable laws, regulations, subpoenas, or lawful requests
• To enforce our agreements or policies
• To protect the rights, safety, or property of SHEPHERD, our customers, or others

Platform Providers

Our website and e-commerce services are hosted and operated through third-party platforms, including Shopify. These platforms may collect and process certain personal information in order to provide, maintain, and secure the services they offer to us. Such processing is governed by their own privacy policies and contractual obligations. To learn more about how Shopify processes personal information, you may review the Shopify Consumer Privacy Policy.

Third-Party Applications & Integrations

SHEPHERD may use third-party applications integrated with the Site (including Shopify apps for email marketing, reviews, analytics, or other functionality). These applications may process certain Personal Information in connection with the services they provide. Such processing is governed by each application's own privacy policy and terms of service. SHEPHERD requires that all integrated applications maintain commercially reasonable data protection standards.

7. Data Retention

We retain Personal Information only for as long as reasonably necessary to:

• Complete transactions
• Maintain customer accounts
• Satisfy legal, accounting, tax, and regulatory obligations
• Resolve disputes and enforce agreements

When Personal Information is no longer required, it is securely deleted, de-identified, or anonymized in accordance with industry standards.

8. Your Privacy Rights

California Residents (CCPA / CPRA)

California residents have the right to:

• Know what Personal Information is collected and how it is used
• Request access to Personal Information
• Request deletion of Personal Information
• Request correction of inaccurate Personal Information
• Limit the use of Sensitive Personal Information (where applicable)
• Not be discriminated against for exercising privacy rights

California residents may request information regarding disclosures of Personal Information to third parties for direct marketing purposes pursuant to California Civil Code §1798.83. SHEPHERD does not disclose Personal Information for such purposes.

Requests may be submitted to support@shepherdskin.com.

We may require reasonable verification of identity before fulfilling requests. Requests that cannot be verified may be denied in accordance with applicable law.

Response Timeframes

Upon receipt of a verifiable consumer request, SHEPHERD will acknowledge receipt within ten (10) business days. SHEPHERD will provide a substantive response within forty-five (45) calendar days. If additional time is required, SHEPHERD will notify the requestor of the extension and the reason(s), and will respond within an additional forty-five (45) calendar days (for a maximum total of ninety (90) calendar days from the date of the original request).

Authorized Agents

California residents may designate an authorized agent to submit privacy requests on their behalf. To submit a request through an authorized agent, the agent must provide: (a) written authorization signed by the consumer, or (b) a valid power of attorney under California Probate Code §4000–4465. SHEPHERD may require the consumer to verify their own identity directly and to confirm that the agent has been authorized. Agent-submitted requests that cannot be verified may be denied.

Other U.S. State Privacy Rights

Residents of other U.S. states with privacy laws (including Virginia, Colorado, Connecticut, Utah, and Nevada) may have similar rights. SHEPHERD honors applicable state-level privacy obligations.

Nevada residents may submit opt-out requests regarding the sale of Personal Information by contacting support@shepherdskin.com. SHEPHERD does not sell Personal Information.

Expanded State Privacy Coverage

In addition to California and Nevada, residents of the following states may have privacy rights under their respective state privacy laws: Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. These rights may include the right to access, correct, or delete Personal Information; the right to opt out of the sale of Personal Information, targeted advertising, or profiling; and the right to appeal a denial of a privacy request. SHEPHERD honors all applicable state-level privacy obligations and will process requests in accordance with the laws of the requestor's state of residence. To exercise any applicable rights, contact support@shepherdskin.com.

International Users (Future Applicability)

SHEPHERD currently operates primarily within the United States. If we expand internationally, additional rights under applicable laws (including GDPR) will apply, and this Privacy Policy will be updated accordingly.

International Access Notice

The Site is accessible to users outside the United States. If you access the Site from outside the United States, please be aware that your Personal Information will be transferred to, processed, and stored in the United States, where data protection laws may differ from those in your jurisdiction. By using the Site and providing Personal Information, you consent to such transfer and processing. SHEPHERD relies on contractual protections with its Service Providers to safeguard internationally transferred data.

9. Data Security

We employ commercially reasonable administrative, technical, and physical safeguards designed to protect Personal Information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

To the extent permitted by law, SHEPHERD disclaims liability for unauthorized access, disclosure, or loss of Personal Information resulting from circumstances beyond our reasonable control.

Your Personal Information may be processed and stored by service providers located outside your state or country of residence. Where required by law, we rely on appropriate safeguards and contractual protections to support such processing.

Breach Notification

SHEPHERD maintains incident response procedures designed to detect and respond to data security incidents. In the event of a breach of security involving Personal Information, SHEPHERD will notify affected individuals and applicable regulatory authorities as required under California Civil Code §1798.82 and other applicable breach notification laws.

10. Children's Privacy

The Site is not intended for children under the age of 13, or under 16 where required by applicable law. SHEPHERD does not knowingly collect Personal Information from children. If we become aware that we have inadvertently collected such information, we will take commercially reasonable steps to delete it.

11. Third-Party Websites

The Site may contain links to third-party websites. SHEPHERD is not responsible for the privacy practices, policies, or content of third-party websites. SHEPHERD does not control, and is not responsible for, the data collection practices of third-party platforms, including advertising and social media platforms, operating independently of the Site. Interactions with third-party advertisements are subject to the privacy settings, preferences, and choices you configure on those platforms.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in law, technology, or business practices. The revised Policy will be posted on the Site with an updated effective date.

13. Categories of Personal Information Collected (CPRA Disclosure)

The following table summarizes the categories of Personal Information collected by SHEPHERD, the business purposes for which each category is used, and the categories of third parties to whom each category may be disclosed:

Except as described in the Advertising & Analytics Tracking Technologies section above, SHEPHERD does not sell or share the above categories of Personal Information as those terms are defined under the CPRA.

14. Notice of Financial Incentive

SHEPHERD may, from time to time, offer financial incentives as defined under the California Privacy Rights Act (CPRA). These incentives may include promotions such as a discount or other benefit offered in exchange for providing your email address and consenting to receive marketing communications, or benefits associated with creating an account on the Site (collectively, "Incentive Programs").

When you participate in an Incentive Program, we may collect the following categories of Personal Information: your name, email address, and, if you create an account, your shipping address, order history, and account preferences.

Participation in any Incentive Program is voluntary. You may opt in by following the instructions provided at the time the incentive is offered (such as entering your email address in a signup form or creating an account). You may withdraw from an Incentive Program at any time by unsubscribing from marketing emails via the unsubscribe link in any communication, by requesting account deletion at support@shepherdskin.com, or by contacting us using the information in the Contact section below.

The value of the Personal Information we collect in connection with an Incentive Program is reasonably related to the value of the discount or benefit provided. We estimate this value based on the expense related to offering the discount or benefit, including the cost of the product discount, the administrative cost of operating the Incentive Program, and the marketing value derived from being able to communicate with participants. SHEPHERD does not assign a monetary value to Personal Information outside of this context.

We will not deny services, charge different prices, or provide a different quality of service to consumers who choose not to participate in an Incentive Program.

15. Definition of "Sale" and "Sharing" Under State Privacy Laws

Under certain state privacy laws, including the CPRA, the term "sale" is defined broadly to include any disclosure of Personal Information to a third party in exchange for monetary or other valuable consideration. The term "sharing" includes disclosure of Personal Information to a third party for purposes of cross-context behavioral advertising, whether or not monetary consideration is exchanged.

As disclosed in the Advertising & Analytics Tracking Technologies section above, SHEPHERD uses advertising pixels and analytics tools that may transmit browsing data and device identifiers to third-party advertising platforms. This transmission may constitute "sharing" as defined under the CPRA. SHEPHERD does not disclose Personal Information in exchange for monetary payment and does not engage in the traditional sale of Personal Information.

You may opt out of sharing at any time by enabling a Global Privacy Control (GPC) signal in your browser, adjusting your cookie preferences through the Site's cookie consent banner, or contacting support@shepherdskin.com.

16. Sensitive Personal Information

SHEPHERD does not collect Sensitive Personal Information as defined under the CPRA, except to the limited extent necessary to complete a transaction you have initiated (such as billing address and payment information processed by third-party payment processors on our behalf).

SHEPHERD does not:

• Sell Sensitive Personal Information
• Share Sensitive Personal Information for purposes of cross-context behavioral advertising
• Use Sensitive Personal Information for any purpose other than what is necessary and anticipated to fulfill the transaction or provide the goods or services reasonably expected by the consumer

Because SHEPHERD does not use Sensitive Personal Information beyond transactional necessity, there is no need for consumers to exercise the right to limit the use and disclosure of Sensitive Personal Information. However, if you believe SHEPHERD holds Sensitive Personal Information about you and wish to make an inquiry, you may contact support@shepherdskin.com.

For clarity, SHEPHERD does not collect any of the following categories of Sensitive Personal Information: Social Security number, driver's license or state identification number, financial account credentials (log-in combined with password or security code), precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of private communications, genetic data, biometric data, health information, or information concerning sex life or sexual orientation.

17. Accessibility

SHEPHERD is committed to ensuring that this Privacy Policy is accessible to all users. If you require this Privacy Policy in an alternative format (such as large print or audio), please contact us at support@shepherdskin.com and we will make commercially reasonable efforts to accommodate your request.

18. Contact Information

For privacy inquiries or requests, contact:

Email: support@shepherdskin.com

Business Name: SHEPHERD

Mailing Address: 3941 Park Drive, PMB 251, El Dorado Hills, CA 95762 United States