Privacy Policy

Last updated: May 7, 2026

This privacy notice for Boutique Rugs, LLC ("we," "us," or "our") describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:

Visit our website at https://boutiquerugs.com
Use Pierre, our personal rug curator service, to find rugs that fit your space
Place an order, manage an account, or contact our support team
Engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at [email protected].

Summary of Key Points

This summary provides key points from our privacy notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. This includes information you provide (your name, email, address, photos you upload to Pierre, messages you send to Pierre) and information collected automatically (IP address, browser characteristics, browsing activity). Learn more about personal information you disclose to us.

Do we process any sensitive personal information? We do not knowingly process sensitive personal information such as biometric identifiers, precise geolocation, government IDs, racial or ethnic origin, or health information. Photos uploaded to Pierre may incidentally contain people, addresses, or other identifying details visible in the room — we use these only to generate rug recommendations and do not extract biometric identifiers (such as face geometry) from them.

Do we receive any information from third parties? We may receive information from third parties such as payment processors, analytics and advertising partners, social networks (if you use social login), shipping carriers, and service providers who help us operate our Services.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, generate AI-powered rug recommendations through Pierre, secure our systems, prevent fraud, and comply with law. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We share information with service providers who help us operate, including AI providers (Anthropic, Google, and OpenAI) who process room photos and conversation messages on our behalf to power Pierre. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have organizational and technical processes and procedures in place designed to protect your personal information, including encryption in transit and at rest, access controls, and audit logging. However, no electronic transmission or storage technology can be guaranteed to be 100% secure. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located, applicable privacy law may give you certain rights regarding your personal information, including the right to access, correct, delete, or opt out of certain processing. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by submitting a data subject access request, by emailing us at [email protected], or by managing your account directly through our website.

Want to learn more about what we do with any information we collect? Review the privacy notice in full.

What information do we collect?
How do we process your information?
When and with whom do we share your personal information?
What is our stance on third-party websites?
Do we use cookies and other tracking technologies?
How do we handle your social logins?
How does Pierre process your photos and messages?
Is your information transferred internationally?
How long do we keep your information?
How do we keep your information safe?
Do we collect information from minors?
What are your privacy rights?
Controls for Do-Not-Track and Global Privacy Control
Do United States residents have specific privacy rights?
Do Canadian residents have specific privacy rights?
Do we make updates to this notice?
How can you contact us about this notice?
How can you review, update, or delete the data we collect from you?

1. What information do we collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, place an order, use Pierre, save items to your favorites or wishlist, write reviews, contact our support team, or otherwise engage with our Services.

Personal Information Provided by You. The personal information we collect may include:

Names
Phone numbers
Email addresses
Mailing addresses
Billing addresses
Contact preferences
Account credentials (username and password)
Order history and product preferences
Saved items, favorites, and wishlists
Reviews and ratings you submit, including any photos you upload with reviews
Pierre photos: photos you upload to Pierre — typically a photo of your room, but you may also upload inspiration images (a pillow, fabric, art, or screenshot)
Pierre conversation messages: the text messages you send Pierre during a consultation

Sensitive Information. We do not knowingly collect or process sensitive personal information such as biometric identifiers, precise geolocation, government identification numbers, financial account details (other than payment information processed by our payment processors), racial or ethnic origin, religious beliefs, or health information. Photos uploaded to Pierre may incidentally show people, addresses, or other identifying details visible in your room — we use these only to generate rug recommendations and do not derive biometric identifiers (such as face geometry, voiceprints, or fingerprints) from them.

Payment Data. We may collect data necessary to process your payment if you make purchases, such as your payment instrument number and the security code associated with your payment instrument. All payment data is stored by Shopify and PayPal. You may find their privacy notices here: https://www.shopify.com/legal/privacy and https://www.paypal.com/us/legalhub/privacy-full.

Social Media Login Data. We may provide you with the option to register or sign in using your existing social media account through our authentication partner Hiko, which currently supports providers including Google and Facebook. If you choose this option, we will collect the information described in the section called "How do we handle your social logins?" below.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your IP address and browser/device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not directly reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. See "Do we use cookies and other tracking technologies?" below.

The information we automatically collect includes:

Log and Usage Data. Service-related, diagnostic, usage, and performance information our servers automatically record. This includes IP address, device information, browser type and settings, and information about your activity in the Services (date/time stamps, pages and files viewed, searches, and other actions you take).
Pierre interaction data. When you use Pierre, we record metadata about your session — when it started, which actions you took (uploaded a photo, asked a question, viewed a recommended rug, added to cart), and how long the session lasted.

Third-party checkout. We may receive your order and delivery details (including personal information such as names, contact details, and shipping addresses) from OpenAI/ChatGPT when you purchase via ChatGPT Instant Checkout. We use these details solely to process, fulfill, support, and service your order in accordance with the disclosures made in this policy.

2. How do we process your information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, generate AI-powered rug recommendations, prevent fraud, and comply with law.

We process your personal information for the following reasons, depending on how you interact with our Services:

To create and manage your account. We process your information so you can create and log in to your account and keep your account in working order.
To deliver our Services. We process your information to provide the products and services you request, including order fulfillment, shipping, and customer support.
To power Pierre, our personal rug curator. We process the photos you upload and the messages you send to Pierre to generate recommendations, place rugs into your photo, save your consultation so you can resume it later, and personalize future consultations. This processing involves sharing your photos and messages with our AI service providers — see "How does Pierre process your photos and messages?" below.
To respond to user inquiries and offer support. We process your information to respond to your inquiries and resolve any potential issues.
To fulfill and manage your orders. We process your information to fulfill and manage your orders, payments, returns, and exchanges.
To request feedback. We may process your information to request feedback about our Services or your purchases.
To send marketing and promotional communications in accordance with your preferences. You can opt out at any time. See "What are your privacy rights?" below.
To deliver targeted advertising. We may process your information to develop and display content and advertising tailored to your interests, location, and product preferences.
To improve our Services and develop new features. We may process anonymized or aggregated information to understand how shoppers use our Services and to improve them.
For security, fraud prevention, and legal compliance. We may process your information to protect our Services, detect or prevent fraud, enforce our terms, comply with legal obligations, and respond to lawful requests.

3. When and with whom do we share your personal information?

In Short: We share information with service providers who help us operate our business, including AI providers who process Pierre photos and messages on our behalf. We do not sell your personal information for monetary consideration.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. We have written contracts in place with our service providers that prohibit them from using your personal information for any purpose other than providing services to us.

The categories of third parties we share personal information with include:

Category	Named Vendors	Purpose
E-commerce Platform	Shopify	Storefront infrastructure, checkout, order management
Cloud Infrastructure & Storage	Cloudflare	Hosting, content delivery, and storage of photos uploaded to Pierre
AI Providers	Anthropic (Claude), Google (Vertex AI / Gemini), OpenAI (GPT)	Processing of Pierre room photos, inspiration images, and conversation messages to generate recommendations and place rugs into your photo
Payment Processors	Shopify Payments, PayPal, Klarna	Payment processing, fraud screening, refunds
Email & Marketing	Klaviyo	Transactional and marketing email, back-in-stock notifications, abandoned-cart messages
Live Chat	FreshChat / Freshworks	Live customer support chat
Reviews	Trustpilot	Collecting and displaying customer reviews
Analytics	Google (Analytics, Tag Manager), Shopify Analytics	Understanding how shoppers use our Services and improving them
Advertising	Google Ads, Meta (Facebook, Instagram), Pinterest, TikTok	Targeted advertising on third-party platforms; you may opt out via "Your Privacy Choices" in our footer
Maps	Google Maps Platform	Location-based features such as store finder
Social Login	Hiko (with providers including Google and Facebook)	Account creation and authentication via social platforms
Order Fulfillment	Carriers and fulfillment partners	Shipping and delivery of physical products
Government Entities	Tax authorities, regulators, law enforcement	As required by law or in response to valid legal process

AI Providers — service-provider arrangement. We share photos uploaded to Pierre and the conversation messages you send Pierre with our AI service providers — currently Anthropic, Google, and OpenAI — solely to generate the AI consultation services you have requested. Our agreements with these providers prohibit them from using your data for any purpose other than providing services to us, including from using your data to train their general-purpose models. This sharing is not a "sale" of personal information and is not "sharing for cross-context behavioral advertising" under California or other state privacy laws.

We may also share personal information in the following situations:

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.
With Affiliates. We may share your information with our parent company, subsidiaries, joint venture partners, or other companies under common control with us, all of whom are bound to honor this privacy notice.
With your consent. We may disclose your personal information for any other purpose with your consent.

4. What is our stance on third-party websites?

In Short: We are not responsible for the privacy practices of third parties that we may link to or that may advertise on our Services.

The Services may link to third-party websites, online services, or mobile applications and may contain advertisements from third parties not affiliated with us. Their inclusion does not imply endorsement. We are not responsible for the content or privacy and security practices of any third parties. You should review their policies directly.

5. Do we use cookies and other tracking technologies?

In Short: We may use cookies and similar tracking technologies to collect and store information.

We use cookies, pixels, beacons, and similar tracking technologies to operate our Services and to understand how shoppers interact with them. These technologies fall into the following categories:

Strictly Necessary. Required for the Services to function — including session cookies, cart cookies, authentication tokens, and security tokens. These cannot be turned off.
Functional. Remember your preferences (language, region, recently viewed products, Pierre conversation continuity).
Analytics. Help us understand how shoppers use our Services so we can improve them. Includes Google Analytics, Shopify Analytics, and similar tools.
Advertising and Marketing. Used to deliver and measure advertising on our Services and on third-party platforms (such as Google, Meta, Pinterest, and TikTok). Includes social-media tracking pixels.

You can control non-essential cookies through our cookie banner, through the "Your Privacy Choices" link in our footer, or through your browser settings. We honor browser-level Global Privacy Control (GPC) signals as a request to opt out of the sharing of personal information for cross-context behavioral advertising. See "Controls for Do-Not-Track and Global Privacy Control" below.

6. How do we handle your social logins?

In Short: If you choose to register or log in using a social media account, we may have access to certain profile information.

Our Services offer the ability to register or log in using your existing third-party account through our authentication partner Hiko, which currently supports providers including Google and Facebook. When you choose this option, we receive certain profile information from your provider — typically your name, email address, and profile picture. We use this information only for the purposes described in this privacy notice or as otherwise made clear to you on the relevant Service.

We do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend you review the relevant provider's privacy notice to understand how they collect, use, and share your information.

7. How does Pierre process your photos and messages?

In Short: Pierre uses artificial intelligence to generate rug recommendations from photos you upload and messages you send. Your photos and messages are processed by our AI service providers (Anthropic, Google, and OpenAI) under contracts that restrict them from any other use.

Pierre is an AI-powered rug curator service. When you use Pierre:

You may upload photos of your room or other inspiration images (a pillow, fabric, art, or screenshot) and send messages describing what you're looking for.
We process those photos and messages to generate rug recommendations from our catalog and to render selected rugs into your room photo so you can see how they would look.
Photos and messages are stored on our infrastructure (Cloudflare R2 for photos, our application servers for conversation messages) and are also sent to our AI service providers — currently Anthropic (Claude), Google (Vertex AI / Gemini), and OpenAI (GPT) — for inference.
Our agreements with these AI providers require them to process your data solely to provide the requested services to us. They are contractually prohibited from using your data to train their general-purpose models, to share it with other customers, or to use it for any purpose other than serving Pierre.

What we don't do:

We do not sell your photos or messages.
We do not use your photos or messages to train third-party AI models.
We do not extract biometric identifiers (such as face geometry) from photos that incidentally include people.
We do not use Pierre photos for advertising purposes.

Human review. A small number of Pierre conversations may be reviewed by our team for quality, safety, and abuse-prevention purposes. Reviewers are bound by confidentiality and access only the minimum information needed.

Retention of Pierre data. See "How long do we keep your information?" for specific retention periods. In short: photos uploaded by anonymous visitors are deleted within 90 days; photos uploaded by signed-in shoppers are kept until you delete them or close your account; and Pierre conversations are deleted automatically after 24 months of inactivity.

Anonymized and aggregated data. We may use photos and conversation messages to generate anonymized and aggregated analytics that help us improve Pierre and our Services — for example, to measure recommendation quality, identify common shopping patterns, or evaluate the performance of new features. Once data has been stripped of identifiers and combined with information from other shoppers in a way that does not reveal any individual, it is no longer personal information under applicable privacy laws and we may retain it indefinitely.

Your choices. You can delete individual photos and conversations from your account at any time. Deleting your account will delete all associated photos and conversations from our active systems. See "How can you review, update, or delete the data we collect from you?" below.

8. Is your information transferred internationally?

In Short: Our primary servers are located in the United States. Your information may also be processed by service providers in other countries.

Our primary servers and storage are located in the United States. Some of our service providers — including AI providers, analytics providers, and email platforms — may process your information in additional countries (including Canada, the European Economic Area, the United Kingdom, India, and other regions where they operate data centers). We require all our service providers to apply protections substantially equivalent to those described in this privacy notice and to comply with applicable data protection laws.

9. How long do we keep your information?

In Short: We keep your information only as long as necessary for the purposes described in this notice or as required by law. Specific retention periods are listed below.

We retain personal information for the following periods:

Data category	Retention period
Account data (name, email, address, password)	Until you delete your account, plus a brief retention period for fraud prevention and legal compliance
Order and transaction data	As required by tax, accounting, and consumer-protection laws (typically 7 years)
Pierre photos — anonymous shoppers (not signed in)	Up to 90 days from upload, after which they are deleted automatically. This window lets returning visitors resume a recent consultation.
Pierre photos — signed-in shoppers	Until you delete the photo, your account, or your saved consultation
Pierre conversation messages	Active conversations: until you delete them or your account. Inactive conversations (no activity for 24 months): deleted automatically.
Anonymized and aggregated data derived from Pierre photos and conversations	Indefinite. Once we have removed identifiers and combined the data with information from other shoppers in a way that no longer reveals any individual, the resulting analytics, model-evaluation metrics, and product-improvement insights are no longer personal information and may be retained without time limit.
Customer support tickets and live chat transcripts	Up to 24 months
Marketing email subscriber list	Until you unsubscribe, plus a brief retention period to honor the unsubscribe request
Analytics data (pseudonymous behavior data)	Up to 14 months (Google Analytics default)
Server logs and audit logs	Up to 12 months for security and operational purposes
Reviews and product ratings	Until you request removal or as long as the product is in our catalog

When we no longer need your personal information for the purposes for which it was collected, we will either delete it or anonymize it so that it can no longer be associated with you. Where deletion is not possible (for example, because the information is in backup archives), we will securely store it and isolate it from any further processing until deletion is possible.

10. How do we keep your information safe?

In Short: We protect your personal information through organizational and technical security measures.

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process, including:

Encryption in transit using TLS
Encryption at rest for stored data
Access controls limiting who can view or modify personal information
Audit logging to detect and investigate unauthorized access
Regular security reviews and vulnerability monitoring
Contractual security obligations on our service providers

However, despite our safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. We cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk.

11. Do we collect information from minors?

In Short: We do not knowingly collect data from or market to children under 13 years of age.

Our Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. By using the Services, you represent that you are at least 13 years of age, or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If you are between 13 and 18, you may use the Services only with the involvement and consent of a parent or legal guardian.

If we learn that we have collected personal information from a child under 13 without verified parental consent, we will deactivate the account and take reasonable measures to promptly delete the data. If you become aware of any data we may have collected from a child under 13, please contact us at [email protected].

12. What are your privacy rights?

In Short: You may review, update, or delete your account information at any time. Depending on your state of residence, you may have additional rights under applicable privacy law.

Subject to applicable law, you may have the right to:

Know what personal information we collect, use, and share about you
Request a copy of your personal information
Correct inaccurate personal information
Request deletion of your personal information
Opt out of the sharing of personal information for cross-context behavioral advertising or targeted advertising
Withdraw consent to processing where consent is the legal basis
Limit the use of sensitive personal information (where applicable)
Not be subject to discrimination for exercising your rights

State-specific rights are described in "Do United States residents have specific privacy rights?" below.

How to exercise your rights

You can exercise your rights in any of the following ways:

Through your account: Log in to update your profile, manage your preferences, delete saved photos and Pierre conversations, or delete your account entirely.
Through our request portal: Submit a data subject access request.
By email: Email [email protected].
For advertising opt-out: Click "Your Privacy Choices" in our website footer.

We respond to verifiable requests within the time required by applicable law (typically 45 days under California law, with one possible 45-day extension when reasonably necessary).

Withdrawing your consent

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. You can do this by contacting us at [email protected]. Withdrawal of consent does not affect the lawfulness of any processing conducted before withdrawal.

Opting out of marketing communications

You can unsubscribe from marketing emails by clicking the unsubscribe link in any email we send. You can opt out of marketing SMS by replying "STOP" or "UNSUBSCRIBE" to any text we send. We may still send you transactional and service-related messages necessary for the administration of your account.

Account information

You may review or change your account information at any time by:

Logging in to your account settings and updating your information, or
Contacting us at [email protected].

Upon your request to terminate your account, we will deactivate or delete your account and remove your information — including Pierre photos and conversations — from our active databases. We may retain limited information in our backups, fraud-prevention records, and as required to comply with legal obligations, resolve disputes, and enforce our agreements.

13. Controls for Do-Not-Track and Global Privacy Control

Most web browsers, mobile operating systems, and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for DNT signals has been finalized; we do not currently respond to DNT browser signals.

Global Privacy Control (GPC). We honor browser-level Global Privacy Control signals as an opt-out of the sharing of personal information for cross-context behavioral advertising as required by California and other state privacy laws. If your browser sends a GPC signal, we will treat it as a verified request to opt out of such sharing without requiring further action from you.

14. Do United States residents have specific privacy rights?

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or other states with comprehensive privacy laws, you may have specific rights regarding your personal information.

Categories of personal information we collect

We have collected the following categories of personal information in the past twelve (12) months:

Category	Examples	Collected
A. Identifiers	Name, alias, postal address, telephone number, unique personal identifier, online identifier, IP address, email address, account name	YES
B. Personal information as defined in the California Customer Records statute	Name, contact information, financial information	YES
C. Protected classification characteristics under state or federal law	Age, gender (if voluntarily provided)	YES (only when voluntarily provided)
D. Commercial information	Transaction information, purchase history, payment information	YES
E. Biometric information	Fingerprints, voiceprints, face geometry	NO
F. Internet or other similar network activity	Browsing history, search history, online behavior, interactions with our and other websites and advertisements	YES
G. Geolocation data	Approximate location derived from IP address (not precise GPS)	YES (approximate only)
H. Audio, electronic, visual, thermal, olfactory, or similar information	Photos uploaded to Pierre and review media	YES
I. Professional or employment-related information	Business contact information for B2B inquiries	YES (only for B2B contacts)
J. Education information	Educational records	NO
K. Inferences drawn from other personal information	Profile inferences for marketing personalization (style preferences, room types, price range)	YES
L. Sensitive personal information	Account log-in credentials in combination with passwords; precise geolocation	YES (account log-in credentials only; we do not collect precise geolocation, government IDs, racial or ethnic origin, religious beliefs, sexual orientation, biometric information, or health information)

We may also collect other personal information outside of these categories through interactions with you in person, by email, by phone, or by mail in the context of receiving customer support, participating in surveys, or otherwise communicating with us.

How we use and share your personal information

Learn how we use your personal information in "How do we process your information?" and how we share it in "When and with whom do we share your personal information?" above.

Sale or sharing of personal information

We do not sell your personal information for monetary consideration. Under California and other state privacy laws, "sharing" can also include sharing for cross-context behavioral advertising. Subject to your privacy choices, we may share the following categories of personal information for targeted advertising on third-party platforms:

Identifiers (Category A)
Internet or other similar network activity (Category F)
Inferences (Category K)

Photos and Pierre conversations are not shared for advertising. We share photos uploaded to Pierre and Pierre conversation messages only with our AI service providers (Anthropic, Google, and OpenAI) for the limited purpose of generating recommendations and rendering placement images on our behalf. This is a service-provider relationship governed by written contracts that prohibit any other use, and is not a "sale" or "sharing for cross-context behavioral advertising" under applicable law.

You can opt out of the sharing of your personal information for cross-context behavioral advertising by clicking "Your Privacy Choices" in our website footer or by sending a Global Privacy Control signal from your browser.

Your rights as a US resident

Depending on your state of residence, you may have the following rights:

Right to know / right of access: request the categories and specific pieces of personal information we have collected about you.
Right to delete: request deletion of your personal information.
Right to correct: request that we correct inaccurate personal information.
Right to data portability: request a copy of your personal information in a portable format.
Right to opt out of sale or sharing: opt out of the sale of your personal information or its sharing for cross-context behavioral advertising.
Right to limit the use of sensitive personal information: limit our use and disclosure of sensitive personal information.
Right to non-discrimination: we will not discriminate against you for exercising any of your rights.
Right to appeal: if we deny your request, you may appeal our decision.

To exercise these rights, follow the instructions in "What are your privacy rights?" above.

You may designate an authorized agent to make a request on your behalf. We will require verification that you have authorized the agent to act on your behalf.

Verification

To process your request, we may need to verify your identity. We will ask you to provide information that allows us to reasonably verify you are the person about whom we collected the personal information. We will use this verification information solely to verify your identity.

Notice of Financial Incentives

From time to time we offer financial incentives in exchange for the collection or retention of certain personal information from California residents. The incentives we currently offer or may offer include:

Newsletter signup discount. A one-time discount on your first order, or a similar perk such as free shipping or early access, in exchange for subscribing to our marketing emails. The current offer is presented at the signup form on our website.
Boutique Rugs Rewards (loyalty program). Members earn points on purchases and other actions, redeemable for discounts and other benefits. You can join and learn more at boutiquerugs.com/pages/rewards.
Other promotional offers. We may from time to time run referral programs, birthday discounts, SMS-opt-in discounts, or similar promotions. The terms of each promotion will be disclosed at the time the offer is made.

Personal information collected. The categories of personal information collected when you participate in these incentives may include identifiers (such as name and email address), commercial information (such as purchase history), and Internet or other similar network activity (such as engagement with our communications and rewards account).

Material terms. Joining any of these programs is free and voluntary. You may withdraw at any time by unsubscribing from our marketing emails using the unsubscribe link in any email, by replying STOP to marketing SMS, by adjusting your account preferences, or by contacting us at [email protected]. Withdrawing from a program does not affect points or rewards already earned, although ongoing membership may be required to redeem certain benefits.

How we calculate the value of your data. We have made a good-faith determination that the value of the financial incentives offered is reasonably related to the value of the personal information you provide. Our calculation considers the cost of providing each incentive, the operational expense of administering the program, and the marketing and customer-relationship value generated by the data you share. Because the incentives are designed to fund themselves through expanded customer engagement and repeat purchases, the value we provide is, in our reasonable estimation, equal to or greater than the value of the personal information collected.

You are not required to participate in any of these programs to use our Services. You may withdraw from any program at any time as described above without penalty other than the loss of the incentive itself.

California "Shine The Light"

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. To make such a request, please email [email protected].

15. Do Canadian residents have specific privacy rights?

In Short: Canadian residents have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws (including Quebec's Law 25).

If you are a resident of Canada, you have the right to:

Request access to and a copy of your personal information
Request correction of inaccurate personal information
Withdraw consent to processing
Lodge a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner

To exercise these rights, please email [email protected] or use the methods described in "What are your privacy rights?" above.

Quebec residents have additional rights under Law 25, including the right to data portability and protection against automated decision-making with significant effects. Pierre's recommendations do not constitute automated decision-making with significant legal or similarly significant effects on you.

16. Do we make updates to this notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws and reflect changes to our practices.

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last updated" date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to stay informed of how we protect your information.

17. How can you contact us about this notice?

If you have questions or comments about this notice, you may contact us at:

Boutique Rugs, LLC
Attn: Privacy Team
650 Ponce De Leon Ave, Ste. 300 #1445
Atlanta, GA 30308
United States
Email: [email protected]
Phone: 1-855-585-4040

18. How can you review, update, or delete the data we collect from you?

Based on the applicable laws of your country or state of residence, you may have the right to:

Request access to the personal information we collect from you
Request details about how we have processed it
Correct inaccuracies
Delete your personal information

You may also have the right to withdraw your consent to our processing of your personal information.

To request to review, update, or delete your personal information, please:

Log in to your account and use the account-management tools, including the option to delete your account along with all associated photos and Pierre conversations
Submit a data subject access request
Email us at [email protected]

We will respond to your request in accordance with applicable law.