Privacy Policy

Information You Provide

Placing an order. In your cart, you enter your name, email address, and shipping address. When you continue to payment, we pass those to Stripe, our payment processor, which takes your payment in secure payment fields shown right on our cart page. Your card details are typed directly into Stripe's fields and go straight to Stripe. They never pass through or get stored on our servers, and we never see your full card number. Once your order is placed, we send an order confirmation email (through our email provider, Resend) to the address you checked out with, summarizing what you ordered and where it's shipping, and later a shipping email with your tracking number.

Calculating shipping. Your cart asks for your shipping address to show you real carrier rates. That address is sent to our shipping provider, Shippo, to fetch live rate quotes, and is sent again, server-side, right before payment to confirm the exact rate charged. As you type your street address, it's also sent to Google Places to suggest matching addresses. A rate quote on its own isn't stored in a database of ours; your address is only kept as part of an order you actually place (see How Long We Keep Information below). Your browser also remembers what you typed on your own device, so you don't have to re-enter it (see Your cart and shipping details below).

Signing up for our discount. If you enter your email to get our welcome discount code, we email you the code and add your address to our email list, stored in our database. See Marketing Emails below for what that means and how to opt out.

Verifying for our service discount. We offer a discount to military members and their families, firefighters, EMS and medical services workers, law enforcement, and teachers and school staff. If you click “Verify with GovX” in your cart, you're taken to GovX, a third-party verification service, where you sign in or register and prove your affiliation to them directly. Whatever you give GovX (such as your account details and proof of service) goes to GovX under its own privacy policy; we never see it. GovX tells us only whether you were approved, which group or groups it approved you for (we look at this only to confirm you qualify, and don't store it), and an anonymous ID it assigns to you. We don't ask for or receive your name, email address, or date of birth. When you're approved, we create a one-time discount code in Stripe for you, keep a record linking that code to your GovX ID (so you can't be issued several at once and so we can trace a discount back to its verification), and save the code in a cookie in your browser (see Cookies below), where we apply it to your order for you. You never need to type it. The GovX ID is also recorded on an order that uses the discount. See GovX's privacy policy for how it handles your information.

Contacting us. The contact form on our Contact page sends what you enter (your name, email, the topic you select, your message, and any photos you attach) to us as an email, through Resend. We don't store submissions in a database of our own, only as the email itself. Please only attach photos relevant to your inquiry, such as your dog, your order, or our products. The required checkbox on that form only lets us reply about your inquiry. A second, optional checkbox, unchecked unless you tick it, adds your email to our email list for occasional marketing emails; sending a message without it doesn't sign you up for anything. Every marketing email has an unsubscribe link, and you can also opt out at any time on our Unsubscribe page or by emailing kylie@chaotick9creations.com.

Leaving a review. The form on our Leave a Review page asks for the order number and email you checked out with, to confirm you're a verified buyer, the same check used by Order Status below. Once that's confirmed, we ask for your name, a star rating, your review text, and optionally up to 3 photos. Your name, rating, and review text are stored in our database and, once we approve the review, published on that product's page under the name you provide. Photos are never stored, they exist only as an email attachment sent to us once, the same as Contact form photos above, so we can look at them while deciding whether to approve the review.

Your account. You can sign in at Account with just your email: we send a 6-digit code to it, and there is no password. Sign-in is run by Neon Auth, which stores your email address, your name if you give one, and your active sign-in sessions in our database. Once signed in you can see the orders placed on this website under that email, track them, leave reviews, message us, and use reward points. Orders placed on Etsy are not part of this website and don't appear in your account.

Messaging us. Messages you send from your account, and our replies, are stored in our database so you can read the conversation again. If you attach photos (up to 3 per message), they are stored there too and can only be viewed by you, while signed in, and by us. We email you when we reply, and we get an email when you write.

Reward points. When you place an order on this website we add reward points to a balance tied to your email address (1 point per $1 of items, before tax and shipping), take points back if the order is refunded, and keep a history of those changes. When you redeem points we create a one-time discount code with Stripe. Points don't expire.

Information Collected Automatically

Your cart and shipping details. While you're shopping, your cart (the styles, colors, lengths, and quantities you've picked) and the name, email, and shipping address you type into it are saved in your browser's local storage, on your device only, so they're still there if you leave and come back. We don't receive any of it until you ask for a shipping quote or continue to payment. Your browser also remembers your cookie-banner choice and whether you've already seen our discount offer. Clearing this site's data in your browser, or using a different device or browser, clears all of it.

Server logs. Like almost every website, ours runs on hosting infrastructure (Vercel) that automatically logs standard request data, such as IP address, browser type, pages requested, and timestamps, for security and reliability. These logs are kept only for a limited period, under Vercel's standard log retention. Separately, we also keep our own copy of each completed order in our database, as an internal backup alongside the Stripe Dashboard and to power the Order Status lookup, see How Long We Keep Information below for what that covers and for how long.

Site statistics. Our host, Vercel, also counts page views and measures how fast pages load (Vercel Web Analytics and Speed Insights), and we record a few events of our own there, like an order being completed (its total and item count, not who placed it). These work without cookies and don't identify you or follow you to other sites, so they run whether or not you accept the cookie banner.

Analytics. We use Google Analytics to understand overall site traffic, such as which pages get visited and roughly how many people shop here, so we know what's working. It only runs if you click “Accept” on the cookie banner shown on your first visit; nothing loads before that, and clicking “Decline” means it stays off. Google Analytics uses cookies (see Cookies below) and collects information like your approximate location, device/browser type, and the pages you view. It does not receive your name, email, address, or payment details. Those only go to the providers that need them to fill your order (see Who We Share It With below). See Google's Privacy Policy for how Google handles this data, and Google Analytics Opt-out Browser Add-on if you'd rather not be counted.

Advertising. We use Meta (Facebook) Pixel to measure how our Facebook and Instagram ads are performing and to build audiences for future ads. Like Google Analytics above, it only runs if you click “Accept” on the cookie banner; nothing loads before that. Meta Pixel sets its own cookies (see Cookies below) and shares information like your approximate location, device/browser type, and the pages you view with Meta, for ad measurement and retargeting. It does not receive your name, email, address, or payment details. This does mean we share some information with Meta for what California and similar state privacy laws call “cross-context behavioral advertising”, see Your Privacy Rights below for how to opt out (declining, or not accepting, the cookie banner keeps it off entirely). See Meta's Privacy Policy for how Meta handles this data, and Meta's Ad Preferences to control how your own Meta account, if you have one, is used for ads generally.

reCAPTCHA. Our forms (Contact, Order Status, Leave a Review, the discount signup, discount codes, account sign-in, account messages, reward redemption, and Unsubscribe), along with the shipping-quote and checkout flow, are protected by Google reCAPTCHA, which screens for automated/bot submissions. It runs invisibly (no puzzles to solve) and unconditionally, unlike Analytics above it's a security control, not a tracking or advertising script, so it isn't gated behind the cookie banner. Google reCAPTCHA may collect your IP address, device and browser information, and how you interact with the page, and sets its own cookie (see Cookies below). See Google's Privacy Policy for how Google handles this data.

Information From Other Sources

Reviews from our Etsy shop. Alongside reviews left on this website, we show reviews that customers left publicly on our Etsy shop. Some are fetched automatically from Etsy (the review text, its star rating, and the listing it was left on, with no name attached), and some we've picked by hand and show with the reviewer's first name as it appears on Etsy. We don't receive Etsy buyers' email addresses, postal addresses, or order details through this. If one of them is yours and you'd like it taken off this website, email us and we'll remove it.

Customer photos. The photos in our Gallery and elsewhere on the site were sent or shared by customers, and we post them with permission. A photo is credited with an Instagram handle only when the customer asked for that. If a photo of yours or your dog is on this site and you want it, or the credit, taken down, email kylie@chaotick9creations.com and we'll remove it.

Your Privacy Rights

Depending on where you live, you may have rights under applicable privacy law to:

• Access the personal information we hold about you tied to an order or inquiry
• Correct inaccurate information
• Delete your personal information
• Obtain a copy of your information in a portable format
• Opt out of targeted advertising or the sale/sharing of personal information. The only thing we do today that falls under this is Meta Pixel (see Advertising above), which only runs if you've clicked “Accept” on the cookie banner. Declining it, or changing your choice later with the Cookie Settings link at the bottom of every page (see Cookies below), opts you out of it entirely. We do not otherwise engage in profiling or sell personal information.
• Appeal if we deny a request

How to exercise these rights. We keep a copy of your order details, and any review you submit, in our own database, in addition to what's held by Stripe and Shippo (see Who We Share It With and How Long We Keep Information below). To exercise any of these rights, email us at kylie@chaotick9creations.com with your request. To protect your information, we may ask you to confirm details tied to your order (such as the email or name used at checkout) before acting on a request. We will respond within 45 days of a verifiable request, and will let you know if we need an additional 45 days for a more complex request. If we deny a request, we'll explain why, and you can appeal that decision by replying to our response.

Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a “Decline” on the cookie banner for that browser: Google Analytics and Meta Pixel don't load, their cookies are removed if they were set earlier, and the banner isn't shown. The older “Do Not Track” browser setting has no agreed standard, so we don't respond to it separately; analytics and advertising cookies are off for everyone until they click “Accept” anyway. We don't let other companies collect information about your browsing on this site except as described under Analytics and Advertising above.

Who We Share It With

We work with a small number of service providers to run this store, and share only what each one needs to do its job:

• Stripe, for payment processing, checkout, Virginia sales tax calculation, and the one-time discount codes you get by redeeming reward points or verifying with GovX. Stripe holds your order and payment records under its own privacy policy and retention rules.
• Shippo, for live shipping rate quotes and, after purchase, generating the actual shipping label from your order's address.
• Resend, for delivering our emails: order confirmations, shipping updates, marketing emails (see Marketing Emails below), your account sign-in codes, notifications about account messages, and messages you send through the Contact form. To send announcements, Resend also keeps a copy of our email list (email addresses and whether each has unsubscribed).
• GovX, only if you choose “Verify with GovX” for our service discount. You deal with GovX directly to prove your affiliation; we send it nothing about you, and it tells us only whether you were approved, as described above.
• Vercel, for website hosting, server logs, and cookieless site statistics, as described above.
• Neon, our database provider, which stores your order details (for the Order Status lookup), any review you submit, our email signup list, our unsubscribe list, your account, messages, and reward points, and the record linking a service-discount code to your GovX ID. Neon Auth also handles account sign-in.
• Etsy, which we fetch our shop's public reviews from, as described above. We don't send Etsy anything about visitors to this website.
• Google Places, which suggests matching addresses as you type your street address in the cart.
• Google reCAPTCHA, for bot and fraud detection on our forms, as described above.
• Google Analytics, for aggregate site traffic and usage statistics, as described above.
• Meta Platforms, Inc., for ad performance measurement and retargeting via Meta Pixel, as described above, only if you've accepted the cookie banner.

We do not sell, rent, or trade your personal information for money, and we don't share it with any party beyond what's listed here. Meta Pixel above is the one exception: it does share some browsing information with Meta for ad measurement and retargeting, which is why it's opt-in (gated behind the cookie banner) rather than on by default.

Legal and safety disclosures. We may also disclose information when we believe in good faith that it's necessary to comply with a law, court order, subpoena, or other valid legal request; to investigate or prevent fraud, a payment dispute, or abuse of the site; to enforce our Terms of Service; or to protect the rights, property, or safety of our customers, ourselves, or others. For example, we share order and delivery details with Stripe when responding to a chargeback, and with a carrier when filing a claim for a lost package.

Cookies

This site uses the following cookies:

These only load after you click “Accept” on the cookie banner shown on your first visit. Clicking “Decline” means none of these are set, including the Meta Pixel cookies. Your choice is remembered in your browser, and you can change it at any time with the Cookie Settings link at the bottom of every page. If you switch from Accept to Decline, we remove these cookies and reload the page so they stop loading.

A few cookies aren't part of the Accept/Decline choice above, since they are needed for the site to work or protect it and your payment rather than track you. When you sign in to your account, we set a sign-in cookie (customer_session) that keeps you signed in for up to 30 days or until you sign out. Google reCAPTCHA (see Information Collected Automatically above) sets its own cookie (_GRECAPTCHA) on the forms it protects. And on the cart page, Stripe's payment fields set fraud-prevention cookies (__stripe_mid, kept for a year, and __stripe_sid, kept for 30 minutes) that help Stripe spot fraudulent payments. If you use “Verify with GovX,” we set two more: a short-lived cookie (govx_state, 10 minutes) that makes sure the verification you return from is the one you started, and, once you're approved, a cookie (govx_verified, 24 hours) holding your verified status and your one-time discount code so the cart can apply it. Both are only set when you choose to verify, are digitally signed so they can't be altered, and aren't used for tracking or advertising. Everything you enter into those payment fields is handled under Stripe's Privacy Policy.

How Long We Keep Information

We keep our own database (with Neon, as described above) for your account, order records, reviews, account messages, and reward points. Account messages and their photos, and your points history, are kept for as long as your account exists or we need them for our records, and we'll delete them on request (see Your Privacy Rights above). The record linking a service-discount code to your GovX ID is kept for as long as we need it to prevent duplicate codes and to trace a discount, and we'll delete it on request. Order and payment records also live in Stripe, and shipping records in Shippo, retained under each provider's own policies and as required by law. Our own copy of each order (used for the Order Status lookup, to attribute reviews to the right product, and for our business and tax records) is kept for as long as we need it for those purposes, unless you ask us to delete it (see Your Privacy Rights above), except where we're required to keep it by law. A review you submit is kept indefinitely, whether it's approved, rejected, or never moderated, unless you ask us to delete it. We also keep short records of which orders have already received a review-request email and which unfinished checkouts have already received a cart reminder, so we never send either twice, for as long as the related record exists. Our email signup list is kept until you ask us to remove you, and our unsubscribe list is kept indefinitely, since its whole purpose is to make sure we never email you marketing again. Server logs are kept only for a limited period (as described above). Contact form emails are retained for up to 24 months, or longer if needed to resolve an active inquiry.

Marketing Emails

We may occasionally send marketing emails if you've signed up for our welcome discount, ticked the optional email-list box on the contact form, or placed an order. These include your welcome-discount code, occasional announcements (like new products or a sale), and a one-time email a couple of days after your order is delivered (or about three weeks after you ordered, if we don't get a delivery update) asking how it's holding up and inviting you to leave a review. If you enter your email in our cart and continue to payment but don't finish your order, we may also send you one reminder about the items you left behind (at most one a week). Every marketing email has an unsubscribe link at the bottom, and you can opt out any time on our Unsubscribe page or by emailing kylie@chaotick9creations.com. When you unsubscribe we keep your email address (and the reason, if you choose to give one) on a do-not-email list, so we can make sure you don't get marketing emails again. Opting out of marketing emails does not affect transactional emails, like order confirmations and shipping updates, tied to a purchase you've made.

Visitors Outside the United States

This site and our products are intended for customers in the United States, and we currently ship within the United States only. If you access this site from outside the US, please be aware that your information will be processed and stored on servers located in the United States, where privacy laws may differ from those in your country.

Children's Privacy

This site is intended for adults purchasing pet gear and is not directed at children. We don't knowingly collect information from anyone under 13, consistent with the Children's Online Privacy Protection Act (COPPA). If we learn that we've inadvertently collected information from a child under 13, we will delete it promptly. If you believe your child has provided us with information, please contact us at kylie@chaotick9creations.com.

Business Transfers

If Chaotic K9 Creations is ever involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We'll notify you via this page if your information becomes subject to a different privacy policy as a result.

Security

Payment information is handled entirely by Stripe, a PCI-compliant payment processor, it never passes through our own servers. No method of transmission or storage online is 100% secure, but we rely on established, reputable providers (Stripe, Shippo, Vercel) for everything involving your personal information.

Governing Law

This policy is governed by the laws of the Commonwealth of Virginia, without regard to conflict-of-law principles.

Changes to This Policy

If how we handle information changes, we'll update this page and revise the date at the top. For material changes, such as new categories of data collected or new ways we share it, we'll take reasonable steps to bring the change to your attention, such as a notice on the site.

Contact Us

Questions about this policy or your data? Email Chaotic K9 Creations, Hampton, Virginia, at kylie@chaotick9creations.com.