Privacy Policy & Data Protection

1. Introduction & Scope

This Privacy Policy explains how SextoyUSA ("we", "us", "our", or the "Platform"), accessible via https://sextoysus.com, collects, processes, stores, protects, and discloses personal information obtained when you visit our website, register an account, utilize third-party authentication (such as Google Sign-In or Google One Tap), browse catalog items, or complete orders.

By accessing or using our services, you acknowledge that you have read, understood, and agreed to the practices outlined in this Privacy Policy. If you do not agree with our policies and practices, please refrain from using our services.

2. Information We Collect

We collect several categories of information to ensure seamless order processing, secure authentication, and personalized customer care:

A. Information You Voluntarily Provide

• Account & Profile Information: Full name, email address, password hash, contact phone number, and communication preferences.
• Shipping & Delivery Information: Full recipient name, physical street address, apartment/suite number, city, state/province, postal/ZIP code, and delivery instructions.
• Transaction & Order History: Records of purchased merchandise, order dates, SKU identifiers, order totals, shipping selections, return requests, and customer service correspondence.
• Customer Support Records: Inquiries, dispute records, and feedback submitted via email, phone, or live chat.

B. Information Collected Through Third-Party Sign-In (Google OAuth)

When you choose to create an account or sign in to SextoyUSA using Google Sign-In or Google One Tap, you authorize Google to share specific identity credentials with us. In accordance with your Google permission settings, we collect only the following essential profile data:

• Google User Identifier: Your unique Google numeric subject ID (sub) to link your Google login to your SextoyUSA account.
• Email Address: The primary email address associated with your Google Account, along with its email verification status.
• Full Name: Your first and last name as configured in your Google profile.
• Profile Picture URL: Your public Google profile avatar URL (used strictly for display in your account header).

Important: We do never request, collect, or have access to your Google account password, Google contacts, calendar entries, emails, Google Drive files, or any other data outside of basic identity authentication.

C. Payment Information & PCI-DSS Security

We prioritize payment security. All financial transactions are processed through certified, PCI-DSS Level 1 compliant payment gateways (such as Stripe, PayPal, or authorized merchant gateways). We never capture, store, or have direct access to your complete credit card numbers, debit card numbers, or CVV/CVC security codes on our servers. We only receive encrypted transaction tokens and payment confirmation statuses.

D. Automated Technical Telemetry & Device Data

When you navigate our site, our servers automatically log standard web telemetry, including:

• Internet Protocol (IP) address and approximate geographic region (city/state level).
• Browser type, version, language preferences, and operating system.
• Referring website, pages visited, timestamps, clickstream activity, and session durations.
• Essential session identifiers and device display parameters for cart continuity.

3. How We Use Your Information

We process your personal information strictly for legitimate, transparent business purposes:

• Account Creation & Authentication: Verifying your identity, enabling instant Google Sign-In or password authentication, maintaining logged-in sessions, and protecting against unauthorized access.
• Order Fulfillment & Logistics: Processing payments, packaging products, generating shipping labels, and facilitating delivery via trusted logistics partners (e.g., USPS, FedEx, UPS).
• Order Tracking & Notifications: Transmitting automated purchase receipts, dispatch alerts, tracking links, and delivery notifications.
• Customer Care & Warranty Support: Resolving support tickets, processing returns, managing cancellations, and assisting with product inquiries.
• Fraud Prevention & Platform Security: Detecting bot traffic, preventing fraudulent chargebacks, mitigating security vulnerabilities, and ensuring compliance with applicable e-commerce regulations.
• Legal & Regulatory Obligations: Complying with tax reporting, financial audits, dispute resolution, and legal proceedings.

4. 100% Discreet Packaging & Billing Guarantee

We recognize that personal wellness and adult novelties require the utmost discretion. We guarantee:

• Exterior Packaging: All orders are dispatched in completely plain, sturdy, unmarked boxes, padded mailers, or standard brown envelopes. There is no mention of "sex toys", adult novelty, or intimate products anywhere on the exterior shipping label or packaging.
• Return Address: The return address displays a neutral, discreet fulfillment identifier (such as "Fulfillment Logistics" or "VT Ventures") to protect your privacy from mail carriers, neighbors, or household members.
• Billing Statements: Charges on your credit card or bank statement appear under a discreet, non-descript merchant billing name.

5. Disclosure & Sharing of Information

We do not sell, rent, or lease your personal data. We only share information with authorized third-party service providers who assist us in operating our platform, subject to strict confidentiality and data protection obligations:

Recipient Category	Data Shared	Purpose
Shipping & Logistics Carriers (USPS, FedEx, UPS)	Name, shipping address, contact phone number	Physical transport and package delivery to your door
Payment Gateways (PCI-DSS compliant processors)	Billing address, payment token, order sum	Secure payment authorization and fraud screening
Cloud & Hosting Infrastructure	Encrypted server databases and session logs	Maintaining 99.9% platform availability and SSL security
Legal & Regulatory Authorities	Transaction records as legally mandated	Compliance with valid court orders, subpoenas, or statutory tax audits

6. Cookies & Tracking Technologies

We utilize small text files known as cookies to maintain website functionality:

• Essential Functional Cookies: Session tokens (e.g., PHPSESSID) required to keep items in your shopping cart across page navigation and verify login state.
• Authentication Cookies: Google Identity cookies (such as g_state) used solely to manage Google One Tap prompt dismissal cooldowns and prevent repetitive popups.
• Security & CSRF Cookies: Tokens utilized to verify form authenticity and prevent Cross-Site Request Forgery (CSRF).

You can manage or disable cookies through your web browser preferences. However, disabling essential cookies may impact your ability to log in or complete an order.

7. Data Retention & Deletion Policy

We retain your personal information for as long as your account remains active or as needed to provide you with services. If you close your account or request data deletion:

• We will permanently delete or anonymize your personal account data from our active databases within thirty (30) days of your verified request.
• Certain transaction and tax records may be retained for longer periods where mandated by statutory accounting, tax, and anti-fraud regulations.

8. Your Privacy Rights (CCPA / CPRA & GDPR Compliance)

Depending on your jurisdiction (including California, Colorado, Connecticut, Virginia, Utah, the European Economic Area, and the UK), you possess the following statutory rights:

• Right to Know & Access: You may request a detailed report of the categories and specific pieces of personal data we have collected about you over the preceding 12 months.
• Right to Deletion: You have the right to request the permanent deletion of your personal data, subject to limited statutory exceptions (such as fulfilling outstanding orders or tax compliance).
• Right to Rectification: You may correct inaccurate or incomplete personal information directly in your account profile or by contacting our team.
• Right to Opt-Out of Data Sale: Because we do not sell your personal data, no opt-out is necessary; nonetheless, we honor all opt-out signals (including Global Privacy Control / GPC).
• Right to Non-Discrimination: We will never discriminate against you, alter prices, or deny goods or services because you exercise any privacy right.

To exercise any of these rights, simply email our Privacy Compliance Officer at [email protected]. We will acknowledge receipt within 48 hours and process your verified request within 15–30 business days at no cost to you.

9. Strict Age Verification Policy (18+ / 21+)

Our products and services are strictly intended for legal adults aged 18 years or older (or 21 years of age in jurisdictions where mandated by local law). We do not knowingly market to, collect, or solicit personal information from individuals under the age of 18. If we discover that personal information of a minor has been submitted, we will immediately delete that information from our active records and cancel any pending orders.

10. Data Security Measures

We implement rigorous technical and organizational safeguards to shield your data against unauthorized access, loss, or disclosure:

• All web communications are encrypted via modern Transport Layer Security (TLS/SSL) 256-bit encryption.
• User passwords are encrypted using high-entropy irreversible cryptographic hashing (Bcrypt / Argon2).
• Administrative panels are protected behind multi-factor authentication, IP restrictions, and strict role-based access controls.

11. Changes to This Privacy Policy

We reserve the right to modify or update this Privacy Policy periodically to reflect technological advances, service modifications, or legal amendments. When changes are made, we will revise the "Last Updated" date at the top of this document. We encourage you to review this policy periodically.

12. Contact Information & Data Protection Inquiries

If you have questions, feedback, or requests regarding this Privacy Policy, your personal information, or Google OAuth data practices, please reach out to our dedicated privacy team: