Privacy policy

Last updated: October 15, 2026

This Privacy Policy explains how Mammoth Headwear LLC ("Mammoth Headwear," "we," "us") collects, uses, and shares personal information when you visit www.mammothheadwear.com (the "Site"), make a purchase, or interact with our emails, texts, and ads. It also explains the choices you have, including how to opt out of targeted advertising, and the rights you have under California and other state privacy laws.

Please read this policy before using the Site. If you do not agree with it, do not use the Site.

1. Information We Collect

Information you give us. When you place an order, create an account, subscribe to our emails or texts, leave a review, take our fit quiz, or contact support, we collect what you provide: name, email address, phone number, shipping and billing addresses, payment information (processed by Shopify Payments or your chosen payment provider; we do not store full card numbers), order history, hat size, and the contents of your messages.

Information collected automatically. When you visit the Site, we and the third-party providers listed in Section 2 automatically collect information about your device and how you use the Site, including:

• IP address, approximate location derived from it, browser type, operating system, device identifiers, and screen size
• Pages and products you view, items you add to your cart, searches you run on the Site, and the links you click
• The website or ad that referred you to the Site and the time and date of your visit
• Cookie IDs, pixel IDs, and similar identifiers set by us or by the providers in Section 2

Information from other sources. We may receive information about you from our service providers and advertising partners (for example, whether an ad led to a purchase) and from social media platforms when you interact with our pages or ads there.

2. Cookies, Pixels, and Tracking Technologies

We use cookies, pixels, tags, software development kits (SDKs), and similar technologies on the Site. Some are set by us; most are set by third parties we have chosen to work with. Several of these technologies begin collecting information as soon as a page loads. The table below lists each provider, what it does, and the category it belongs to. You can opt out of the Advertising and Analytics categories as described in Section 5.

What these technologies collect. Depending on the provider, this includes your IP address, the URL of each page you visit, the page that referred you, the products you view or add to your cart, your device and browser identifiers, and cookie or pixel IDs. Some providers can link this information to an account you hold with them (for example, your Facebook or Google account) even if you are not logged in on our Site.

Do Not Track and Global Privacy Control. We honor the Global Privacy Control (GPC) browser signal as a valid request to opt out of the sale or sharing of your personal information, as described in Section 5. Because there is no common standard for Do Not Track signals, we do not respond to those separately; GPC and the opt-out tools in Section 5 are the methods we support.

3. How We Use Information

We use the information described above to:

• Process and ship your orders, handle returns and exchanges, and send order confirmations and shipping updates
• Create and manage your account and remember your cart
• Respond to your questions and support requests
• Send marketing emails and texts you have subscribed to, and let you unsubscribe
• Show you ads for our products on other websites and apps, and measure whether those ads work ("targeted" or "cross-context behavioral" advertising)
• Understand how the Site is used so we can fix problems and improve it
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enforce our terms

We do not use personal information to make decisions that produce legal or similarly significant effects about you, and we do not knowingly collect sensitive personal information as defined by California law.

4. How We Share Information

Service providers. We share information with companies that perform services for us and are contractually limited to using it for that purpose: Shopify (store hosting, payments, fraud screening, and Shopify Collabs creator attribution), shipping carriers and fulfillment partners including Printful, Klaviyo (email), Postscript (texts), GoAffPro (affiliate tracking), Richpanel (support chat), Stamped (reviews), Redo (returns), UpCart (cart), Alia (pop-ups), Instant (landing pages), Google Analytics and Triple Whale (analytics), and Intelligems (A/B testing).

Advertising partners ("sharing" and "selling" under California law). When you visit the Site, the advertising pixels listed in Section 2 send information about your visit to Google, Meta, TikTok, Pinterest, Snap, Reddit, Microsoft, X, OpenAI, and AppLovin. Those companies use it to show you our ads elsewhere and to improve their own advertising products. California law treats these disclosures as "sharing" for cross-context behavioral advertising and, in some cases, as a "sale" of personal information, even though no money changes hands. We do not sell personal information for money.

In the past 12 months we have shared or sold the following categories of personal information to advertising partners: identifiers (cookie and device IDs, IP address), internet activity (pages viewed, products viewed, cart activity, referring site), and commercial information (purchases).

You can opt out of this sharing at any time. See Section 5.

Legal and business transfers. We may disclose information to comply with law, respond to a subpoena or lawful request, protect our rights or the safety of others, or in connection with a merger, sale, or financing of our business.

Social media platforms. If you interact with our pages or ads on Facebook, Instagram, TikTok, Pinterest, Snapchat, Reddit, or X, those platforms collect information under their own privacy policies.

5. Your Choices: Opting Out of Tracking and Targeted Advertising

You can limit or stop the sharing described above in any of these ways. Each one takes effect in the browser or device where you use it.

Do Not Sell or Share My Personal Information. Click the "Your privacy choices" link in the footer of every page, or use the cookie preferences banner shown when you first visit. Turning off "Advertising" cookies stops the advertising pixels from loading; turning off "Analytics" cookies stops the analytics tools. Essential cookies needed for checkout cannot be turned off. You can change your choice at any time from the same link.

Global Privacy Control. If your browser or a browser extension sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sale and sharing and apply it automatically. Learn how to enable GPC at globalprivacycontrol.org.

Platform-level opt-outs. You can also limit ad targeting directly with each platform:

• Google: adssettings.google.com and the Google Analytics opt-out add-on
• Meta: Facebook Settings → Accounts Center → Ad preferences
• TikTok, Pinterest, Snapchat, Reddit, X: each app's ad or privacy settings; Microsoft: account.microsoft.com/privacy/ad-settings
• Industry tools: optout.aboutads.info (Digital Advertising Alliance) and optout.networkadvertising.org (Network Advertising Initiative)

Email and text marketing. Click "unsubscribe" in any marketing email, or reply STOP to any text. Transactional messages about your order will still be sent.

Browser cookie controls. Most browsers let you block or delete cookies. Blocking all cookies may prevent checkout from working.

6. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA, as amended by the CPRA) gives you the rights below. This section is our "Notice at Collection" and supplements the rest of this policy.

Categories of personal information we collect, and why. In the past 12 months we have collected these categories, for the purposes in Section 3: identifiers (name, email, phone, address, IP address, cookie and device IDs); customer records (billing and shipping details); commercial information (orders, cart activity, returns); internet activity (pages and products viewed, searches on the Site, referring site, clicks); approximate geolocation (from IP address); and inferences (for example, hat size or product interests). We retain this information as described in Section 8.

Your rights.

• Know and access: request the specific pieces and categories of personal information we have collected about you, where we got it, why we use it, and whom we share it with.
• Delete: request that we delete personal information we have collected from you, subject to legal exceptions (for example, we keep order records for tax and accounting purposes).
• Correct: request that we correct inaccurate personal information.
• Opt out of sale and sharing: stop the disclosures to advertising partners described in Section 4, using the methods in Section 5.
• Limit use of sensitive personal information: we do not collect sensitive personal information, so this right does not currently apply.
• Non-discrimination: we will not deny you products, charge a different price, or provide a different level of service because you exercised these rights.

How to submit a request. Email support@mammothheadwear.com with the subject line "California Privacy Request," or write to the address in Section 8. Tell us which right you are exercising and the email address or order number associated with your account so we can verify your identity. We will respond within 45 days and may extend by another 45 days with notice. You may use an authorized agent to make a request on your behalf; we will ask for proof that you authorized them.

Minors. We do not knowingly sell or share the personal information of consumers under 16.

Shine the Light. California Civil Code §1798.83 lets California residents request a list of third parties to whom we disclosed personal information for their own direct marketing in the prior year. Send such requests to support@mammothheadwear.com.

7. Other U.S. State Rights

Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out of targeted advertising or the sale of personal information. Use the methods in Sections 5 and 6 to exercise them. If we deny a request, you may appeal by replying to our response; we will explain the outcome of the appeal in writing.

8. Data Retention, Security, and Other Terms

Retention. We keep order records for as long as needed for accounting, tax, warranty, and fraud-prevention purposes, generally seven years. We keep account and marketing data until you ask us to delete it or unsubscribe. Analytics and advertising data is retained by the providers in Section 2 according to their own policies, typically 2 to 26 months.

Security. We use Shopify's PCI-compliant checkout and reasonable administrative and technical safeguards. No system is perfectly secure, and we cannot guarantee the security of information transmitted over the internet.

Children. The Site is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

International visitors. The Site is operated in the United States. If you visit from the EU, UK, or elsewhere, your information will be transferred to and processed in the United States. EU and UK residents may have rights to access, correct, delete, restrict, or port their data and to object to processing; contact us to exercise them.

Text messaging. If you opt in to texts, our Messaging Terms and Messaging Privacy Policy, provided by Postscript, also apply.

Changes. We may update this policy. The date at the top shows when it was last revised. Material changes will be posted on the Site before they take effect.

Contact us. Questions, complaints, or privacy requests:

Mammoth Headwear LLC
Attn: Privacy
1289 Reamwood Ave, Suite D
Sunnyvale, CA 94089
support@mammothheadwear.com