Conifer Kingdom

Privacy Policy

1. Who we are

This website, www.coniferkingdom.com (the "Site"), is operated by MS Rare LLC. dba Conifer Kingdom, a nursery located at 6450 Brush Creek Drive Northeast Silverton, OR 97381 ("Conifer Kingdom", "we", "us"). We sell and ship living plants within the United States.

This Privacy Policy explains what personal information we collect when you visit the Site, place an order, create an account, contact us or sign up for our messages, how we use it, who we share it with, and the choices you have. It applies to the Site and to our customer communications. It does not apply to third-party websites we link to, including our social media pages.

2. What we collect and where it comes from

Information you give us

• Order and account details: name, billing and shipping address, email address, phone number, order contents, gift messages, order notes, gift-card recipient details, and your account password (stored only in hashed form).
• Payment details: entered directly into forms provided by our payment processors (Braintree, PayPal, Google Pay). We receive a confirmation, the payment method type and the last four digits of the card only.
• Communications: messages you send us through contact forms, email, phone or SMS, product reviews, and your answer to "Where did you hear about us?" at checkout.
• Marketing sign-ups: your phone number or email when you subscribe to text or email offers.

Information collected automatically

• Device and usage data: IP address, approximate location derived from it (country and state), browser type and settings, device identifiers, pages viewed, products viewed and added to cart, searches, referring site, and the date and time of visits.
• Cookies and similar technologies: described in section 4, including advertising identifiers set by Google and Meta when you allow them.
• Attribution data: the campaign, ad or link that brought you to the Site (for example UTM parameters and click identifiers such as fbclid), stored in a first-party cookie and attached to your order so we know which advertising works.
• Security and anti-fraud signals: browser and device characteristics analyzed by our anti-spam (CleanTalk), bot-protection (Cloudflare Turnstile) and payment fraud-prevention (Braintree, PayPal) providers.

Information from other sources

• Payment processors (payment status, fraud signals), shipping carriers (delivery status), advertising platforms (aggregate campaign performance), and our SMS/email providers (delivery and engagement).

We do not collect Social Security numbers, government IDs, precise geolocation, biometric data or health information, and we do not want you to send them to us.

3. How we use your information

• To fulfill orders: process payment, calculate tax and shipping, grow and pack your plants, ship them, send order and delivery updates, honor our 45-Day Growing Guarantee, and handle returns, replacements and gift cards.
• To run your account: log you in, show your order history, remember your cart.
• To support you: answer questions, provide planting and care advice, resolve issues.
• To market our plants: send offers and news by email or text where you have signed up, show you our ads on other sites and apps, measure whether our advertising works, and understand which products and pages our visitors like.
• To keep the Site safe: detect bots, spam, fraud and abuse; secure our systems; enforce our terms.
• To comply with law: tax and accounting records, agricultural shipping requirements, responding to lawful requests.

We use analytics and advertising data only with your consent where the law or our consent tool requires it (see section 4). We do not use automated decision-making that produces legal or similarly significant effects about you.

4. Cookies, pixels and tracking technologies

Cookies are small files stored by your browser; pixels and tags are small pieces of code that let a provider know you visited a page or took an action. We group them into three categories. You can review and change your choices at any time via Your Privacy Choices (also linked in the footer of every page).

How consent works on our Site

• Opt-in regions. If you visit from California, Pennsylvania, Florida, Washington, Illinois, Maryland or Massachusetts, or from outside the United States, or if we cannot determine your location, no analytics or marketing technology loads until you click "Allow all" or enable a category in the settings panel. "Reject all" keeps only necessary cookies.
• All other US states. Analytics and marketing technologies load when you arrive, and you can turn them off at any time with "Do Not Sell or Share My Info" or in the settings panel. Doing so stops them and deletes their cookies.
• Global Privacy Control (GPC). If your browser sends the GPC signal, we treat it as an opt-out of analytics and marketing everywhere, automatically. You can override it only by explicitly enabling a category in the settings panel.
• Your choice is remembered for 12 months in a first-party cookie (ck_consent), and we keep a record of the choice (date, categories chosen, region, a hashed IP address and browser type, but no name or email) so we can demonstrate compliance. We ask again if this policy materially changes.

Necessary (always on)

Required for the Site to work: cart and checkout, login, payment security, spam and bot protection, and remembering your privacy choices. You cannot switch these off, but you can block them in your browser (the shop will then not work properly).

Analytics

Helps us understand which pages and plants are popular and how the Site performs.

Marketing

Lets us show you relevant offers on other sites and apps, measure our advertising, and send you text messages you signed up for.

We may update the list of providers from time to time; the current list always applies. We do not use session-recording or screen-replay tools on our Site.

Do Not Track

Browsers offer a "Do Not Track" (DNT) setting that has no agreed meaning, and we do not respond to it. We do respond to the Global Privacy Control signal, as described above.

5. Who we share information with

We share personal information only as described here. We do not sell it for money.

• Service providers that work on our behalf under contracts restricting their use of your data: payment processing (Braintree/PayPal, Google Pay), sales-tax calculation (Avalara), shipping and fulfillment (ShipStation, UPS/FedEx/USPS and other carriers), package protection (Route, when you add it), hosting, content delivery and security (Cloudflare, our hosting provider), anti-spam (CleanTalk), email delivery, customer support tools, and accounting.
• Advertising and analytics partners (Google, Meta) that receive device and browsing information through cookies and pixels, and hashed order details, as described in section 4. These partners may combine this information with data they hold about you. Under some state privacy laws this is "sharing" for cross-context behavioral advertising or "targeted advertising"; you can opt out via Your Privacy Choices.
• SMS and email platform (Attentive) to send messages you have signed up for.
• Legal and safety: when required by law, subpoena or court order; to protect the rights, property or safety of Conifer Kingdom, our customers or others; to investigate fraud or abuse.
• Business transfers: if we sell or merge our business, your information may be transferred to the new owner, who must honor this policy.

We do not share personal information with third parties for their own direct marketing purposes.

6. SMS and email marketing

Email. We send order and account emails to every customer. We send marketing emails only where you have signed up or purchased from us; every marketing email has an unsubscribe link. Marketing emails are sent through Mailchimp.

Discounts for signing up. When we offer a discount in exchange for subscribing, that is a financial incentive under California law. The value of your data to us is reasonably related to the discount, which we estimate from the expected additional purchases of subscribers. You may withdraw at any time by replying STOP or unsubscribing; the discount already applied is not affected.

7. Your privacy rights

Depending on where you live, you may have the right to:

• Know / access the personal information we hold about you and receive a copy in a portable format;
• Correct inaccurate information;
• Delete your information, subject to exceptions (for example we must keep order records for tax and warranty purposes);
• Opt out of the sale or sharing of your information, of targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not do such profiling);
• Limit the use of sensitive personal information (we do not use sensitive information for anything other than what the law allows without an opt-out);
• Not be discriminated against for exercising your rights.

How to exercise them

• Cookies and advertising: use the settings panel above, click "Do Not Sell or Share My Info" on the banner, or enable Global Privacy Control in your browser.
• Marketing messages: reply STOP to any text; use the unsubscribe link in any email.
• Access, correction, deletion, portability: email [[email protected]] or call [503-874-4123]. You can also update most account details by logging in.

Verification. To protect your data we will verify your request by matching the information you give us (such as your email address and a recent order number) with our records, and may ask for more information if needed. Authorized agents may submit requests on your behalf with written permission from you; we may still verify your identity directly with you. We respond within 45 days and will tell you if we need more time. If we deny a request, you may appeal by replying to our response; we will explain the outcome of the appeal in writing and, where applicable, tell you how to contact your state attorney general.

8. California notice at collection (CCPA/CPRA)

This section applies to California residents and supplements the rest of this policy. The table shows the categories of personal information we have collected in the preceding 12 months, our purposes, and whether the category is "sold" or "shared".

Sources: you, your device and browser, our service providers and advertising partners. Retention: see section 10. Sale: we do not sell personal information and have not done so in the preceding 12 months. Sharing: we share the categories marked above with Google and Meta for cross-context behavioral advertising; California visitors see an opt-in banner and nothing is shared until you allow it. We have no actual knowledge that we sell or share the personal information of consumers under 16.

Your California rights: the rights in section 7, including the right to opt out of sharing via the "Do Not Sell or Share My Personal Information" link and the Global Privacy Control signal, which we honor as a valid opt-out request. We do not offer a financial incentive except the marketing sign-up discount described in section 6. Shine the Light (Civ. Code &1798.83): we do not disclose personal information to third parties for their own direct marketing purposes. Requests: [[email protected]] or [503-874-4123].

9. Residents of other states

If you live in Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you have the rights in section 7 under your state's privacy law, including the right to opt out of targeted advertising and the sale of personal data and to appeal our decision on a request. We honor the Global Privacy Control signal as an opt-out of targeted advertising and sale where your state requires it. We do not sell personal data as defined by those laws. Nevada: we do not sell covered information as defined in NRS 603A. Residents of other states may contact us with any privacy request and we will consider it in good faith.

10. How long we keep information

• Orders and accounts: for as long as you have an account and for 7 years after your last order, to meet tax, accounting, guarantee and dispute requirements.
• Marketing subscriptions: until you unsubscribe, plus a suppression record so we do not contact you again.
• Support messages: 2 years after the last contact.
• Privacy-choice records: 180 days on our servers; your choice cookie lasts 12 months.
• Analytics and advertising data: per the retention periods of the cookies listed above and our partners' policies; Google Analytics data is retained for 6 months.
• Security logs: up to 6 months.

When information is no longer needed we delete or anonymize it.

11. Security

We protect your information with HTTPS encryption on every page, PCI-compliant payment processors (we never handle full card numbers), hashed passwords, access controls, a web application firewall and bot protection, malware scanning, and regular software updates. No method of transmission or storage is completely secure; if we learn of a breach affecting your information we will notify you as required by law.

12. Children

The Site is intended for adults. We do not knowingly collect personal information from children under 16, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

13. Visitors outside the United States

We ship only within the United States and our services are directed to US residents. If you visit from another country, your information is processed in the United States, where privacy laws may differ from those in your country. Visitors from outside the US see an opt-in cookie notice, and nothing beyond necessary cookies loads unless you allow it. If you are in a jurisdiction that grants you additional rights (for example the EU, UK or Canada), you may exercise them by contacting us.

14. Changes to this policy

We may update this policy as our practices, providers or the law change. We will post the new version here with a new effective date and, for material changes, ask for your cookie choices again and, where appropriate, notify you by email. The policy version shown at the top is recorded with every privacy choice you make.

15. Contact us