Last updated: November 4, 2026

This Privacy Policy explains how Clever Poppy collects, uses, shares and protects your personal information when you visit our websites (cleverpoppy.com, cleverpoppy.com.au, cleverpoppy.co.nz, cleverpoppy.co.uk and our other country sites, together the "Site"), buy from us, watch our video tutorials, or sign up for our emails or texts. It also explains your privacy rights and how to use them.

1. Who is responsible for your information

The company responsible for your personal information (the "data controller") is Clever Poppy Ltd (NZ company number 5688129), 28 Silkwood Lane, Kerikeri 0230, New Zealand. (Customers in the United States are covered by Clever Poppy, LLC and our U.S. Privacy Policy at cleverpoppy.com/policies/privacy-policy.)

For any privacy question or request, contact our privacy contact at help@cleverpoppy.com (subject line "Privacy").

2. The information we collect

Information you give us

• Contact and order details: name, email address, phone number, billing and delivery address, and what you bought.
• Payment details: handled directly by Shopify and our payment providers. We see only limited details (such as card type and last four digits), never your full card number.
• Account details: login email and saved addresses, if you create an account.
• Marketing sign-ups: your email and/or mobile number, and your preferences, if you sign up for our emails or texts.
• Messages, reviews and surveys: what you send our customer support team, reviews, photos and videos you post, and answers to our surveys and quizzes.

Information collected automatically

• Device and usage information: IP address, approximate location (country/city), browser and device type, time zone, pages and products viewed, search terms, how you arrived at the Site, and how you interact with it. We collect this using cookies, pixels and similar technologies (see Section 7).

Information from other sources

• Advertising and social media platforms (such as Meta/Facebook/Instagram, Google, Pinterest and AppLovin) may share information with us about how you interacted with our ads, and Shopify may tell us if you use Shop Pay.
• Delivery companies may share delivery status updates.

We do not knowingly collect personal information from children under 16. If you think a child has given us their information, contact us and we will delete it.

3. How we use your information, and our legal reasons

Privacy laws in the UK, EU, Switzerland and some other places require us to tell you the legal reason ("lawful basis") for each use. Here is what we do, and why:

What we do	Lawful basis
Process and deliver your order, send order and shipping updates, handle returns and refunds, and give you access to video tutorials	Performing our contract with you
Answer your questions and provide customer support	Performing our contract; our legitimate interest in helping customers
Prevent fraud and keep the Site secure (including limited automated fraud checks by Shopify, such as temporarily blocking an IP address after repeated failed payments)	Our legitimate interest in protecting our business and customers; legal obligations
Keep tax and accounting records, and respond to lawful requests	Legal obligation
Send marketing emails and texts	Your consent (or, for emails to past customers where the law allows, our legitimate interest, and you can opt out at any time)
Show you personalized ads on other websites and measure our advertising	Your consent (given through our cookie banner where required)
Understand how the Site is used, test improvements (for example A/B tests of page layouts or offers), and improve our products	Your consent for non-essential cookies; otherwise our legitimate interest in improving the Site
Publish your reviews and photos	Your consent / our contract with you when you submit them

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.

4. Who we share your information with

We do not sell your personal information for money. We share it only with the following, and only as needed:

• Our store platform and payments: Shopify (store, checkout and Shop Pay), Shopify Payments and PayPal.
• Delivery and fulfillment: our fulfillment partners in the United States and China, and the postal and courier companies that deliver your order.
• Email and text messaging: Klaviyo (email) and Postscript (text messages).
• Customer support and reviews: CustomerDesk (support inbox), Judge.me (reviews), Venon (post-purchase surveys).
• Video tutorials and lessons: Shopify, Vimeo and YouTube (video hosting) and Kajabi (lesson pages and our members area).
• Site tools and analytics: Google Analytics and Google Tag Manager, Zipify (landing pages and page analytics), Intelligems (A/B testing), Triple Whale (marketing analytics) and Alia (on-site sign-up forms and quizzes).
• Advertising partners: Meta (Facebook and Instagram), Google Ads, Pinterest and AppLovin. These partners receive information about your visit and purchases through pixels so we can show relevant ads and measure results. See Section 7 for how to opt out.
• Professional advisers (such as accountants and lawyers), authorities when required by law, and a buyer of our business if Clever Poppy is ever sold or merged.

Our service providers may only use your information to provide services to us, and must keep it secure. Some (such as Shopify, Meta and Google) also act as independent controllers under their own privacy policies.

5. International transfers

We are based in New Zealand and the United States, and our service providers process information in those countries and others (including Canada, Ireland, the EU, Australia and China). Your information may therefore be transferred outside your country. When we transfer personal information from the UK, EU or Switzerland, we rely on adequacy decisions (for example, the EU and UK recognize New Zealand and Canada as providing adequate protection, and certified U.S. companies under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions) or on Standard Contractual Clauses approved by the European Commission and the UK and Swiss authorities. When we send order details to our fulfillment partner in China, we do so because it is necessary to deliver the order you asked for, and we require the partner to protect your information. You can ask us for more details about these safeguards.

6. How long we keep your information

• Order and payment records: 7 years after your order, because tax and accounting laws require it.
• Customer account: until you ask us to delete it, or after 3 years of no activity.
• Marketing lists: until you unsubscribe, or after 2 years without opening or clicking our messages. We keep a record of unsubscribes so we do not contact you again.
• Customer support messages: 3 years after the conversation ends.
• Analytics and cookies: for the cookie lifetimes described in Section 7 (most expire within 2 years).

7. Cookies and similar technologies

Cookies are small files stored on your device. Pixels and tags are small pieces of code that send information to us or our partners. We use them in four groups:

Type	What it does	Examples
Strictly necessary (always on)	Make the Site work: your cart, checkout, login, security, and remembering your cookie choices	Shopify (cart, _secure_session_id, secure_customer_sig, _tracking_consent, localization)
Preferences	Remember choices such as country and currency	Shopify (localization, _shopify_country)
Analytics	Show us how visitors use the Site so we can improve it and test changes	Shopify analytics (_shopify_y, _shopify_s), Google Analytics (_ga), Zipify, Intelligems, Triple Whale
Marketing	Show you relevant ads on other sites, measure ad results, and personalize our emails	Meta Pixel (_fbp), Google Ads (_gcl_au), Pinterest Tag (_pin_unauth), AppLovin, Klaviyo (__kla_id)

Your choices:

• Cookie banner: where the law requires it (including the UK, EU and Switzerland), we ask for your consent before using analytics and marketing cookies. You can change your choices at any time using the "Cookie preferences" link at the bottom of every page.
• Browser settings: you can block or delete cookies in your browser, but some parts of the Site (like the cart) may stop working.
• Ad platforms: you can also adjust ad settings directly with Meta and Google, opt out of Google Analytics at tools.google.com/dlpage/gaoptout, or use the industry opt-out tools at optout.aboutads.info and youronlinechoices.eu.

8. Your privacy rights

Depending on where you live, you may have the right to:

• ask what personal information we hold about you and get a copy;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information (we may need to keep some records, such as orders, for legal reasons);
• get your information in a portable format;
• object to, or ask us to restrict, how we use your information, including for direct marketing (which you can always stop);
• withdraw consent at any time (this does not affect anything we did before you withdrew it); and
• complain to a privacy regulator (see below).

To use any of these rights, email help@cleverpoppy.com with the subject "Privacy request". We may need to confirm your identity first. We will respond within the time the law requires (usually within 20 working days in New Zealand, 30 days in Australia and Canada, and one month in the UK, EU and Switzerland). We will not treat you differently for using your rights.

9. Additional information for your location

Regulators you can contact: New Zealand: Office of the Privacy Commissioner (privacy.org.nz); Australia: Office of the Australian Information Commissioner (oaic.gov.au); UK: Information Commissioner's Office (ico.org.uk); EU: your local data protection authority; Switzerland: the Federal Data Protection and Information Commissioner (FDPIC); Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca). We'd appreciate the chance to help you first, though.

Australia: we handle personal information in line with the Australian Privacy Principles. New Zealand: we follow the Information Privacy Principles in the Privacy Act 2020. UK, EU and Switzerland: you have the rights listed in Section 8 under the UK GDPR, the EU GDPR and the Swiss Federal Act on Data Protection.

10. Text messages

If you sign up for our text messages, we collect your mobile number and your messaging preferences. We use them only to send you the messages you signed up for, through our provider Postscript. We do not sell or share your mobile number or text consent with third parties for their own marketing. Reply STOP to unsubscribe or HELP for help. More details are in our Text Messaging Privacy Policy.

11. How we protect your information

Our Site uses HTTPS encryption on every page, and payments are processed by PCI-compliant providers. We limit access to personal information to the people who need it, and we choose service providers with strong security practices. No method of transmission or storage is 100% secure, but we take reasonable steps to protect your information and will notify you and the regulators if a data breach is likely to cause you serious harm, as required by law.

12. Do Not Track

Many browsers have a "Do Not Track" setting. Because there is no common standard for it, we do not respond to Do Not Track signals.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version here with a new "Last updated" date, and tell you about significant changes by email or a notice on the Site.

14. Contact us

Email: help@cleverpoppy.com (subject "Privacy")
Mail: Clever Poppy Ltd, 28 Silkwood Lane, Kerikeri 0230, New Zealand