Privacy Policy

---

This website is intended for residents of the United States only. We ship only to addresses within the United States and its territories, except Puerto Rico and the U.S. Virgin Islands.

Effective Date: September 27, 2026

Last Updated: September 27, 2026

1. Introduction and Scope

Baseline Commerce, LLC ("Baseline Commerce," "we," "us," or "our") operates the website habitsbe.com (the "Site"), through which we sell photographic landscape prints.

This Privacy Policy describes the categories of personal information we collect, the purposes for which we use it, the parties to whom we disclose it, how long we keep it, and the rights and choices available to you. It applies to personal information we collect through the Site, by email or telephone, and in connection with fulfilling your orders.

We are a small business located in Melvindale, Michigan. Some of the state privacy laws described in this Policy apply only to businesses that exceed specified revenue or data-volume thresholds, and we may not meet those thresholds. Nevertheless, we extend the substantive rights described in Section 10 to all residents of the United States, regardless of whether a particular law obligates us to do so. Where a law does apply to us, that law controls.

Please read this Privacy Policy carefully. If you do not agree with it, please do not access or use the Site.

2. Summary of Key Points

● We collect the information necessary to sell and ship photographic prints to you, to respond to your inquiries, and to operate and secure the Site.

● We do not sell your personal information, and we run no advertising or social media trackers. Our website platform includes a Google Analytics tag that we do not use and cannot remove; Section 5.2 explains what it does and does not send.

● Our website platform does not detect or process opt-out preference signals, including Global Privacy Control (GPC). If you email us that you use one, we treat it as an opt-out request — see Section 6. We already start every visitor in the state such a signal would request. 

● We do not use your personal information to train large language models or other artificial intelligence models, and we do not license it to others for that purpose.

● We do not knowingly collect personal information from children under 13, and we do not process the personal information of any consumer we know or should know to be under 18 for targeted advertising or sale.

● You may exercise your privacy rights at any time by emailing marino.apollinari@gmail.com. We do not charge for this, except as described in Section 11.1, and we will not penalize you for asking.

3. Personal Information We Collect

We collect only the personal information reasonably necessary and proportionate to the purposes described below.

3.1 Categories

Identifiers and contact data. Your name, shipping address, billing address, email address, and telephone number. Source: directly from you at checkout, account registration, or when you contact us; or, if you pay using the Paze digital wallet, from Paze. Purpose: order processing, fulfillment, delivery, customer support, and transactional communications.

Account credentials. If you create an account, the email address and the password you choose. Your password is stored by our website platform in hashed form; we cannot see it, and we cannot retrieve it for you. An account is optional — you may complete any order as a guest, in which case we hold no credentials for you. Source: directly from you at account registration. Purpose: authenticating you, letting you view your order history, and securing your account.

Commercial information. Records of products purchased or considered, the contents of your shopping cart, order numbers, order history, and shipping and return records. Source: directly from you and from our e-commerce platform. Purpose: order fulfillment, returns and claims handling, accounting, tax reporting, and fraud prevention. To calculate and remit applicable sales tax, we disclose your shipping and billing address and order details to our tax compliance service provider, Avalara, Inc.

Financial and payment data. Payment card brand, the last four digits of the card number, expiration date, billing ZIP code, and authorization result. We do not collect, process, or store your full payment card number. Full payment credentials are collected directly by our payment processors and never transit our systems in a form we can read. If you choose to save a payment method for future purchases, that card is stored by our payment processor, not by us; what we hold does not change, and you may remove a saved card at any time through your account or by contacting us. If you pay using the Paze digital wallet, your full card number is not sent to us; Paze provides us a payment token, the card's last four digits, and an authorization result instead, the same as our other payment processors. Unlike your card number, Paze does pass us the name, email address, phone number, and shipping and billing address in your Paze wallet profile, the same information we would otherwise collect from you directly at checkout. Source: our payment processors. Purpose: payment authorization, chargeback handling, and refunds.

Internet and network activity information. IP address, browser type and version, operating system, device identifiers, referring and exit pages, pages viewed, search terms you enter in our product search, access times and dates, time spent on pages, and diagnostic data. Source: automatically from your device via server logs, cookies, and similar technologies. Purpose: operating and securing the Site and diagnosing problems. We do not use this information for advertising, and we do not run analytics reporting on it ourselves (Section 5.2).

Customer communications. The content of emails, contact-form submissions, damage and defect claims, and any photographs you send us to document a damaged or defective print. Source: directly from you. Purpose: responding to you and resolving your claim.

3.2 Information We Do Not Collect

We do not intentionally collect Social Security numbers, driver's license or state identification numbers, passport numbers, financial account numbers, precise geolocation, biometric or genetic data, health or medical information, consumer health data, racial or ethnic origin, religious or philosophical beliefs, union membership, immigration or citizenship status, sexual orientation, or the contents of your mail, email, or text messages other than those you send to us. Please do not send us this information.

4. How We Use Personal Information

We use personal information for the following business and commercial purposes:

● To process, fulfill, ship, and deliver your orders for photographic prints;

● To create and administer your account and provide customer support;

● To send transactional messages, including order confirmations, shipping notices, tracking information, backorder and delay notices, and refund confirmations;

● To evaluate and resolve damage, defect, and return claims;

● To process returns, replacements, and refunds;

● To detect, investigate, and prevent fraudulent transactions, chargeback abuse, and other unlawful activity, and to protect the security and integrity of the Site;

● To comply with legal, tax, accounting, and recordkeeping obligations and to establish, exercise, or defend legal claims;

● To operate, maintain, debug, and improve the Site and our products;

● To create de-identified or aggregated statistics that cannot reasonably be used to identify you. Where we create de-identified information, we maintain it in de-identified form, do not attempt to reidentify it, and contractually obligate recipients to do the same.

We will not use your personal information for a materially different, unrelated, or incompatible purpose without providing you notice.

5. Cookies, Analytics, and Advertising Technologies

This section describes what runs on the Site, based on our own review of the code actually served on habitsbe.com rather than on a generic template. Our website platform controls some of this code and does not document all of it; Section 5.5 explains the limits of our review.

5.1 Strictly Necessary Cookies

These are required for the Site to function — maintaining your shopping cart, keeping you signed in if you have an account, and remembering the choice you make on our cookie banner. They are set whether or not you accept optional cookies, and they cannot be switched off through the banner, because without them the Site cannot take an order.

When you sign in, our website platform's account system stores a cookie named info_c2 containing your email address and name, so the Account page can display your details without an extra server request. This cookie lasts approximately fourteen (14) days and is only sent over a secure connection, but unlike our other cookies, it is not marked HttpOnly, meaning any script running on the Site is technically capable of reading it. Your actual sign-in credential is stored separately, in a cookie that is both HttpOnly and Secure, and is not exposed this way. We did not build this account system and do not control this setting; it is part of the account system built into our website platform. We will fix this and update this section if our platform allows it.

5.2 Analytics

Our website platform, GoDaddy, includes a Google Analytics tag on every page of the Site as part of the hosted storefront we license. We do not use it — we do not log into it, build reports from it, or make decisions from it — but we cannot remove it from the platform.

We have set the platform's tracking controls to their most restrictive setting, which instructs Google Analytics not to store analytics or advertising data on your device. In that state, it does not create a Google Analytics cookie or a persistent identifier for you.

It would not be accurate to say nothing reaches Google. Your browser loads the tag from Google's servers, which discloses your IP address to Google, and the tag sends a limited, cookieless message on each page. According to Google's documentation, that message can include the event and its time, your browser's user agent (which identifies your browser and device type), the referring page, the address of the page you are viewing, your consent state, a random number generated for each page load, and whether the page address contains an advertising click identifier. Google can also derive an approximate location from your IP address. The message does not include a Google Analytics identifier or your name.

If you accept our cookie banner, the platform may lift some of these restrictions, in which case Google Analytics can store its own cookie and identifier on your device. Declining, or ignoring the banner, leaves the restrictions in place.

5.3 What Additionally Happens If You Accept

If you select Accept on our cookie banner, two further things occur that do not occur if you decline or ignore the banner:

● A visitor identifier is stored. The platform creates a randomly generated identifier and stores it in a cookie named x-visitor-id that lasts sixty (60) days. It is not derived from anything you told us, and it is not linked to your name or your account, but it is a persistent identifier that allows repeat visits from the same browser to be recognized as the same visitor.

● Advertising click identifiers in the web address are stored. If you arrive at the Site through a link containing a gclid, fbclid, or gdan_clid parameter — the click identifiers used by Google Ads, Facebook, and GoDaddy's advertising respectively — that value is saved in your browser's local storage. This happens only if such a parameter is present in the address you arrived on. We do not place advertising that generates these parameters (Section 5.4); the platform's code captures them if another party's link supplies one.

Declining prevents both. You can also remove them at any time by clearing site data for habitsbe.com in your browser.

The visitor identifier and click identifiers described here are set by our website platform itself, not by Google Analytics — Section 5.2 covers that separately.

5.4 Advertising and Social Media Trackers — None

We do not run any advertising or social media tracking technology on the Site. As of the effective date of this Privacy Policy, there is no Meta (Facebook) pixel, no Pinterest tag, no TikTok pixel, no LinkedIn insight tag, no Google Ads conversion or remarketing tag, and no DoubleClick or other ad-exchange tag on habitsbe.com. We do not buy advertising, we do not build advertising audiences, and we do not track you across other websites or apps.

The Site does include Open Graph and Twitter Card tags — lines of text that tell a social platform how to display a preview if someone shares a link to the Site. They load nothing, set no cookie, and send nothing to any social platform.

If this changes, we will update this section and the cookie banner, and the opt-out mechanisms in Sections 5.6, 6 and 11 will apply.

5.5 Platform Operations, Fonts, and Other Loaded Assets

Fonts and stylesheets used by the Site are served by our website platform's own content delivery network, and the Site does not load fonts from Google Fonts or from any other third-party font service. Scripts are served by that same network with one exception: the Google Analytics tag described in Section 5.2 is loaded from Google's servers.

The Site also registers a service worker — a small script that stores copies of page files in your browser so that pages load faster. It caches site files, not personal information, and you can remove it by clearing site data for habitsbe.com.

Our platform additionally supports an on-site messaging or live chat feature and a pop-up feature. Both are switched off, and neither collects anything from you. If we enable either one, we will update this Policy before it goes live. The platform also records operational and diagnostic information about how its software performs on the Site, for its own service-delivery purposes as our hosting provider.

Our checkout system, hosted on a separate domain operated by the same website platform, sets additional cookies on that domain — including _tccl_visitor, _tccl_visit, and _scc_session — that we did not add and have no setting to configure or remove. Based on our own review of the code actually served, these appear to assign the platform's checkout system a visitor and session identifier and track basic session activity for its own analytics; the platform does not publicly document what data they contain or how it is used. Unlike the identifiers described in Section 5.3, these cookies are not currently affected by your choice on our cookie banner — they are present whether you accept or decline. If our platform gives us a way to control this, or documents these cookies further, we will update this section and extend the choice described in Section 5.6 to cover them.

Our platform also sets a cookie named dps_site_id on habitsbe.com itself, lasting only for your current browsing session. Its value is a short code identifying a server region, not anything unique to you or your device. Based on our own review, this is consistent with routing or infrastructure use by our hosting platform's servers, not with tracking or advertising, though the platform does not publicly document it. Like the checkout cookies above, it is not currently affected by your choice on our cookie banner.

Because GoDaddy controls this code and does not publicly document either set of cookies, this section reflects our review as of the Last Updated date above and may not capture every cookie the platform sets on these two domains; we will update it if further review identifies others.

5.6 How to Control This

● Our cookie banner. Decline, and no visitor identifier is created, and no click identifiers are stored. Accept, and Section 5.3 applies. The platform's Google Analytics tag loads either way; declining keeps it from storing anything on your device (Section 5.2).

● Opt-out preference signals. Our website platform does not detect a Global Privacy Control (GPC) signal from your browser, so transmitting one has no automatic effect on the Site. Email us instead — see Section 6. 

● Browser settings. Most browsers let you block or delete cookies and clear local storage. Blocking strictly necessary cookies will prevent checkout from working.

● Email us. Send an opt-out request to marino.apollinari@gmail.com. We will suppress that email address from future marketing and from any advertising audience list, at no charge and without asking you to verify your identity.

Your banner choice is stored on the browser and device where you made it. If you clear site data, use a different browser, or use a different device, you will need to choose again.

Our cookie banner does not reappear once you have made a choice. To reverse an acceptance on this browser or device, clear site data for habitsbe.com — this removes the visitor identifier, any stored click identifiers, and your saved banner choice, and it is the only way anyone, including us, can do that for a specific browser or device.

Emailing marino.apollinari@gmail.com is separate from clearing site data: it stops future marketing and ad-audience-list use of your email address, but it cannot remove data already stored in your browser — only clearing your browser's site data can do that.

5.7 reCAPTCHA (Contact Form, Account Creation, and Checkout)

Our Contact page, our account creation page, and the payment step of checkout use Google reCAPTCHA, provided as part of the forms and checkout system built into our website platform, to screen out automated and fraudulent submissions before they reach us. On the Contact page and the account creation page, reCAPTCHA does not run merely because you visit — it activates when you submit the contact form or create an account, rather than displaying a visible challenge. During checkout, reCAPTCHA also loads at the point where you enter credit card details, as an invisible badge — there is no challenge for you to click or solve. In each case, that activity discloses information about your visit — such as your IP address, browser and device characteristics, and how you interact with the page — to Google, which uses it to distinguish human visitors from bots. We do not receive or see the underlying signals reCAPTCHA collects; Google processes them under its own Privacy Policy and Terms of Service, linked wherever reCAPTCHA appears on the Site. reCAPTCHA loads on the Contact page, the account creation page, and the checkout payment step — not at sign-in, in your order history, or elsewhere on the Site.

6. Opt-Out Preference Signals (Global Privacy Control)

We honor an opt-out preference signal, including the Global Privacy Control (GPC), when you tell us by email that you use one. Our website platform has confirmed to us directly that it does not detect or process such a signal automatically at the page level, and that doing so would require adding a third-party cookie management tool, which we have not done. Section 5.4 explains why nothing on the Site does the advertising or cross-site tracking a signal would switch off in any case.

Because our platform does not detect these signals, we cannot apply one automatically when you visit the Site. If you email us and tell us you are transmitting an opt-out preference signal — or simply that you wish to opt out — we treat that as a valid request to opt out of the sale of your personal information, the sharing of your personal information for cross-context behavioral advertising, and the processing of your personal information for targeted advertising, and we apply it to your account and to any information we hold about you.

In practice, the Site already begins every visit in the state a GPC signal asks for: advertising storage, advertising user data, and advertising personalization are denied by default for every visitor, whether or not a signal is sent, and we run no advertising or cross-site tracking technology at all (Section 5.4). Our platform does not detect a signal at the cookie banner either, so if you want that preference on record with us, email us as described above; once you do, we will not treat a later banner acceptance as consent to sell or share your personal information, and we will not use the identifiers described in Section 5.3 for any advertising purpose.

Because no uniform technical standard for legacy "Do Not Track" (DNT) browser headers has been adopted, we do not separately respond to DNT headers. Emailing us, as described above, is the effective method on this platform.

7. Sale and Sharing of Personal Information

We do not sell your personal information for monetary consideration, and we have not done so in the preceding twelve (12) months.

We do not share your personal information for cross-context behavioral advertising or targeted advertising, and we have not done so in the preceding twelve (12) months. We run no advertising or social media tracking technology on the Site (Section 5.4), and we do not use the platform's analytics tag for advertising or audience building (Section 5.2), so the disclosures that would constitute "sharing" under state privacy law do not occur.

Several state privacy laws also define "sale" to include disclosures for other valuable consideration, not only for money. Our platform's Google Analytics tag does transmit limited, cookieless information to Google on each page, as described in Section 5.2. We receive nothing of value for it, and it carries no identifier for you. The one thing worth flagging under this broader definition is what happens if you accept our cookie banner:

● If you accept, our website platform stores a sixty-day visitor identifier and any advertising click identifier present in your web address, in your own browser (Section 5.3).

We do not consider this to be a sale or sharing of your personal information: nothing is transmitted to a third party by it, no money or other consideration comes to us for it, and it exists only so repeat visits from the same browser can be recognized as the same visitor. You do not need that question resolved to act: you may opt out at any time, and we will honor it — by declining on the banner or by emailing us, including to tell us you have transmitted a GPC signal (Section 6) — and we will not charge you, deny you a product, or degrade the Site for doing so.

You have the right to opt out at any time, using any of the methods in Sections 5.6, 6, or 11. We do not sell or share the personal information of any consumer we know or should know to be under 18 years of age, and we do not process such information for targeted advertising, regardless of consent.

We do not sell sensitive personal information, and we do not process sensitive personal information for the purpose of inferring characteristics about you.

8. How We Disclose Personal Information

In the preceding twelve (12) months, we have disclosed the following categories of personal information for the business purposes described below:

● Identifiers, commercial information. Disclosed to our e-commerce and hosting provider (GoDaddy), for operating the Site and storing order records — including, when you create an account, retention of your order history and sign-in activity within the platform's built-in contacts and email tool (see Section 15).

● Identifiers, financial/payment data, commercial information. Disclosed to our payment processor (GoDaddy Payments), including storage of a payment method you choose to save, and to Paze, a digital wallet service, if you choose to pay with it at checkout — for authorizing payment, processing refunds, and resolving chargebacks.

● Identifiers, commercial information. Disclosed to our shipping carrier (USPS) for delivering your prints and providing tracking.

● Identifiers, commercial information. Disclosed to tax calculation and accounting service providers (for example, Avalara), for calculating sales tax and maintaining financial records.

● Identifiers, customer communications. Disclosed to Google, which hosts our business email (Gmail), and to GoDaddy, whose store platform sends order confirmation and shipping email — for sending transactional email about your order, and receiving and responding to messages you send us.

● Internet and network activity information. Disclosed to Google, via the platform's Google Analytics tag — limited, cookieless data (see Section 5.2) — as part of the platform's built-in analytics, which we do not use.

● Internet and network activity information. Disclosed to Google, via reCAPTCHA on our Contact page, account creation page, and the checkout payment step — your IP address, browser and device characteristics, and interaction signals (see Section 5.7) — for screening those forms and the payment step for automated and fraudulent activity.

● Internet and network activity information. Disclosed to our website platform, via cookies (_tccl_visitor, _tccl_visit, and _scc_session) that its checkout system sets independent of our cookie banner — for the platform's own analytics (see Section 5.5).

Most of these recipients process personal information to provide their services to us, under their own terms of service. Some also use it for their own purposes under their own terms and privacy policies, including our website platform through its checkout cookies (Section 5.5), Google through its Analytics tag and reCAPTCHA (Sections 5.2 and 5.7), and Paze.

We have not disclosed personal information for a business purpose in the following categories in the preceding twelve (12) months; if either becomes necessary, Sections 8.1 and 8.2 describe what it would involve.

8.1 Legal Disclosures

We may disclose personal information where we reasonably believe it is necessary to comply with applicable law, regulation, subpoena, warrant, or court order; to investigate suspected fraud or other unlawful activity; to protect the rights, property, or safety of Baseline Commerce, our customers, or the public; or to enforce our Terms and Conditions.

8.2 Business Transfers

If Baseline Commerce is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, personal information may be transferred as part of that transaction. We will require the recipient to honor the commitments in this Privacy Policy with respect to information transferred, or to provide you notice and an opportunity to opt out before any materially different use.

8.3 What We Do Not Do

We do not rent, trade, or sell our customer list. We do not disclose your personal information to third parties for those third parties' own direct marketing purposes. We do not disclose your personal information to data brokers.

9. Artificial Intelligence, Profiling, and Automated Decision-Making

We do not use your personal information to train large language models or other artificial intelligence or machine learning models, and we do not sell, license, or otherwise disclose your personal information to any third party for that purpose.

We do not use automated decision-making technology or profiling to make decisions that produce legal or similarly significant effects concerning you — for example, decisions about credit, employment, housing, or healthcare. Order acceptance, pricing, and fraud screening decisions that affect you are subject to human review on request.

If this ever changes, we will update this Policy, provide advance notice, and — where required by law — provide a pre-use notice, an opportunity to opt out, an explanation of the logic and inputs used, and a right to appeal to a human reviewer.

10. Your Privacy Rights

Depending on your state of residence, you may have some or all of the following rights. As stated in Section 1, we extend these rights to all U.S. residents as a matter of practice.

● Right to know and access. To confirm whether we process your personal information and to obtain the categories collected, the categories of sources, the business or commercial purposes, the categories of third parties to whom we disclose it, and the specific pieces of personal information we hold about you.

● Right to a portable copy. To receive your personal information in a portable and, to the extent technically feasible, readily usable format.

● Right to correct. To have inaccurate personal information corrected, taking into account its nature and our purposes for processing it.

● Right to delete. To have your personal information deleted, subject to exceptions — for example, where we must retain records to complete a transaction, resolve an open claim, detect security incidents, comply with tax or accounting obligations, or establish, exercise, or defend legal claims.

● Right to opt out of targeted advertising, sale, and sharing. See Sections 5, 6, and 7.

● Right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects. See Section 9.

● Right to limit the use and disclosure of sensitive personal information. We do not collect sensitive personal information for purposes that would require this right, but you may nonetheless submit a request.

● Right to obtain a list of the specific third parties to which we have disclosed personal information.

● Right to non-discrimination and non-retaliation. We will not deny you goods or services, charge you a different price, provide a different level or quality of service, or retaliate against you for exercising any privacy right.

● Right to appeal. See Section 11.4.

● Right to withdraw consent. Where we rely on your consent, you may withdraw it at any time; withdrawal does not affect processing carried out before withdrawal.

11. How to Exercise Your Rights

11.1 Submitting a Request

Email marino.apollinari@gmail.com with the subject line "Privacy Request." Please state:

● The right you wish to exercise;

● Your state of residence;

● The email address, order number(s), or other identifier associated with your information; and

● Whether you are submitting the request on your own behalf or as an authorized agent.

You may also write to us at Baseline Commerce, LLC, 3205 McKitrick Street, Melvindale, MI 48122, or call 734-799-1677.

Requests are free, except that we may charge a reasonable fee or decline a request that is manifestly unfounded, excessive, or repetitive, and if we do, we will explain why.

11.2 Verification

To protect your information, we must verify your identity before fulfilling a request to know, access, correct, delete, or port. We generally verify by matching two or more data points you provide — such as the email address and order number used for a purchase — against our records. We do not require you to create an account to submit a request, and we will not use information you provide for verification for any other purpose. You do not need to verify your identity to opt out of sale, sharing, or targeted advertising.

11.3 Response Times

We will acknowledge receipt within ten (10) business days and respond substantively within forty-five (45) days. Where reasonably necessary, we may extend that period by an additional forty-five (45) days and will notify you of the extension and the reason for it within the initial forty-five-day period. Opt-out requests, including a request telling us you transmit an opt-out preference signal (Section 6), are honored within fifteen (15) business days.

11.4 Appeals

If we decline your request in whole or in part, we will tell you why and how to appeal. To appeal, reply to our decision or email marino.apollinari@gmail.com with the subject line "Privacy Request Appeal." We will review the appeal and respond in writing with our decision and reasons within forty-five (45) days. If we deny the appeal, we will provide you with a method to contact your state Attorney General to submit a complaint.

11.5 Authorized Agents

You may designate an authorized agent to submit a request on your behalf. We will require the agent to provide written proof of authorization signed by you, and we may require you to verify your own identity directly with us and to confirm that you authorized the request. An agent acting under a valid power of attorney need not provide separate written authorization.

12. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, and then delete or de-identify it. Our retention criteria are the length of our relationship with you, the period necessary to satisfy tax, accounting, and recordkeeping obligations, the period during which a return or defect claim may be made, and the applicable statutes of limitations for claims.

Specifically, our retention periods by category of information are:

● Order and transaction records (including identifiers and commercial information): seven (7) years from the transaction date, to satisfy federal and Michigan tax and recordkeeping obligations.

● Damage, defect, and return claim records: four (4) years from resolution.

● Payment authorization records (card brand, last four digits, authorization result): two (2) years from the transaction date, or longer if needed to resolve an open chargeback or dispute. A payment method you have chosen to save is kept by our payment processor until you remove it or close your account.

● Account information: for the life of the account. When you close your account, your account credentials and profile are removed; order and transaction records are kept for the period stated above.

● Customer service correspondence: four (4) years from resolution.

● Server logs and diagnostic data: twelve (12) months.

● Records of privacy rights requests: twenty-four (24) months, as required to demonstrate compliance.

● Your cookie banner choice, stored on your device: until you clear site data for habitsbe.com, use a different browser, or use a different device.

Where a legal hold, open dispute, investigation, or regulatory obligation applies, we retain the relevant records until it is resolved.

Closing or deleting your account removes your account credentials and the profile associated with them. It does not delete the order and transaction records for purchases you have already made; we retain those for the period stated above to satisfy tax and recordkeeping obligations.

13. Data Security and Breach Notification

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and destruction. These include transport encryption for data in transit, access controls limiting access to those with a business need, use of PCI-DSS-compliant payment processors so that full card data never enters our systems, and periodic review of our vendors' security practices.

No method of transmission over the Internet or method of electronic storage is completely secure. We cannot and do not guarantee absolute security.

Breach notification. If a security incident results in unauthorized access to or acquisition of your personal information, we will notify you and the appropriate regulators as and when required by applicable federal and state law. Notification deadlines vary by state and by the type of information involved; several states require notice within thirty (30) days, and Michigan's Identity Theft Protection Act requires notice without unreasonable delay. We will provide notice within the shortest period applicable to your residence, consistent with law enforcement needs and the time required to assess the incident.

14. Children's and Teens' Privacy

The Site is a general-audience e-commerce site directed to adults. It is not directed to children.

Children under 13. The Site is not directed to children under 13, and we do not knowingly collect, use, or disclose personal information from them. If we learn that we have collected personal information from a child under 13, we will not use or disclose it, and we will delete it promptly. We do not use any child's personal information for targeted advertising or profiling. A parent or guardian who believes we may have information from a child under 13 should contact us at marino.apollinari@gmail.com; we will check our records, delete any such information, and confirm the deletion in writing.

Children aged 13 to 17. We do not process the personal information of any children we know or should know to be under 18 years of age for purposes of targeted advertising, the sale of personal information, or profiling in furtherance of decisions producing legal or similarly significant effects. This prohibition applies regardless of whether the children or a parent has consented, consistent with the laws of states including Maryland and Connecticut.

Purchasing. Purchases may only be made by persons 18 years of age or older, or by a parent or guardian on a minor's behalf.

15. Email and Text Messages

Email. We do not send marketing or promotional email. The only email we send is transactional — order confirmations, shipping notices, delay notices, and refund confirmations — as a necessary part of fulfilling your order. You cannot opt out of transactional email while an order is open. If we ever begin sending marketing email, we will obtain your consent where required, include an unsubscribe mechanism and our valid physical postal address in every message, and honor opt-out requests within ten (10) business days as required by the CAN-SPAM Act.

Checkout signup checkbox. Our checkout, built into our website platform, displays a box labeled to store your information for faster checkout, checked by default, stating that by signing up you may receive exclusive rewards by email. We did not add this box, it is checked by default rather than opt-in, and we have no setting to uncheck it by default or to remove it. Checking this box also adds your name, email address, order history, and account sign-in activity to a contacts tool built into our website platform — the same tool this box's rewards program would send from — regardless of whether we ever send anything to you through it. This is separate from the advertising and social media tracking technology described in Section 5.4; it functions as an internal record of your account and order, and we have no setting to prevent that record from being created. Based on our own testing (orders placed with the box both checked and unchecked), checking it has not triggered any marketing or rewards email — only the transactional emails described above were sent. If that changes, we will update this section, and any marketing email sent through this feature will include an unsubscribe mechanism and our valid physical postal address, consistent with the CAN-SPAM Act.

Text messages. We do not send marketing text messages. We will not send you an autodialed or prerecorded marketing call or text without your prior express written consent, and if you ever provide such consent you may revoke it at any time by any reasonable means — including by replying STOP — which we will honor within ten (10) business days as required by the Telephone Consumer Protection Act. We may contact you by telephone about an open order.

Third-party communications. If you no longer wish to receive communications from a third party such as a shipping carrier, contact that party directly.

Abandoned-cart email. Our store platform is capable of emailing someone who begins checkout and does not complete it. We have that feature switched off and do not send abandoned-cart email. If we ever turn it on, we will update this Policy before we do.

16. Third-Party Websites and Services

The Site may contain links to third-party websites, including social media platforms and payment processors. This Privacy Policy does not apply to those services. We do not control and are not responsible for their privacy practices. Review the privacy policy of any third-party service before providing it with personal information.

17. Nevada Residents

Nevada law (NRS 603A.345) permits Nevada consumers to submit a verified request directing us not to sell certain covered information. We do not sell covered information as Nevada defines the term. You may nonetheless submit a request to marino.apollinari@gmail.com with the subject line "Nevada Do Not Sell Request," and we will respond within sixty (60) days.

18. California Residents

In addition to the rights in Section 10, California residents have the following rights.

Shine the Light (Cal. Civ. Code § 1798.83). You may request, once per calendar year and free of charge, information about the categories of personal information (if any) we disclosed to third parties for those third parties' direct marketing purposes during the immediately preceding calendar year, and the names and addresses of those third parties. We do not disclose personal information to third parties for their direct marketing purposes. Submit any request in writing to the address in Section 23.

Notice at collection. The disclosures in Sections 3, 4, 8, and 12 constitute our notice at collection under the California Consumer Privacy Act.

Metrics. Because we are not a business that buys, sells, or shares the personal information of 10,000,000 or more California residents in a calendar year, we are not required to compile the request metrics described in the CCPA regulations.

19. Consumer Health Data

We do not collect, process, share, or sell "consumer health data" as that term is defined in the Washington My Health My Data Act, the Nevada consumer health data law (SB 370), or comparable laws. We do not operate a geofence around any facility that provides health care services, and we do not infer health conditions from your purchases or browsing.

20. Users Located Outside the United States

The Site is intended solely for users located in the United States, and we ship only to addresses within the United States and its territories, except Puerto Rico and the U.S. Virgin Islands. We do not knowingly market to, or offer goods or services to, individuals located in the European Economic Area, the United Kingdom, Switzerland, Canada, or other jurisdictions outside the United States, and this Privacy Policy is not intended to describe rights under the laws of those jurisdictions.

We are located in the United States. If you access the Site from outside the United States, you do so on your own initiative, and any information you provide will be handled under United States law, which may not provide the same level of protection as the law of your jurisdiction.

21. Accessibility

We are committed to making this Privacy Policy accessible to individuals with disabilities. If you use assistive technology and have difficulty accessing this Policy, or would like it in an alternative format, contact us at marino.apollinari@gmail.com or 734-799-1677, and we will provide it in a format you can use, at no charge.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top and post the revised Policy on the Site. We review this Policy at least once every twelve (12) months.

If we make material changes — for example, a change in the categories of personal information we collect, the purposes for which we use it, the parties to whom we disclose it, or your rights — we will provide notice before the change takes effect by posting a prominent notice on the Site and, where we have your email address and the change concerns information we have already collected, by emailing you.

We will not apply a materially different use to personal information we collected before the change without providing you notice and, where required, obtaining your consent.

Your continued use of the Site after the effective date of a revised Policy constitutes acceptance of the revised Policy for information collected after that date.

23. Contact Us

For questions about this Privacy Policy, to exercise a privacy right, or to raise a concern:

Baseline Commerce, LLC

3205 McKitrick Street

Melvindale, MI 48122

Telephone: 734-799-1677

Email: marino.apollinari@gmail.com

Website: habitsbe.com

If you are not satisfied with our response, you may contact the Michigan Attorney General's Consumer Protection Division or the Attorney General of your state of residence.