Privacy policy
GOYO Cosmetics Last updated: August 24, 2026
The short version
- We collect what you give us (name, address, email, phone, order details) and what your device tells us (IP address, browsing behavior, cookie and pixel data).
- We use it to fulfill orders, provide support, send marketing you asked for, prevent fraud, and improve our advertising.
- We do not sell your personal information for money. We do share identifiers and browsing activity with advertising platforms like Meta and Google in ways that several US state privacy laws define as a "sale" or as "sharing for targeted advertising." You can opt out at any time — see Section 8.
- We do not use or disclose sensitive personal information for purposes that require a right to limit under California law.
- Questions, requests, or complaints: support@goyocosmetics.com
1. Who is responsible for your data
NOVAHIVES-US LLC, doing business as GOYO Cosmetics, 1811 Lorraine Ave, Allen, TX 75002, United States, is the business/controller responsible for the personal information described here.
Contact for privacy matters: support@goyocosmetics.com
2. What this policy covers
This policy applies to goyocosmetics.com, to our email and SMS programs, to our customer service channels, and to the GOYO business pages we operate on third-party platforms (to the extent we control the data). It does not cover third-party sites we link to, or the platforms' own use of your data as independent controllers.
3. The personal information we actually collect
3.1 Information you give us
| What | When | Why |
|---|---|---|
| Name, shipping address, billing address | Checkout | Fulfill and deliver your order |
| Email address | Checkout, newsletter signup, popups, account creation | Order confirmations, shipping updates, support, marketing (with consent) |
| Phone number | Checkout, SMS signup | Delivery notifications, SMS marketing (with express written consent), support |
| Payment information (card type, last 4 digits, billing ZIP, transaction ID) | Checkout | Process payment, prevent fraud, handle refunds and chargebacks. Full card numbers go directly to Shopify Payments — we never see or store them. |
| Order history, returns, refunds | Ongoing | Account management, warranty/returns, accounting |
| Support messages, emails, chat and DM content | When you contact us | Answer you, improve service, resolve disputes |
| Reviews, photos, videos, testimonials you submit | When you post | Publish on the Site and, per our Terms, in marketing |
| Quiz, survey, or skin-preference responses | If you complete one | Recommend products, segment marketing |
| Account login credentials | If you create an account | Authentication |
3.2 Information collected automatically
- Device and connection data: IP address, browser type and version, operating system, device type, screen size, language, referring URL, timestamps.
- Usage data: pages viewed, products viewed, time on page, scroll depth, clicks, search terms used on the Site, items added to cart, checkout steps completed or abandoned.
-
Cookie and pixel identifiers: first- and third-party cookie IDs, advertising IDs, Meta browser ID (
_fbp) and click ID (fbc), Google Analytics client ID, Shopify session identifiers. - Approximate location derived from IP address (city/region level, not GPS).
- Email and SMS engagement: whether you opened an email, which links you clicked, whether a message was delivered, unsubscribes. (Email opens are measured using a small tracking pixel.)
3.3 Information from third parties
- Shopify — our e-commerce platform and the source of order, customer, and storefront analytics data.
- Shopify Payments (and any other payment method you use) — payment authorization results, fraud risk scores, chargeback data.
- Klaviyo — email/SMS profile, consent records, engagement history.
- Meta and Google — aggregated and, where you have consented, event-level advertising and conversion data.
- Shipping carriers — delivery status and, where relevant, address corrections.
- Fraud prevention services — risk signals Shopify's built-in fraud analysis.
- Review platform — Loox
4. Cookies, pixels, and other tracking
We use cookies and similar technologies (pixels, SDKs, local storage, server-side event forwarding) for four purposes: to make the store work, to remember your preferences, to measure performance, and to advertise.
| Category | Examples | Can you turn it off? |
|---|---|---|
| Strictly necessary | Shopify cart and session cookies, checkout security, fraud prevention, load balancing | No — the store can't function without them |
| Preferences | Language, currency, region, cookie choices, dismissed popups | Yes |
| Analytics / performance | Shopify analytics, Google Analytics 4 | Yes |
| Advertising / targeting | Meta Pixel and Meta Conversions API, Google Ads / Google Tag, TikTok Pixel — list only if you actually install it, Klaviyo onsite tracking | Yes |
Full detail, cookie names, durations, and how to change your choices are in our Cookie Notice.
Global Privacy Control. We honor the Global Privacy Control (GPC) and other recognized opt-out preference signals as a valid request to opt out of sale/sharing and targeted advertising, as required by California, Colorado, Connecticut, Texas, Montana, Oregon, Delaware, New Jersey, Nebraska, New Hampshire, Minnesota, and Maryland law.
5. Why we use your information (and, for EU/UK, our legal basis)
| Purpose | Categories used | EU/UK legal basis |
|---|---|---|
| Take, process, and ship your order; handle returns and refunds | Identifiers, commercial, payment | Performance of a contract (Art. 6(1)(b)) |
| Customer support | Identifiers, commercial, communications | Contract; legitimate interests |
| Fraud prevention, chargeback defense, site security | Identifiers, device, transaction | Legitimate interests (Art. 6(1)(f)); legal obligation |
| Marketing emails and text messages | Identifiers, engagement | Consent (Art. 6(1)(a)); for existing customers in some countries, legitimate interests / soft opt-in |
| Personalized and retargeted advertising; measuring ad performance | Identifiers, device, usage, inferences | Consent (Art. 6(1)(a)) for EU/UK and for cookies; legitimate interests where consent isn't required |
| Analytics and improving the Site and products | Device, usage | Consent (EU/UK); legitimate interests (US) |
| Publishing reviews and using UGC in marketing | Content you submit, identifiers | Consent; contract (our Terms) |
| Accounting, tax, and legal compliance; responding to lawful requests | All relevant | Legal obligation (Art. 6(1)(c)) |
| Business transfer (merger, financing, sale of assets) | All relevant | Legitimate interests |
We do not use your personal information to make decisions that produce legal or similarly significant effects about you through solely automated means, and we do not engage in "profiling" of that kind.
6. Who we share it with
We share personal information with service providers / processors who work for us and are contractually restricted from using it for their own purposes:
| Recipient | What they get | What they do |
|---|---|---|
| Shopify Inc. | Order, customer, and storefront data | E-commerce platform, hosting, order management |
| Shopify Payments (Stripe as processor) | Payment and billing data | Payment processing, fraud screening |
| Klaviyo, Inc. | Email, phone, name, order and browsing events, consent records | Email and SMS marketing, automation, segmentation |
| Shipping carriers and fulfillment partners | Name, delivery address, phone, email, order contents | Deliver your order and provide tracking |
| [Review platform] | Name/initials, email, order data | Collect and display reviews |
| [Customer support tool — e.g. Gorgias, Zendesk, Shopify Inbox] | Contact details, order and message history | Handle support tickets |
| Google LLC | Device and usage data, cookie IDs, conversion events | Analytics; advertising [if Google Ads is enabled] |
| Meta Platforms, Inc. | Cookie IDs, hashed email/phone, browsing and purchase events | Advertising, measurement, custom and lookalike audiences |
| Accountant / bookkeeping | Transaction records | Accounting and tax filing |
We also disclose personal information: to professional advisers (lawyers, accountants, insurers); to authorities where required by law, subpoena, or to protect rights and safety; and to a buyer or successor in a merger, acquisition, financing, or sale of assets.
Meta and Google note. For some advertising activities, Meta and Google act as independent controllers or as joint controllers with us, not simply as our processors. Their own privacy terms then govern what they do with the data. See Meta's Privacy Policy and Google's Privacy Policy.
We have not sold personal information for monetary consideration in the preceding 12 months. We have "shared" and "sold" personal information as those terms are defined under California and other state laws — specifically, we disclose identifiers, internet/network activity, commercial information, geolocation (approximate), and inferences to advertising partners for cross-context behavioral advertising. You can opt out (Section 8).
We do not knowingly sell or share the personal information of consumers under 16 years of age.
7. How long we keep it
| Data | Retention |
|---|---|
| Order and transaction records | 7 years after the order, for tax, accounting, and chargeback purposes |
| Customer account data | While your account is open, then [24] months, then deleted or anonymized |
| Marketing contact data and consent records | Until you unsubscribe, plus [5] years for the consent record only (TCPA/CAN-SPAM defense) |
| Support tickets | [3] years |
| Website analytics and advertising identifiers | [14] months (GA4 default) or the platform's default, whichever is shorter |
| Reviews and UGC | Until you ask us to remove them, or indefinitely if used in published marketing |
Where we can't delete data immediately (backups, legal holds), we isolate it and stop actively using it.
8. Your privacy rights — United States
Depending on where you live, you may have some or all of the following rights:
- Know / access — what we collect, why, who we share it with, and a copy of your data.
- Correct — fix inaccurate personal information.
- Delete — ask us to delete personal information we hold about you.
- Portability — receive your data in a portable, machine-readable format.
- Opt out of "sale" / "sharing" / targeted advertising — stop us from disclosing your data to advertising partners for cross-context behavioral advertising.
- Opt out of profiling in furtherance of decisions with legal or similarly significant effects (we don't do this).
- Limit the use of sensitive personal information (California) — we don't use sensitive PI for purposes that trigger this right.
- Non-discrimination — we won't deny you goods or services, charge different prices, or give you a lower quality of service for exercising your rights.
- Appeal — if we deny your request, you may appeal (see below).
How to exercise them
- Email support@goyocosmetics.com with the subject "Privacy Request," or
- Use the "Do Not Sell or Share My Personal Information" and "Your Privacy Choices" links in our website footer, or
- Turn on Global Privacy Control in your browser — we treat it as an opt-out signal automatically.
We'll confirm receipt within 10 business days and respond within 45 days, extendable by another 45 days if we tell you why. Verifying you: we'll match the email address, order number, or account details you give us against our records; for deletion or access requests we may ask for a signed declaration. An authorized agent may act for you with written permission and, in California, proof of your identity.
Appeals. If we deny a request, reply to our decision email with "Appeal" and your reason. We'll respond within 45 days (60 in some states) and, if we still deny it, tell you how to contact your state Attorney General.
State-specific notes
California (CCPA/CPRA). The categories of personal information we collect, our purposes, retention, and the categories disclosed to advertising partners are set out in Sections 3, 5, 6, and 7 — those sections are our "notice at collection." California residents also have the rights listed above, including the right to limit use of sensitive personal information (not applicable to us) and to know about disclosure for a business purpose. We collect the following CCPA categories: identifiers; customer records information (Cal. Civ. Code § 1798.80); commercial information; internet or other electronic network activity; approximate geolocation; audio/visual (photos and videos you submit); and inferences. We do not collect biometric information, precise geolocation, government ID numbers, racial or ethnic origin, religious beliefs, union membership, genetic data, or the contents of your private communications.
Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, Arkansas, and Florida residents have comparable rights under their state's comprehensive privacy law, and we handle all requests the same way regardless of state. Additional notes:
- Colorado, Connecticut, Montana, Oregon, Delaware, New Jersey, Maryland, Minnesota, Nebraska, New Hampshire, Rhode Island, Texas: we obtain consent before processing sensitive data, and honor universal opt-out signals.
- Minnesota residents may additionally ask us to list the specific third parties to whom we've disclosed their data, and may question the result of profiling.
- Maryland law prohibits the sale of sensitive data outright and limits collection to what is reasonably necessary — we do not sell sensitive data.
- Oregon residents may request a list of specific third parties (not just categories) that received their personal data.
- Texas: the Texas Data Privacy and Security Act requires a specific, verbatim notice from any business that sells personal data. Because we disclose identifiers and browsing activity to advertising partners, and Texas defines "sale" broadly enough to capture that, we give this notice: "NOVAHIVES-US LLC may sell your personal data."
- Nevada residents may opt out of the sale of "covered information" — email support@goyocosmetics.com with "Nevada Opt-Out."
Shine the Light (California Civil Code § 1798.83)
California residents may request, once per year, information about personal information we disclosed to third parties for their own direct marketing purposes in the prior calendar year. We do not disclose personal information to third parties for their own direct marketing.
9. Your privacy rights — EU, UK, and Switzerland
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to: access your data; rectify inaccurate data; erase it ("right to be forgotten"); restrict processing; object to processing based on legitimate interests, and to object to direct marketing at any time, absolutely; data portability; and withdraw consent at any time without affecting processing already carried out.
Exercise them at support@goyocosmetics.com. We respond within one month, extendable by two further months for complex requests.
You also have the right to complain to your national supervisory authority. A list is at edpb.europa.eu; in the UK, the ICO at ico.org.uk.
International transfers. Your personal data is processed in the United States and in other countries where our service providers operate. For transfers out of the EEA/UK/Switzerland we rely on: the European Commission's Standard Contractual Clauses (with the UK Addendum / IDTA where relevant), supplemented by technical and organizational safeguards; and, where the recipient is certified, the EU-US Data Privacy Framework and its UK Extension and Swiss-US framework. You may request a copy of the relevant transfer mechanism at support@goyocosmetics.com.
10. Health-related information
Our products are cosmetics. We do not need, ask for, or want your medical history, diagnoses, prescriptions, or health records — please don't send them to us.
However, some US state laws define "consumer health data" very broadly. Under the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, and Connecticut's health-data amendments, information suggesting that you are seeking a product for a skin condition — including quiz answers, product-browsing patterns, and before/after photos — can count as regulated consumer health data.
Accordingly:
- We do not sell consumer health data, and we do not collect it without your consent.
- We do not use geofencing around any healthcare facility, dermatology clinic, or pharmacy for advertising.
- If you are a Washington or Nevada resident, you may exercise the rights in Section 8 with respect to any consumer health data, and you may withdraw consent at any time by emailing support@goyocosmetics.com.
11. Marketing communications
Email. You can unsubscribe from marketing emails using the link at the bottom of any of them, or by emailing us. We'll still send transactional messages (order confirmations, shipping updates, return notices) because those aren't marketing.
SMS. Reply STOP to any message to opt out, or HELP for help. Full terms, consent language, and message frequency are in our SMS & Email Marketing Terms.
Advertising. To stop personalized ads, use the opt-out in our Cookie Notice, turn on Global Privacy Control, and/or use the industry tools at optout.aboutads.info, optout.networkadvertising.org, and youradchoices.com. You can also adjust ad settings directly in your Meta and Google accounts.
12. Security
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data: TLS encryption in transit, encryption at rest with our platform providers, PCI-DSS compliant payment processing handled by Shopify Payments, access controls and two-factor authentication on admin accounts, and vendor due diligence.
No system is perfectly secure. We can't guarantee absolute security, and you send information to us at your own risk. If we experience a breach affecting your personal information, we'll notify you and the relevant regulators as required by law.
13. Children
The Site is intended for adults. We do not knowingly collect personal information from children under 13 (or under 16 for the purposes of "sale"/"sharing" and targeted advertising). If you believe a child has given us personal information, email support@goyocosmetics.com and we'll delete it.
14. Changes to this policy
We'll update this policy when our practices change. The "Last updated" date at the top always reflects the current version. If we make a material change, we'll post a notice on the Site and, where required, email you.
15. Contact
NOVAHIVES-US LLC d/b/a GOYO Cosmetics 1811 Lorraine Ave, Allen, TX 75002, United States support@goyocosmetics.com