Privacy policy

Last updated: June 10, 2026

This Privacy Policy ("Policy") describes how BestSelf Co. ("we," "us," "our," "BestSelf") collects, uses, discloses, transfers and otherwise processes your personal information when you visit or use our website at bestself.co (the "Site"), make a purchase, create an account, contact us, or otherwise interact with our services (collectively, the "Services").

For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), the data controller is BestSelf Co., 2028 E Ben White Blvd, #240-5675, Austin, TX, 78741, US.

When we refer to "you" or "your" in this Policy, we mean the user of our Services, whether you are a visitor, a customer, or another individual whose information is processed by us.

Personal Information We Collect or Process

When we use the term "personal information," we mean information that identifies or can reasonably be linked to you or another person. It does not include information collected anonymously or that has been de-identified so that it cannot identify or reasonably be linked to you. Depending on how you interact with the Services and where you live, we may collect or process the following categories of personal information, including inferences drawn from it:

• Contact details — name, address, billing address, shipping address, phone number, and email address.
  
  
• Financial information — payment card details, financial account information, transaction details, form of payment, and payment confirmations. (Payment card numbers are processed by our payment processors; we do not store full card numbers on our systems.)
  
  
• Account information — username, password, security questions, preferences and settings.
  
  
• Transaction information — items you view, add to your cart or wishlist, purchase, return, exchange, or cancel, and your past transactions.
  
  
• Communications — information you include in communications with us, for example a customer support inquiry, product review, or survey response.
  
  
• Device information — device, browser, network connection, IP address, and other unique identifiers.
  
  
• Usage information — how and when you interact with or navigate the Services.
  
  

We do not seek to collect sensitive personal information (such as government identifiers, precise geolocation, health information, or information revealing racial or ethnic origin, religious beliefs, or sexual orientation) through the Services, and we ask that you do not provide it to us. We do not use or disclose sensitive personal information for purposes that would require a "right to limit" under California law.

Sources of Personal Information

• Directly from you, when you create an account, use the Services, make a purchase, communicate with us, or otherwise provide information.
  
  
• Automatically through the Services, including from your device via cookies and similar technologies (see "Cookies and Tracking Technologies" below).
  
  
• From our service providers, when they collect or process personal information on our behalf.
  
  
• From our partners or other third parties, such as marketing, analytics, and advertising partners.
  
  

Cookies and Tracking Technologies

Like many websites, we use cookies, pixels, software development kits, and similar technologies ("Cookies") to operate the Site, remember your preferences and cart, measure site performance, and deliver and measure advertising.

• Strictly necessary Cookies are required for the Site to function (e.g., checkout, security) and cannot be switched off.
  
  
• Analytics and performance Cookies help us understand how the Services are used.
  
  
• Advertising and targeting Cookies are used by us and our advertising partners to show you relevant ads on the Services and on other websites and to measure their effectiveness.
  
  

If you are in the European Economic Area, United Kingdom, or Switzerland, we will ask for your consent before placing any non-essential Cookies, in line with applicable ePrivacy laws. You can withdraw or modify your consent at any time via the cookie preferences in the Site footer.

Wherever you are, you can also control Cookies through your browser settings, and you can opt out of targeted advertising as described in "Your Rights and Choices" below. We honor the Global Privacy Control (GPC) opt-out preference signal where required by applicable law.

How We Use Your Personal Information

Depending on how you interact with us, we may use personal information for the following purposes:

• Providing, tailoring, and improving the Services — performing our contract with you, processing payments, fulfilling orders, arranging shipping, facilitating returns and exchanges, managing your account, remembering your preferences, enabling reviews, recommending products, and improving the Services.
  
  
• Marketing and advertising — sending marketing communications by email, text message or postal mail (with your consent where required by law), and showing you online advertisements based on your activity on the Services.
  
  
• Security and fraud prevention — authenticating your account, providing a secure payment and shopping experience, and detecting, investigating, or taking action regarding fraudulent, illegal, unsafe, or malicious activity.
  
  
• Communicating with you — providing customer support and maintaining our business relationship with you.
  
  
• Legal reasons — complying with applicable law, responding to valid legal process, participating in litigation, and enforcing our terms and policies.
  
  

Legal Bases for Processing (EEA / UK / Switzerland)

Where the GDPR, UK GDPR, or Swiss FADP applies, we process your personal information on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — processing orders, payments, shipping, returns, and account management.
  
  
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, security, service improvement, and basic analytics.
  
  
• Consent (Art. 6(1)(a)) — email/SMS marketing, non-essential Cookies, and targeted advertising. You may withdraw consent at any time.
  
  
• Legal obligation (Art. 6(1)(c)) — tax, accounting, consumer-law, and other regulatory obligations.
  
  

We do not use your personal information to make decisions based solely on automated processing that produce legal or similarly significant effects about you.

How We Disclose Personal Information

We may disclose personal information to third parties for legitimate purposes, including:

• With Shopify, vendors, and other service providers that perform services on our behalf (IT management, payment processing, data analytics, customer support, cloud storage, fulfillment and shipping).
  
  
• With business and marketing partners to provide marketing services and advertise to you. For example, we use Shopify to support personalized advertising with third-party services based on your online activity with different merchants and websites. These partners use your information in accordance with their own privacy notices. Depending on where you live, you may direct us not to "share" or "sell" your information for targeted advertising — see "Your Rights and Choices."
  
  
• At your direction or with your consent, such as to ship products to you or through your use of social media widgets or login integrations.
  
  
• With our affiliates or otherwise within our corporate group.
  
  
• In connection with a business transaction (e.g., merger, acquisition, financing, or bankruptcy), to comply with legal obligations (including subpoenas, search warrants and similar requests), to enforce our terms or policies, and to protect or defend the Services, our rights, and the rights of our users or others.
  
  

We do not disclose personal information to third parties for their own direct marketing purposes without offering you the choices required by applicable law.

Categories Disclosed (U.S. State Law Disclosure)

In the preceding 12 months, we have disclosed the categories of personal information listed in "Personal Information We Collect" above to service providers for business purposes, and we have "shared" (for cross-context behavioral / targeted advertising) the following categories: identifiers, device information, and usage/commercial information, with advertising and analytics partners. We do not "sell" personal information for money. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Information you submit will be transmitted to and shared with Shopify and with third parties that may be located in countries other than where you reside. We also use certain Shopify enhanced features that incorporate data from your interactions with our store, other merchants, and Shopify; for those features, Shopify is responsible for the processing of your personal information, including responding to your rights requests. To learn more, visit the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

Third-Party Websites and Links

The Services may link to websites or platforms operated by third parties. We do not guarantee and are not responsible for the privacy or security of those sites. Information you share on public or semi-public venues, including third-party social platforms, may be viewable by others. Review the privacy policies of any third-party sites you visit.

Children's Data

The Services are not intended for children, and we do not knowingly collect personal information from children under the age of majority in their jurisdiction (or under 13 in the United States, under 16 in the EEA/UK where consent thresholds apply, or as otherwise defined by local law). If you are a parent or guardian of a child who has provided us personal information, contact us using the details below to request deletion. As of the Last Updated date, we do not have actual knowledge that we share or sell personal information of individuals under 16 years of age.

Security and Retention

We maintain administrative, technical, and physical safeguards designed to protect personal information, appropriate to the volume and sensitivity of the data we handle, consistent with applicable requirements such as the New York SHIELD Act. However, no security measure is perfect, and we cannot guarantee absolute security. Please do not use unsecured channels to send us sensitive or confidential information.

We retain personal information only as long as reasonably necessary for the purposes described in this Policy. The criteria we use to determine retention periods include: whether we need the information to maintain your account or provide the Services; our legal, tax, and accounting obligations; the time limits for bringing or defending legal claims; and fraud-prevention needs. For example, we retain order and transaction records for as long as required by tax law, and account information for as long as your account remains active. When personal information is no longer needed, we delete or de-identify it.

Your Rights and Choices

Depending on where you live, you may have some or all of the rights below. These rights are not absolute, may apply only in certain circumstances, and in certain cases we may decline a request as permitted by law.

• Right to Access / Know — request access to, and information about, the personal information we hold about you.
  
  
• Right to Delete — request deletion of personal information we maintain about you.
  
  
• Right to Correct — request correction of inaccurate personal information.
  
  
• Right of Portability — receive a copy of your personal information in a portable format and, where applicable, request that we transmit it to a third party.
  
  
• Right to Opt Out of Sale, Sharing, and Targeted Advertising — opt out of the "sale" or "sharing" of personal information and of processing for targeted advertising, as defined by applicable law. Exercise this here: Your Privacy Choices. If you browse with the Global Privacy Control (GPC) signal enabled, we treat it as a valid opt-out request for that browser and device (and, where we can link it, your account). Other than GPC, we do not respond to "Do Not Track" signals.
  
  
• Right to Opt Out of Profiling — where provided by applicable law, opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.
  
  
• Right to Object / Restrict (EEA, UK, Switzerland) — object to processing based on our legitimate interests (including direct marketing, which we will always honor) and request restriction of processing in certain circumstances.
  
  
• Right to Withdraw Consent — where processing is based on consent (e.g., marketing, non-essential Cookies), withdraw it at any time without affecting the lawfulness of prior processing.
  
  
• Communication preferences — unsubscribe from promotional emails at any time via the link in those emails, and from SMS by replying STOP. We may still send non-promotional messages about your account or orders.
  
  

How to exercise your rights. Use the forms indicated on the Services or contact us at support@bestself.co. We will not discriminate against you for exercising your rights. We may need to verify your identity before processing a request, as permitted or required by law. You may designate an authorized agent to submit requests on your behalf; we will require proof of authorization and may still need to verify your identity. We will respond within the timeframe required by applicable law (for example, 45 days under most U.S. state privacy laws, extendable once where permitted; one month under the GDPR, extendable by two further months for complex requests).

Right to Appeal. If we decline to act on your request and you live in a U.S. state whose privacy law provides an appeal right (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia), you may appeal our decision by replying to our response or contacting us at support@bestself.co with the subject "Privacy Appeal." If your appeal is denied, you may contact your state Attorney General.

Complaints

If you have a complaint about how we process your personal information, please contact us first using the details below. Depending on where you live, you also have the right to lodge a complaint with your supervisory or data protection authority, including: your local EU Data Protection Authority, the UK Information Commissioner's Office (ICO), the Office of the Privacy Commissioner of Canada (or Quebec's Commission d'accès à l'information), the Office of the Australian Information Commissioner (OAIC), Brazil's ANPD, or your U.S. state Attorney General.

International Transfers

We are based in the United States, and we may transfer, store, and process your personal information outside the country where you live, including in the United States and other countries where our service providers operate.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum or Swiss equivalents), or transfers to countries with an adequacy determination. Where we transfer personal information out of other jurisdictions (for example, Quebec, Australia, or Brazil), we take the steps required by local law to ensure the information receives comparable protection. You may contact us for more information about the safeguards we use.

Special Notice for Certain Jurisdictions

United States — All State Privacy Laws

Residents of states with comprehensive privacy laws — including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — have the rights described in "Your Rights and Choices" above to the extent provided by their state's law, including access, correction, deletion, portability, opt-out of sale/targeted advertising/certain profiling, non-discrimination, and (where applicable) appeal. Maryland residents: we do not sell sensitive personal information, consistent with Maryland law.

United States — California Residents (CCPA, as amended by the CPRA)

In addition to the rights above, California residents have the right to know the categories of personal information we have collected, the categories of sources, our business purposes, and the categories of third parties to whom we disclose, sell, or share it (see "Personal Information We Collect," "Sources," "How We Disclose," and "Categories Disclosed" above, which serve as our notice at collection); the right to limit use of sensitive personal information (we do not use sensitive personal information for purposes requiring this right); and the right to non-discrimination. We do not "sell" personal information for money, but our use of advertising Cookies may constitute "sharing" under California law — opt out via Your Privacy Choices or by enabling GPC. We do not offer financial incentives in exchange for personal information. California's "Shine the Light" law (Civil Code §1798.83) also permits California residents to request certain information regarding disclosures to third parties for their direct marketing purposes; contact us to make such a request.

European Union / European Economic Area, United Kingdom, and Switzerland (GDPR, UK GDPR, FADP, ePrivacy)

You have all the rights listed in "Your Rights and Choices," including access, rectification, erasure, restriction, portability, objection (including to direct marketing), withdrawal of consent, and the right not to be subject to solely automated decision-making with legal or similarly significant effects. Our legal bases are described in "Legal Bases for Processing" above. We will respond within one month, extendable as permitted. You may complain to your local supervisory authority, the ICO (UK), or the FDPIC (Switzerland).

Canada (PIPEDA and Provincial Laws, including Quebec Law 25)

We process Canadian residents' personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. You have the right to access and correct your personal information and to withdraw consent for non-essential processing at any time. Quebec residents additionally have rights under the Act respecting the protection of personal information in the private sector (as amended by Law 25), including data portability and the right to be informed of and have explained any decision based exclusively on automated processing. Complaints may be directed to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.

Australia (Privacy Act 1988 and the Australian Privacy Principles)

You have the right to access and correct your personal information and to opt out of direct marketing. Some of your personal information will be disclosed to recipients located outside Australia (including the United States); we take steps required by APP 8 to ensure overseas recipients handle it consistently with the APPs. If you believe we have breached the APPs, contact us first; if unresolved, you may complain to the Office of the Australian Information Commissioner (OAIC).

Brazil (LGPD)

If you are in Brazil, you have rights under the Lei Geral de Proteção de Dados, including confirmation of processing, access, correction, anonymization or deletion of unnecessary data, portability, information about sharing, and revocation of consent. Requests may be submitted to support@bestself.co. You may also contact the Autoridade Nacional de Proteção de Dados (ANPD).

Other Jurisdictions

If you live in a jurisdiction not listed above (for example, Japan, South Korea, New Zealand, or Singapore), you may have similar rights under your local law, including rights of access, correction, and deletion. We will honor requests as required by the law applicable to you — contact us using the details below.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for operational, legal, or regulatory reasons. We will post the revised Policy on this website, update the "Last updated" date, and provide notice (or obtain consent) where required by applicable law. Material changes affecting how we use previously collected personal information will be communicated as required.

Contact

Questions about this Policy or our privacy practices, or to exercise your rights:

• Email: support@bestself.co
  
  
• Mail: BestSelf Co., 2028 E Ben White Blvd, #240-5675, Austin, TX, 78741, US
  
  
• Data Sharing Opt Out: https://bestself.co/pages/data-sharing-opt-out