Privacy Policy

Effective Date: June 9, 2026 | Last Updated: June 9, 2026

Two Gooders, LLC · 1050 Calle Cordillera, Suite 104, San Clemente, CA 92673 · privacy@twogooders.com · twogooders.com

At Two Gooders, we believe in doing good, for people, communities, and the planet. Part of that commitment means being transparent about how we collect and use your information. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have.

This Policy covers two related contexts:

Part A — Customer Privacy: how we handle the information of shoppers who visit twogooders.com or place an order.
Part B — Shopify Application Privacy: how our Shopify App handles data from supplier/merchant Shopify stores connected to the Two Gooders platform.
Part C — Provisions Common to Both.

By visiting twogooders.com, placing an order, or installing or using the App, you agree to the terms of this Privacy Policy.

PART A — Customer Privacy

A1. Information We Collect

We collect information to process your orders, improve your experience, and fulfill our mission as a give-back e-commerce company.

Information You Provide Directly

Name, email address, and shipping/billing address
Account login credentials (username and password) when you create an account
Order history and gift preferences
Any messages or communications you send us

Information Collected Automatically

When you browse our website, we and our third-party partners automatically collect certain technical information, including:

IP address and browser type
Pages visited, time spent on site, and referring URLs
Device type and operating system
Cookies and similar tracking technologies (see Part C)

A2. How We Use Your Information

We use the information we collect to:

Process and fulfill your orders, including coordinating with our drop-ship supplier partners
Send order confirmations, shipping updates, and customer service communications
Administer your account and maintain account security
Send marketing emails and promotional offers (you may opt out at any time)
Analyze website usage to improve our platform and product offerings
Detect and prevent fraud and unauthorized activity
Comply with applicable laws and legal obligations
Fulfill our charitable giving commitments, including reporting impact to our charity partners

A3. How We Share Your Information (Customer)

Two Gooders does not sell your personal information to third parties. In addition to the shared circumstances in Part C, we share customer information as follows:

Supplier and Logistics Partners

Because we operate on a drop-ship model, your name, shipping address, and order details are shared with our supplier partners solely to fulfill your order. These suppliers are not permitted to use your information for their own marketing purposes.

Service Providers

We work with trusted third-party companies that help us operate our business, including:

Payment processors (e.g., Stripe) — to securely process transactions
Email platform (e.g., Twilio) — to send order and marketing communications
Analytics providers (e.g., Google Analytics) — to understand how visitors use our site
Advertising partners (e.g., Meta/Facebook Pixel) — to deliver relevant ads and measure ad performance

A4. Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies to improve your browsing experience, analyze site traffic, and deliver personalized advertising.

Essential cookies: Required for the site to function, including shopping cart and account features
Analytics cookies: Help us understand traffic patterns and improve our site (Google Analytics)
Marketing/advertising pixels: Allow us to show you relevant ads on platforms like Facebook and Instagram (Meta Pixel)

You can control cookies through your browser settings. Note that disabling certain cookies may affect site functionality. For California residents and others with applicable rights, you may opt out of the "sale" or "sharing" of personal information through interest-based advertising by adjusting your settings or contacting us directly.

A5. Email Communications

If you opt in to our email list, we may send you promotional emails about new products, sales, impact stories, and Two Gooders news. You can unsubscribe at any time by clicking the "Unsubscribe" link at the bottom of any email, or by contacting us at privacy@twogooders.com.

Even if you unsubscribe from marketing emails, we will still send you transactional messages related to your orders and account.

A6. Customer Data Retention

We retain your personal information for as long as your account is active, as needed to fulfill the purposes described in this policy, or as required by applicable law (including tax and accounting requirements). If you request deletion of your account and data, we will remove your personal information within 30 days, except where retention is legally required.

PART B — Shopify Application Privacy (Merchants & Suppliers)

B1. Introduction

Two Gooders, LLC ("Two Gooders," "we," "our," or "us") operates a cause-commerce platform that connects suppliers, merchants, and charitable partner organizations. This part describes how our Shopify application ("the App") collects, uses, stores, and shares data obtained through the Shopify API and related integrations.

This part applies specifically to data processed by the Two Gooders Shopify App, which enables supplier onboarding and synchronization of product, inventory, and order data between supplier Shopify stores and the Two Gooders platform. It is intended to satisfy the Shopify App Store's privacy policy requirements and to comply with applicable data protection laws including GDPR, CCPA, and other relevant regulations.

By installing or using the App, you acknowledge and agree to the practices described in this policy.

B2. Data We Collect

The App requests the following Shopify API access scopes during installation via OAuth 2.0. Data is collected only for the purposes described below.

B2.1 Merchant / Supplier Store Data

read_products, write_products – Product titles, descriptions, variants, SKUs, images, and pricing to sync supplier product catalogs to the Two Gooders platform.
read_product_listings – Published product listing data made available to sales channels, used to confirm which products are active and available for synchronization to the Two Gooders storefront.
read_inventory, write_inventory – Inventory levels and location data to maintain accurate stock availability across the platform.
read_orders, write_orders – Order details (order ID, line items, quantities, fulfillment status) to route and track orders placed through Two Gooders.
read_fulfillments, write_fulfillments – Fulfillment status and tracking information to update customers on order progress.
read_locations – Supplier warehouse and shipping location data to facilitate accurate order routing.
read_shipping – Carrier accounts and shipping rates to calculate logistics costs.

B2.2 Onboarding & Account Data

Supplier store name and email address, which are retrieved from Shopify's API during App installation rather than provided directly by the supplier, and supplier contact name collected during the onboarding intake process.
OAuth access tokens used to authenticate API calls on behalf of the merchant's store. Tokens are encrypted at rest using AES-256 encryption and are never exposed in logs or to third parties.
Third-party Inflow API credentials (Company ID and API Key) provided by suppliers, which we store to enable inventory and order synchronization with the supplier's Inflow account. These credentials are encrypted at rest and are never exposed in logs or to unauthorized third parties.
Webhook endpoint configuration data to enable real-time event notifications.

B2.3 Data We Do NOT Collect

We do not collect or store end-customer payment card data, bank account numbers, or other financial credentials.
We do not collect consumer browsing history or behavioral tracking data.
We do not collect data beyond what is necessary to provide the App's core synchronization functionality.

B3. How We Use Data

Data collected through the Shopify API is used solely for the following purposes:

Supplier onboarding: Verifying supplier eligibility and establishing an authenticated connection between the supplier's Shopify store and the Two Gooders platform.
Product catalog synchronization: Importing and maintaining an up-to-date copy of supplier product listings on the Two Gooders storefront.
Inventory management: Reflecting accurate stock levels to prevent overselling across the drop-ship network.
Order routing and fulfillment: Transmitting customer orders to the correct supplier and receiving fulfillment confirmations and tracking updates.
Platform operations: Diagnosing integration errors, monitoring webhook delivery, and ensuring platform reliability.
Compliance: Responding to data subject requests, mandatory Shopify compliance webhooks, and applicable regulatory obligations.

We do not use merchant or customer data for advertising, profiling, or any purpose unrelated to the App's stated integration functionality.

B4. App Data Retention

We retain data for the minimum period necessary to fulfill operational and legal obligations:

Active integration data (product, inventory, order records): Retained for the duration of the supplier's active relationship with Two Gooders.
OAuth access tokens: Retained only while the App is installed. Tokens are revoked and purged within 48 hours of uninstallation.
Order and fulfillment records: Retained for up to 7 years in accordance with California commercial recordkeeping requirements and applicable tax law.
Onboarding records and supplier contact data: Retained for the duration of the supplier agreement and up to 3 years thereafter for legal and dispute resolution purposes.
Deleted or uninstalled store data: All store-specific data is permanently deleted within 30 days of App uninstallation unless a longer retention period is required by law.

B5. Shopify Mandatory Compliance Webhooks

As required by Shopify for all apps listed on the Shopify App Store, the Two Gooders App implements the following mandatory compliance webhooks:

customers/data_request: Upon receipt of a merchant's customer data access request, we compile all data associated with the identified customer and make it available to the merchant within 30 days in a machine-readable format (JSON).
customers/redact: Upon receipt of a customer data deletion request, we permanently delete all personally identifiable information (PII) associated with that customer from our systems within 30 days. This includes customer profiles, contact information, and order associations.
shop/redact: Upon uninstallation of the App, we initiate deletion of all store-level data within 48 hours and complete permanent deletion within 30 days.

Webhook endpoints are secured via HTTPS, and all payloads are verified using Shopify's HMAC signature validation to prevent unauthorized requests.

PART C — Provisions Common to Both

C1. Additional Data Sharing & Disclosure

We do not sell, rent, or trade personal data. Beyond the context-specific sharing above, we may share data in the following limited circumstances:

Charity Partners

We may share aggregated, non-personally identifiable impact data (e.g., total donations, purchase categories, units sold) with our charity partner organizations to report on program outcomes. We do not share your personal details with charities without your consent.

Service Providers

We work with trusted third-party vendors (e.g., cloud hosting, database infrastructure) who process data on our behalf under data processing agreements that require equivalent protections. These providers may only use data for the services they provide to us.

Legal Compliance

We may disclose your information if required to do so by law, in response to a subpoena, court order, or regulatory authority, or where necessary to protect the rights, property, or safety of Two Gooders, our customers, our users, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of company assets, your information may be transferred as part of that transaction subject to the same privacy commitments. We will notify you via email or a prominent notice on our website if such a change occurs.

Shopify

Data processed through the Shopify API is also subject to Shopify's Privacy Policy, available at https://www.shopify.com/legal/privacy.

C2. Data Security

We implement industry-standard security measures to protect data, including:

SSL/TLS 1.2+ encryption for all data in transit, including web traffic, API calls, and webhook payloads
AES-256 encryption for OAuth access tokens and sensitive credentials at rest
HMAC signature validation for all inbound Shopify webhook payloads
Role-based access controls limiting data access to authorized personnel
Working only with payment processors that are PCI-DSS compliant
Regular security reviews and vulnerability assessments

While we take reasonable precautions, no method of transmission over the internet, and no system, is completely secure. We encourage you to use a strong, unique password for your account and to contact us immediately if you suspect unauthorized access. In the event of a data breach affecting personal data, we will notify affected parties in accordance with applicable law.

C3. Your Privacy Rights

Depending on where you live, you may have the following rights with respect to your personal information:

Access: Request a copy of the personal data we hold about you
Correction / Rectification: Request that we correct inaccurate or incomplete information
Deletion / Erasure: Request that we delete your personal data, subject to legal requirements
Opt-Out of Marketing: Unsubscribe from promotional communications at any time
Opt-Out of Targeted Advertising: Object to the use of your data for interest-based advertising
Data Portability: Request a copy of your data in a structured, commonly used, machine-readable format

GDPR — European Economic Area, UK, and Switzerland

If you are located in the EEA, United Kingdom, or Switzerland, we process your data under the following legal bases: contractual necessity (processing required to fulfill the supplier agreement and provide services), legitimate interests (fraud prevention, security monitoring, and platform reliability), and legal obligation (compliance with applicable law). In addition to the rights above, you have the right to restriction of processing, the right to object to processing based on legitimate interests, and the right to withdraw consent (where processing is based on consent) without affecting prior processing. To exercise these rights, contact privacy@twogooders.com; we will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority. Two Gooders does not transfer EEA personal data to countries outside the EEA without implementing appropriate safeguards, including Standard Contractual Clauses (SCCs) where required.

CCPA / CPRA — California

Two Gooders is a California-based limited liability company (LLC). For California residents, the CCPA as amended by the CPRA provides the following rights: Right to know (the categories and specific pieces of personal information collected in the past 12 months, the sources, the business purposes, and the third parties with whom it has been shared); Right to delete (subject to legal exceptions); Right to correct; Right to opt out of sale/sharing (Two Gooders does not sell or share personal information for cross-context behavioral advertising); Right to limit use of sensitive personal information (we do not use sensitive personal information beyond purposes permitted under the CPRA); and Right to non-discrimination. To submit a California privacy request, contact privacy@twogooders.com. We will verify your identity before processing and respond within 45 days (with a possible 45-day extension where reasonably necessary).

C4. Children's Privacy

Our storefront and services are not directed to children under the age of 13, and we do not knowingly collect personal information from children. Separately, the Two Gooders Shopify App is intended for use by business operators (merchants and suppliers) and is not directed to individuals under the age of 18. If you believe we have inadvertently collected information from a child or minor, please contact us immediately at privacy@twogooders.com so we can delete it.

C5. Third-Party Links and Services

Our website and the App may contain links to, or integrate with, third-party websites and services, including the Shopify platform, our charity partners, supplier pages, cloud hosting providers, and logistics partners. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party site or service you use.

C6. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or App functionality. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you (and merchants) by email or a prominent notice. Your continued use of our site or the App after changes take effect constitutes your acceptance of the updated policy.

C7. Contact Us

For privacy questions, data requests, or to exercise your rights under applicable law, please contact:

Two Gooders, LLC — Privacy & Data Requests
Email: privacy@twogooders.com
Mailing Address: 1050 Calle Cordillera, Suite 104, San Clemente, CA 92673
Website: www.twogooders.com

For EEA residents, if you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in your country.