Privacy Policy

Last updated: September 7, 2026

This Privacy Policy explains how Plant In The Box Inc. (“Plant In The Box,” “we,” “us,” or “our”) collects, uses, and discloses personal information when you visit plantinthebox.com, purchase or receive a product, enroll in a subscription, participate in a gifting program, communicate with us, or otherwise use our website and related services (collectively, the “Services”).

Plant In The Box uses Shopify to operate its online store. Information submitted through the Services may be processed by Shopify and by service providers that support our business.

Personal Information We Collect

“Personal information” means information that identifies, relates to, describes, or can reasonably be linked with an individual or household. It does not include information that has been aggregated or de-identified so that it cannot reasonably be linked to an individual.

Depending on how you interact with us, we may collect the following categories of personal information:

• Contact information, such as your name, billing address, delivery address, email address, telephone number, and business name.

• Order and transaction information, such as products viewed or purchased, order history, subscription selections, gift messages, delivery instructions, payment status, refunds, replacements, and claims.

• Account information, such as login credentials, saved addresses, preferences, and subscription settings.

• Communications, including information provided through customer-support requests, forms, email, telephone, text messages, reviews, photographs, claims, and social-media interactions.

• Device and website information, such as your IP address, browser, device type, operating system, approximate location, cookie or advertising identifiers, referring pages, pages and products viewed, searches, cart activity, checkout activity, and dates and times of visits.

• Marketing and analytics information, such as interactions with advertisements, emails, text messages, and other marketing communications.

Payments are processed by Shopify and our payment providers. Plant In The Box generally does not receive or store complete payment-card numbers.

Sources of Personal Information

We may collect personal information:

• Directly from you;

• Automatically from your browser or device;

• From someone purchasing or arranging a gift for you;

• From a business or other organization arranging a gifting order;

• From Shopify and service providers supporting our operations;

• From fulfillment and delivery providers;

• From advertising, analytics, and marketing providers; and

• From fraud-prevention and security providers.

If you provide personal information about another person, you represent that you are authorized to provide it for the requested purchase, gift, delivery, communication, or other purpose.

How We Use Personal Information

We may use personal information to:

• Process payments and complete transactions;

• Prepare, fulfill, ship, track, and deliver orders;

• Send order, gift, and delivery notifications;

• Provide product information and virtual care cards;

• Administer subscriptions and recurring purchases;

• Process subscription renewals, changes, pauses, and cancellations;

• Fulfill corporate and multi-recipient gifting orders;

• Provide customer service;

• Process refunds, replacements, guarantees, and claims;

• Maintain customer accounts and preferences;

• Communicate with purchasers and recipients about an order;

• Personalize and improve the Services;

• Analyze website and product performance;

• Measure advertising and marketing effectiveness;

• Send promotional communications with appropriate consent;

• Detect and prevent fraud, abuse, and security incidents;

• Maintain business, tax, accounting, and transaction records;

• Comply with law and respond to valid legal requests;

• Enforce our agreements and policies; and

• Establish, exercise, or defend legal claims.

Gifts and Corporate Gifting

A purchaser or business customer may provide personal information about a gift recipient, including the recipient’s name, delivery address, email address, telephone number, delivery instructions, and gift message.

We use this information to fulfill and deliver the gift, send requested gift or delivery notifications, coordinate delivery, provide customer service, prevent fraud, and resolve order issues. We may disclose recipient information to service providers involved in processing, preparing, communicating about, or delivering the order.

Receiving a gift does not enroll the recipient in promotional email or text-message marketing. We may send transactional communications related to the gift or delivery, but recipients are added to marketing lists only if they separately choose to subscribe.

Working files used to process corporate or multi-recipient orders are generally deleted or access-restricted after fulfillment, subject to operational, backup, fraud-prevention, recordkeeping, and legal requirements. Related order records may be retained as described below.

Subscriptions

If you purchase a subscription, we use your account, payment, delivery, preference, and transaction information to administer recurring purchases, process renewals, provide notices, and manage changes, pauses, or cancellations.

Payment credentials are processed by Shopify and our payment and subscription providers. Additional subscription terms may be presented when you enroll.

Email and Text Messages

If you subscribe to promotional email or SMS communications, we may collect your contact information, consent records, communication preferences, and information about your interactions with those communications.

Marketing text messages may be sent using automated technology. Consent to receive marketing messages is not a condition of purchase. Message frequency may vary, and message and data rates may apply.

You may unsubscribe from promotional emails using the unsubscribe link included in an email. You may opt out of promotional text messages by replying STOP. Reply HELP for assistance.

We use service providers to administer our email and SMS programs. Mobile information, SMS opt-in data, and consent records will not be sold or shared with third parties or affiliates for their own marketing or promotional purposes. We may disclose this information to providers that help us operate our messaging program and as otherwise required by law.

Opting out of promotional communications does not prevent us from sending non-promotional messages, such as order confirmations, requested gift notifications, delivery updates, subscription notices, safety notices, or responses to customer-service requests.

We may offer a discount to customers who voluntarily provide an email address and enroll in promotional email communications. You can unsubscribe at any time. Unsubscribing does not affect an eligible discount that has already been applied to an order.

Cookies and Similar Technologies

We and our service providers use cookies, pixels, tags, local storage, and similar technologies to operate the Services, maintain security, remember preferences, perform analytics, measure advertising and conversions, and personalize content or advertisements where permitted.

Where required, we obtain consent before using nonessential cookies or similar technologies. You may manage applicable choices through our cookie banner, Cookie Preferences link, and Data Sharing Opt-Out page.

You may also configure your browser to block or delete cookies. Blocking certain cookies may affect the operation of portions of the Services.

How We Disclose Personal Information

We may disclose personal information to the following categories of recipients.

Shopify

Shopify hosts and supports our online store and processes personal information to provide its services to us and our customers. Shopify may also process information to provide fraud prevention, analytics, personalization, advertising, and other enhanced services.

You can learn more through the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

Service Providers

We disclose personal information to providers that support functions such as payment processing, ecommerce, subscriptions, order management, fulfillment, delivery, communications, customer support, reviews, analytics, advertising, fraud prevention, security, accounting, insurance, and legal services.

These providers may process personal information as necessary to perform services for us and as otherwise permitted by their agreements and applicable law.

Advertising and Analytics Providers

Subject to applicable law and your privacy choices, advertising and analytics providers may receive information such as device identifiers, IP addresses, approximate location, website activity, product interactions, cart activity, and purchase or conversion information.

These providers may use the information to provide analytics, measure advertising performance, create or measure audiences, and deliver or personalize advertisements. Depending on where you live, these disclosures may be considered a “sale,” “sharing,” or processing for targeted advertising under applicable privacy laws, even though we do not receive money for the information.

You may exercise applicable opt-out rights through our Data Sharing Opt-Out page.

Other Disclosures

We may disclose personal information:

• When you request, direct, or authorize the disclosure;

• To comply with law, regulation, court order, subpoena, or valid legal process;

• To protect the rights, property, safety, and security of Plant In The Box, our customers, recipients, service providers, or others;

• To investigate fraud, abuse, security incidents, or unlawful activity;

• To enforce our agreements and policies; or

• In connection with an actual or proposed merger, financing, acquisition, restructuring, bankruptcy, sale of assets, or similar business transaction.

Sale, Sharing, and Targeted Advertising

We do not sell personal information for money. Some disclosures to advertising and analytics providers, however, may be treated as a sale, sharing, or targeted advertising under certain state privacy laws.

During the preceding 12 months, we disclosed the following categories of personal information for advertising, analytics, or targeted-advertising purposes:

• Identifiers, such as IP addresses, cookie identifiers, and advertising identifiers;

• Commercial information, such as product views, cart activity, and purchases;

• Internet or electronic-network activity;

• Approximate location; and

• Information reflecting likely interests or preferences.

The recipients of this information may include advertising, analytics, social-media, and attribution providers. We disclose this information for analytics, advertising measurement, audience measurement, and advertising delivery or personalization.

We do not knowingly sell or share personal information belonging to individuals under 16 years of age.

You may exercise applicable opt-out rights through our Data Sharing Opt-Out page. Where required by applicable law, we recognize a Global Privacy Control signal as a request to opt out of the sale or sharing of personal information and targeted advertising for the browser or device sending the signal.

Data Retention

We retain personal information for as long as reasonably necessary to fulfill orders, administer subscriptions, maintain accounts, provide customer service, process guarantees and disputes, prevent fraud, maintain business and legal records, enforce agreements, and comply with applicable law.

We do not use one fixed retention period for every category of information. Retention depends on the nature of the information, our relationship with you, operational requirements, and applicable legal obligations.

When information is no longer reasonably necessary, we may delete, de-identify, aggregate, or restrict access to it, subject to legal and technical limitations.

Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information. No security system or method of transmission is completely secure, however, and we cannot guarantee absolute security.

You are responsible for protecting your account credentials. Please do not send sensitive or confidential information through unsecured communication channels.

Your Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have the right to:

• Confirm whether we process your personal information;

• Access personal information we maintain about you;

• Correct inaccurate personal information;

• Request deletion of personal information;

• Receive certain information in a portable format;

• Opt out of the sale or sharing of personal information;

• Opt out of processing for targeted advertising;

• Opt out of certain profiling that produces legal or similarly significant effects;

• Withdraw consent where processing is based on consent;

• Restrict or object to certain processing;

• Appeal a decision concerning a privacy request; and

• Exercise your rights without unlawful discrimination.

These rights are not absolute and may apply only in certain circumstances. We may deny or limit a request when permitted by law.

Submitting a Request

You may exercise applicable rights by:

• Using our Data Sharing Opt-Out page;

• Emailing help@plantinthebox.com; or

• Writing to us at the address below.

We may need to verify your identity before completing a request. The information required for verification will depend on the nature and sensitivity of the request.

Where permitted, you may designate an authorized agent to submit a request. We may require proof of the agent’s authority and may ask you to verify your identity directly.

If we deny a request, you may appeal by replying to our response or contacting us and clearly identifying the request as an appeal.

Global Privacy Control and Do Not Track

Where required by applicable law, we recognize a Global Privacy Control signal as a request to opt out of the sale or sharing of personal information and targeted advertising for the browser or device sending the signal.

Other browser “Do Not Track” signals do not currently provide a consistent technical standard. Except for recognized signals such as Global Privacy Control where applicable, we do not respond to those signals.

Children’s Privacy

The Services are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal information directly from children under 13.

We also do not knowingly sell or share personal information belonging to individuals under 16. If you believe a child has provided personal information to us improperly, please contact us so we can investigate and take appropriate action.

Third-Party Websites

The Services may contain links to websites, applications, or services operated by third parties. We do not control and are not responsible for the privacy, security, content, or practices of third-party services. Review their privacy policies before providing personal information.

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technologies, Services, or legal requirements.

When we make changes, we will post the updated policy and revise the “Last updated” date. We will provide additional notice when required by law.

Contact Us

For questions about this Privacy Policy, our privacy practices, or a privacy-rights request, contact:

Plant In The Box Inc.
7582 Las Vegas Boulevard South, #238
Las Vegas, Nevada 89123
United States

Email: help@plantinthebox.com