Privacy Policy

1. Information we collect and its sources

The information we collect depends on how you interact with the Services. We receive information directly from you, automatically through your use of the Services, and from service providers and business partners as described below.

Information you provide

• Contact and account information: your name, email address, telephone number, billing and shipping addresses, username, account credentials, and information used to protect your account.
• Order and transaction information: products purchased, order history, payment confirmations, returns, exchanges, and related communications. Payment providers collect payment details to process transactions.
• Seller information: information you provide for a Marketplace artist account, product listings, payment instructions, and tax reporting, including required tax forms.
• Support and communications: questions, messages, attachments, and other information you provide when contacting us.
• Reviews and public content: ratings, text, chosen display name, photographs, videos, audio, captions, and information visible or audible in them, including a face, voice, appearance, or other identifiable features. We may associate a review with a product, an account or order, its submission date, moderation information, and an incentive or material-connection disclosure.
• Permissions and preferences: records of your acceptance of applicable terms, privacy and marketing choices, and permissions or releases you provide concerning uploaded content.

We may receive personal information about you from another person who submits content depicting or mentioning you. Contact us if you believe someone has submitted your information or likeness without authority.

Information collected automatically

We collect information about interactions with the Services, including IP address, device and browser information, network information, pages and products viewed, referring pages, and interactions with our messages, advertisements, and media players. Cookies, pixels, and similar technologies support this collection. An IP address may indicate an approximate location.

Uploaded files may contain embedded metadata, such as recording date, device information, and location information. Do not assume that every upload has had all metadata removed. Review your files and remove private information before uploading them. Information visible or audible in a photo or video may reveal personal details even if embedded metadata is removed.

Information from providers and partners

We receive information from providers supporting the Services, including Shopify, payment processors, shipping and fulfillment providers, and advertising and analytics partners. For example, these providers may supply payment status, delivery information, fraud indicators, and information about interactions with our Services or advertisements. For international orders, relevant information may be exchanged with Passport and its shipping and customs partners.

Some information is necessary to fulfill an order, maintain an account, or provide a requested feature. If you do not provide it, we may be unable to provide that feature. Submitting a review or attaching media is not necessary to make a purchase.

2. How we use personal information

We use the information described above for the following purposes:

• Provide the Services: create and administer accounts; process payments and orders; deliver products; manage returns, exchanges, Marketplace sales, seller payments, and customer support; and send service and transaction messages.
• Operate reviews: receive, host, process, moderate, and publish reviews and media; check product and purchase associations; prevent spam and fraudulent reviews; handle content complaints; and maintain evidence of permissions and applicable terms.
• Use customer content in marketing: display and adapt submitted reviews, photos, videos, and associated public attribution on product pages and in theory11 advertising, social media, email campaigns, product packaging, printed materials, retail and event displays, broadcast and streaming media, and other promotional channels, including campaigns for theory11 collaborations and distribution through authorized partners, within the permissions granted and subject to applicable privacy law.
• Communicate and advertise: send permitted marketing messages by email, text, or postal mail, measure campaigns, and personalize the Services and advertising, including on third-party platforms, subject to your choices and any required consent.
• Improve and protect the Services: understand performance and usage, troubleshoot problems, maintain security, detect and investigate abuse and fraud, and protect users and others.
• Meet legal and business obligations: maintain accounting and tax records, comply with law and valid legal process, resolve disputes, establish or defend legal claims, and administer permitted business transactions.

We do not seek sensitive personal information in public reviews. Do not upload government identifiers, financial account details, private health information, intimate material, or precise location information. We do not use submitted review media to infer sensitive characteristics about you. The review license does not authorize the creation of a new synthetic performance or voice clone of you.

If you choose to use other Shopify consumer services, we may enable Shopify to match your account with those services. Shopify's own notices govern processing it undertakes for its independent services. We may also use properly aggregated or de-identified information for business analysis, service improvement, and other lawful purposes. Where law requires, we maintain such information in de-identified form and do not attempt to re-identify it except as permitted by law.

3. Public reviews and likeness information

An approved review may display your chosen public name, rating, text, submitted media, product association, and relevant labels such as an incentive disclosure. Material you include in a public submission may also appear in marketing. The content license does not authorize publication of your private email address, telephone number, billing details, or account credentials. Avoid including such information in the submission itself.

Public reviews and marketing materials may be viewed worldwide, indexed by search engines, or copied and shared by third parties. Those third parties may retain copies outside our control. Public availability does not eliminate privacy rights that apply under law.

Only adults who meet the eligibility requirements in our Terms may submit review photos or videos. Do not submit photos or videos depicting or identifying minors. Before including another identifiable adult, obtain that person's express permission for public display and the commercial uses described in the Terms, including authority to grant those permissions on their behalf. We may request evidence of permission or a direct release. Ordinary forum posts are governed by the separate public-submission provision in the Terms; posting there does not itself grant the review-media advertising permission.

You may request removal or report unauthorized use of your image, voice, or information by emailing support@theory11.com. Include the relevant page or content reference and enough information to identify the issue. Do not send sensitive identity documents unless we specifically request a necessary, secure verification method. We assess requests under applicable law and the Terms; the fact that a license is described as irrevocable does not defeat a valid privacy request.

4. Legal bases for processing

Where the laws of the European Economic Area or United Kingdom apply, we rely on the following legal bases, as appropriate to the particular activity:

• Contract: processing objectively necessary to fulfill your order, administer a requested account or Marketplace transaction, or provide the review publication feature you request. A provision in our Terms does not make every advertising use necessary to perform a contract.
• Legitimate interests: operating, securing, understanding, and improving the Services; preventing fraud; responding to support requests; and conducting permitted business and marketing activities, after considering your interests and rights. We do not rely on this basis where your rights override those interests or consent is required.
• Consent: activities for which we request consent or law requires it, including applicable nonessential tracking, marketing communications, and promotional use of identifiable review media where required. Where separate consent is required for promotional reuse, we obtain a distinct, optional consent rather than treating acceptance of the Terms as that consent.
• Legal obligation: processing needed to satisfy applicable tax, accounting, consumer protection, and other legal requirements.

Where we rely on consent, you may withdraw it at any time using the relevant preference control or by contacting support@theory11.com. Withdrawal does not affect the lawfulness of processing before withdrawal. We will stop the processing that depends on the withdrawn consent, unless law permits or requires limited continued processing for a separate purpose, such as legal recordkeeping. We will not treat the content license as a substitute for withdrawn consent.

You may object to processing based on legitimate interests, and you may object to direct marketing at any time. The rights described in Section 9 apply in addition to the controls described throughout this Policy.

5. How we disclose information

We disclose information as appropriate to the purposes described above:

• Service providers: companies that provide e-commerce infrastructure, payments, hosting, storage, image and video processing and streaming, content delivery, moderation support, analytics, security, customer support, communications, fulfillment, shipping, and tax or payment administration. They receive information needed for their functions, subject to applicable contractual and legal restrictions. Shopify provides our store platform, and Postscript supports our text messaging program.
• Advertising and marketing partners: platforms and partners that deliver, personalize, or measure advertisements and support campaigns. We use Shopify advertising services, including Shopify Audiences, as described in the advertising choices below. Information disclosed for advertising is subject to applicable consent and opt-out requirements.
• The public and promotional distribution partners: recipients of the reviews and media you submit for publication, and platforms, agencies, and other providers involved in authorized theory11 marketing. Publishing a customer review is different from disclosing browsing or purchase data for targeted advertising; privacy rules apply to each activity according to its circumstances.
• Parties you direct us to use: for example, a shipping provider, a social integration you choose, or a person you authorize to act for you.
• Affiliates and professional advisers: where reasonably necessary for the purposes in this Policy and subject to applicable safeguards.
• Legal and business recipients: authorities or other parties when required by law, necessary to protect rights or safety, or involved in a merger, financing, acquisition, reorganization, or other business transaction, subject to applicable confidentiality and privacy obligations.

For copyright and other rights complaints, relevant information may be shared with the submitting user, complaining party, advisers, or authorities to process the complaint and meet legal requirements. We do not treat such complaints as public review submissions.

We do not share mobile opt-in data or text messaging consent with third parties or affiliates for their own marketing or promotional purposes. We may provide that information to service providers supporting the messaging program, subject to restrictions on its use.

Our media and infrastructure providers include, but are not limited to, Cloudflare, Mux, Amazon Web Services, and Wistia. Providers may vary by feature and may change over time. Identifying these examples does not limit us to a particular storage, processing, playback, or delivery system. Any additional or replacement provider remains subject to the applicable purposes, restrictions, and safeguards described in this Policy.

6. Cookies and advertising choices

We use cookies and similar technologies to operate the store, remember preferences, secure accounts, analyze use, and support advertising. Some are necessary for functions you request; others are used for analytics or advertising. Where required by law, nonessential technologies are used only with your prior consent. You may use the cookie or privacy controls provided on the Services to manage choices and withdraw consent where applicable. See Shopify's cookie information for its platform technologies.

You may also block or delete cookies through browser settings. Blocking necessary cookies may interfere with account, checkout, or other functionality. Cookie choices can depend on the device and browser you use; deleting cookies may reset saved choices. Blocking cookies alone may not stop every disclosure made to advertising partners.

Where applicable law gives you a right to opt out of the sale or sharing of personal information or targeted advertising, you can exercise it through our privacy controls or by emailing support@theory11.com with your request. We honor legally recognized opt-out preference signals, including Global Privacy Control, where required. Such a signal applies to the browser or device transmitting it and to an identifiable account where required by law. We do not require account creation to exercise these opt-out rights.

Our Services do not respond to the older browser "Do Not Track" setting as a general signal. This is separate from our obligation to honor legally recognized opt-out preference signals. You may also manage advertising uses supported by Shopify through Shopify's privacy portal. That portal supplements, and does not replace, requests you can make directly to theory11.

Unsubscribe from marketing email through the link in an email. Reply STOP to a marketing text or contact support@theory11.com to revoke text marketing consent. We honor other reasonable revocation methods where required. Opting out of marketing does not stop necessary order or account messages. Submitting a review does not subscribe you to marketing messages.

7. Additional information for United States residents

State privacy laws may provide additional rights, depending on where you live and whether a particular law applies to our activities. The categories below describe information collected and disclosed in our existing operations during the preceding 12 months, to the extent applicable to your interactions. The review-media category also describes collection and disclosure beginning when that feature becomes available; it is not a statement that a new feature operated throughout that period.

Categories and recipients

• Identifiers and customer records: names, contact details, account identifiers, and relevant order and payment information. Recipients include e-commerce, payment, account, support, shipping, and communications providers; affiliates and advisers as needed; and advertising partners for permitted matching and campaign purposes. Private credentials and full payment details are not supplied as advertising data.
• Commercial information: purchase, return, and transaction history. Recipients include providers supporting transactions, support, accounting, and analytics, and advertising partners for permitted personalization and measurement.
• Internet and network activity: browser and device information and interactions with our Services, messages, and advertising. Recipients include hosting, security, analytics, and advertising providers.
• Approximate geolocation: location inferred from an IP address or similar general technical information. Recipients include providers supporting security, localization, analytics, and advertising. This does not mean that we request precise device location for a review.
• Audio, electronic, and visual information: submitted review media and other content you provide. Recipients include media hosting, processing, moderation, and support providers and, for content submitted for public use, the public and recipients of permitted marketing uses. Private support attachments are not public review content.
• Seller and sensitive account information: tax identifiers, payment instructions, or account access information provided for seller administration or account security. Recipients include providers handling those functions and authorities where required; this information is not provided for targeted advertising.

Information in each category may also be disclosed to legal or business-transaction recipients in the circumstances described in Section 5. Sources, purposes, and retention criteria are explained in Sections 1, 2, and 8. We do not use or disclose sensitive personal information to infer characteristics about you; its use is limited to providing requested services, security, legal obligations, and other purposes permitted without a right to limit under applicable law.

Sale sharing and targeted advertising

We disclose identifiers, commercial information, internet activity, and approximate location information to advertising and marketing partners for personalization and measurement, as described above. These disclosures may constitute a "sale" for valuable consideration, "sharing" for cross-context behavioral advertising, or "targeted advertising" under state privacy laws, even when no money is exchanged for the information. The same categories have been involved in these advertising practices during the preceding 12 months, to the extent those practices applied to your interactions.

You may opt out through the methods in Section 6. We do not knowingly sell or share the personal information of individuals under 16. A non-exclusive license to use a review does not waive an applicable advertising opt-out right. If a particular promotional disclosure falls within a regulated sale, sharing, or targeted advertising activity, we apply the corresponding legal requirements.

8. Retention and security

We retain personal information only as long as reasonably necessary and proportionate for the purposes described in this Policy, subject to applicable law. We consider the information's nature and sensitivity, the duration of your relationship with us, whether the purpose remains active, legal retention requirements, and the need to handle complaints, security incidents, or legal claims.

• Accounts, orders, and seller records: retained as needed to provide the relationship or transaction, administer returns and payments, meet tax and accounting obligations, and handle applicable disputes or claims.
• Reviews and media: retained while reasonably needed to publish and administer reviews and carry out permitted promotional uses. A product's removal from sale does not necessarily end a lawful promotional use. We assess continued need in light of privacy requests, the ongoing purpose, and applicable law; the perpetual license is not an instruction to retain personal information forever.
• Permission and moderation records: retained as reasonably needed to document authorized uses, honor choices, prevent abuse, and establish or defend legal claims. Such records may need to be retained after the public content is removed, with access restricted as appropriate.
• Technical, support, and marketing records: retained for the applicable operational, security, support, or communication purpose. Limited suppression records may be kept to honor an opt-out.

When information is no longer needed, we delete or de-identify it as appropriate. Backup copies may remain until the relevant backup cycle completes, subject to legally required limits and restricted use. Legal holds and statutory exceptions may require particular records to be kept longer.

We use reasonable safeguards appropriate to the information and its processing. No system is completely secure. Protect your account credentials and avoid sending sensitive information through public reviews or insecure communications.

9. Your rights and requests

Depending on applicable law, you may have rights to:

• Know whether we process your information and access it, including information about the categories, sources, purposes, and recipients of collection or disclosure.
• Correct inaccurate personal information, request deletion, and receive a portable copy where available.
• Opt out of sale, sharing, or targeted advertising and, where applicable, profiling used for decisions with legal or similarly significant effects.
• Limit qualifying uses or disclosures of sensitive personal information where a right to limit applies.
• Restrict processing, object to processing based on legitimate interests, and object to direct marketing.
• Withdraw consent when consent is the legal basis for processing.
• Appeal a denied request and complain to an appropriate regulator.

Email support@theory11.com, call (800) 511-9484, or write to the address in Section 12 to exercise a right. You may also use relevant controls on the Services. Identify the request and, for content-related requests, the review or media involved. You may make a request about information depicting you even if another person uploaded it.

We may need to verify identity and authority before granting access, deletion, or other requests that require verification. Verification will be proportionate to the request; advertising opt-outs generally do not require identity verification. Where permitted, an authorized agent may act for you, subject to appropriate proof of authority and any legally permitted verification.

Rights may be subject to exceptions, including for legal compliance, security, free expression, or legal claims. We will respond within the deadlines required by applicable law and explain a denial or permissible extension. You may appeal by replying to the response or contacting support@theory11.com with "Privacy Appeal" in the subject. If an appeal is denied, we will provide information about further complaint options where required. We will not unlawfully discriminate or retaliate against you for exercising privacy rights.

Where a valid request requires us to stop using or delete identifiable Review Content, we will apply it to uses under our control and take required steps with service providers or other recipients. A perpetual copyright license does not override that obligation. We may be unable to recall printed materials already distributed or copies independently made by others, but this does not excuse steps required by law or allow new unlawful distribution.

10. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information directly from children under 13. Review photo and video submissions are restricted to adults under our Terms, and those photos and videos must not depict or identify minors. Users aged 13 or older who are below the age of majority need a parent or guardian's authorization for other permitted uses of the Services. These restrictions do not replace our legal obligations when we learn that children's information has been collected.

If you believe a child has provided personal information or a review contains a child's information, contact support@theory11.com. We will investigate and delete or otherwise handle the information as required by applicable law. Parents and guardians may contact us to exercise applicable rights on a child's behalf.

11. International processing and third-party services

theory11 operates in the United States. Information may be transferred to, stored in, and processed in the United States and other countries where our providers or partners operate. Privacy laws may differ from those where you live. Where European or UK law requires safeguards for an international transfer, we use an applicable adequacy decision, approved contractual safeguards such as the European Commission's Standard Contractual Clauses and relevant UK mechanism, or another lawful transfer basis. Contact us for information about applicable safeguards and, where available, a copy.

Links and integrations may take you to independently operated services. Their privacy notices govern their own processing, and our inclusion of a link does not make us responsible for all of their practices. Shopify may process information for services you choose under its own Privacy Policy. Our text program is also described in the Messaging Privacy Policy. Those notices do not reduce rights you have concerning theory11's processing.

12. Changes contact and complaints

We may update this Policy to reflect changes in our practices or legal requirements. We will post the updated version with a new date, provide additional notice of material changes as required, and obtain consent where required before a new use. Continued browsing does not substitute for consent where consent is necessary.

For privacy questions, requests, or complaints, email support@theory11.com, call (800) 511-9484, or write to theory11, 4401 Belle Oaks Drive, Suite 120, North Charleston, SC 29405, United States.

You may also complain to an appropriate data protection authority or state regulator. EEA residents can find their authority in the European Data Protection Board directory; UK residents may contact the Information Commissioner's Office. You do not need to contact us first to exercise a legal right to complain to a regulator.