Privacy Policy

Welcome to the Centerpiece platform. This Privacy Policy describes how Centerpiece Lab, Inc. ("Company," "we," "us," or "our") collects, uses, discloses, and safeguards your personal information when you visit, register on, or make purchases through any storefront hosted on the Centerpiece platform (collectively, the "Platform").

Centerpiece Lab is the merchant of record for all transactions conducted through the Platform. Storefronts on the Platform are operated by independent partners ("Store Operators" or "Partners") who promote products on our behalf. Partners are not parties to the transaction between you and the Company. All purchases are made directly from Centerpiece Lab, Inc.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please discontinue use of the Platform.

This Privacy Policy applies regardless of which storefront you visit or purchase from, as all storefronts are part of the Centerpiece platform operated by Centerpiece Lab, Inc.

We collect the following categories of personal information when you interact with the Platform:

Information You Provide

• Account Information: Name, email address, phone number, and password when you create an account.
• Profile Information: Shipping address, billing address, and communication preferences you choose to provide.
• Transaction Information: Details of products you purchase, order history, payment method details (processed by our payment service providers), and shipping preferences.
• Communications: Messages you send to us through customer support, feedback forms, or email correspondence.
• User Content: Product reviews, ratings, or other content you voluntarily submit on the Platform.

Information Collected Automatically

• Device Information: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage Information: Pages visited, time spent on pages, click patterns, referral URLs, and navigation paths within the Platform.
• Location Information: Approximate geographic location derived from your IP address, used for shipping estimation and regional compliance.
• Log Data: Server logs recording access times, error reports, and diagnostic data necessary for platform operations.

Information from Cookies and Similar Technologies

We use cookies, pixels, and similar technologies to maintain your session, remember your preferences (such as language and theme settings), and collect aggregated analytics. For complete details about our cookie practices, please see our Cookie Policy.

Information from Third Parties

• Payment Processors: Transaction confirmation and fraud screening results from our payment service providers.
• Fulfillment Partners: Shipping status updates and delivery confirmation from logistics providers acting on our behalf.

We process your personal information for the following purposes:

Order Fulfillment and Platform Operations

• Processing and fulfilling your orders, including payment processing and shipping coordination.
• Managing your account and providing customer support.
• Sending transactional communications such as order confirmations, shipping notifications, and delivery updates.
• Maintaining platform security, detecting and preventing fraud, and enforcing our terms of service.

Service Improvement

• Analyzing aggregated usage patterns to improve platform performance and user experience.
• Conducting internal sales attribution and performance measurement to optimize storefront operations. This attribution tracking is entirely internal to Centerpiece Lab and does not involve sharing your personal data with Store Operators or any third parties.
• Developing new features and services based on aggregated user feedback and usage trends.

Communications

• Responding to your inquiries and support requests.
• Sending service-related notices, including security alerts and policy updates.
• With your consent, sending promotional communications about products or services that may interest you. You may opt out of promotional communications at any time.

Legal Compliance

• Complying with applicable laws, regulations, and legal processes.
• Establishing, exercising, or defending legal claims.
• Maintaining records as required by tax, accounting, and regulatory obligations.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on the following legal bases under the General Data Protection Regulation (GDPR) for processing your personal data:

Contract Performance (Art. 6(1)(b))

Processing necessary to fulfill our contractual obligations to you, including:

• Processing your orders and payments.
• Delivering products you have purchased.
• Providing customer support related to your transactions.
• Managing your user account.

Consent (Art. 6(1)(a))

Where you have given clear, affirmative consent for specific processing activities, including:

• Sending promotional or marketing communications.
• Setting non-essential cookies (such as analytics or preference cookies).

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Legitimate Interests (Art. 6(1)(f))

Processing necessary for our legitimate business interests, provided these interests are not overridden by your fundamental rights, including:

• Improving platform functionality and user experience through aggregated analytics.
• Preventing fraud and ensuring platform security.
• Internal sales attribution and performance measurement.
• Enforcing our terms of service.

Legal Obligation (Art. 6(1)(c))

Processing necessary to comply with legal obligations to which we are subject, including:

• Tax reporting and accounting requirements.
• Responding to valid legal processes, court orders, or regulatory inquiries.
• Maintaining records as required by applicable law.

Centerpiece Lab does not sell, rent, or trade your personal information to third parties. We share your data only in the following limited circumstances:

Fulfillment Partners

We share shipping-related information (name, delivery address, and order details) with third-party logistics providers solely for the purpose of delivering your orders. Fulfillment partners are contractually bound to use this information only for order delivery and are prohibited from using it for any other purpose.

Payment Processors

We transmit payment details to our payment service providers to process transactions securely. These providers are PCI DSS compliant and process payment data in accordance with applicable security standards. We do not store full credit card numbers on our servers.

Store Operators and Partners

Store Operators who operate storefronts on the Platform do not receive your personal data. Internal sales attribution and commission calculations are performed entirely within Centerpiece Lab's systems. Partners may receive aggregated, non-identifying performance metrics (such as total sales volume) but never individual customer records, contact information, or transaction details.

Legal Requirements

We may disclose your information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, or legal process.
• Respond to valid government requests, including law enforcement.
• Protect the rights, property, or safety of Centerpiece Lab, our users, or the public.
• Enforce our terms of service and investigate potential violations.

Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

With Your Consent

We may share your information with third parties when you have given explicit consent for a specific purpose.

Centerpiece Lab is based in the United States. If you access the Platform from outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

Safeguards for International Transfers

For transfers of personal data from the EEA, United Kingdom, or Switzerland to the United States, we rely on:

• Standard Contractual Clauses (SCCs): We use the European Commission's Standard Contractual Clauses to provide appropriate safeguards for data transfers.
• Adequacy Decisions: Where applicable, we transfer data to countries recognized by the European Commission as providing an adequate level of data protection.
• Supplementary Measures: We implement additional technical and organizational measures, including encryption in transit and at rest, to protect your data during and after transfer.

By using the Platform, you acknowledge that your information may be processed in the United States and other jurisdictions where our service providers operate.

We retain your personal information for the following periods:

| Data Category | Retention Period | Reason | |---------------|-----------------|--------| | Account information | Duration of your account plus 30 days after deletion request | Account functionality and recovery window | | Transaction records | 7 years from transaction date | Tax reporting, accounting, and legal compliance | | Payment metadata | 7 years from transaction date | Financial auditing and chargeback resolution | | Customer support interactions | 3 years from resolution | Service quality improvement and dispute resolution | | Device and usage data | 26 months from collection | Platform analytics and performance improvement | | Cookies and tracking data | See Cookie Policy for specific retention periods | Varies by cookie type and purpose |

After the applicable retention period expires, we securely delete or anonymize your data. In some cases, we may retain anonymized or aggregated data that can no longer identify you for statistical purposes.

You may request deletion of your personal data at any time (see "Your Rights" sections below). Upon receiving a valid deletion request, we will delete your data within 30 days, except where retention is required by law.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation and related legislation:

Right of Access (Art. 15)

You have the right to request a copy of the personal data we hold about you, along with information about how we process it.

Right to Rectification (Art. 16)

You have the right to request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure (Art. 17)

You have the right to request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when you object to processing and there are no overriding legitimate grounds.

Right to Data Portability (Art. 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance.

Right to Restrict Processing (Art. 18)

You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data or when processing is unlawful but you oppose erasure.

Right to Object (Art. 21)

You have the right to object to processing of your personal data based on our legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Right to Withdraw Consent (Art. 7(3))

Where we process your data based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority (DPA) if you believe our processing of your personal data violates the GDPR.

How to Exercise Your Rights

To exercise any of these rights, contact us at legal@centerpiecelab.com. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know (§1798.100)

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which the information was collected, the business or commercial purposes for collecting the information, and the categories of third parties with whom we shared the information.

Right to Delete (§1798.105)

You have the right to request deletion of personal information we have collected from you, subject to certain exceptions required by law.

Right to Opt-Out of Sale (§1798.120)

Centerpiece Lab does not sell your personal information. We do not sell, rent, or share your personal information with third parties for their direct marketing purposes. Because we do not sell personal information, there is no need to opt out of the sale of personal information.

Right to Non-Discrimination (§1798.125)

We will not discriminate against you for exercising your CCPA/CPRA rights. You will not receive different pricing, a different quality of service, or be denied service for making a privacy request.

Right to Correction (§1798.106)

You have the right to request correction of inaccurate personal information that we maintain about you.

Right to Limit Use of Sensitive Personal Information (§1798.121)

You have the right to limit the use and disclosure of your sensitive personal information to purposes that are necessary to provide the services you have requested.

Categories of Information Collected

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers: Name, email address, phone number, IP address, account credentials.
• Commercial Information: Purchase history, order details, products or services considered.
• Internet Activity: Browsing history on the Platform, search history, interaction with the Platform.
• Geolocation Data: Approximate location derived from IP address.
• Payment Information: Billing address, payment method details (processed by third-party payment providers).

How to Exercise Your Rights

To submit a verifiable consumer request, contact us at legal@centerpiecelab.com. You may also submit a request through your account settings. We will verify your identity before processing your request and respond within 45 days.

The Platform is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected personal information from a child under 16, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at legal@centerpiecelab.com and we will delete the information.

We take the security of your personal information seriously and implement appropriate technical and organizational measures designed to protect it against unauthorized access, alteration, disclosure, or destruction.

Security Measures

• Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher. Sensitive data is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis. We use role-based access controls and multi-factor authentication for administrative access.
• Infrastructure Security: The Platform is hosted on Cloudflare's global edge network, which provides built-in DDoS protection, Web Application Firewall (WAF), and network-level security.
• Payment Security: Payment transactions are processed by PCI DSS Level 1 certified payment processors. We do not store full credit card numbers on our systems.
• Regular Assessments: We conduct periodic security assessments and vulnerability scans to identify and address potential risks.

Incident Response

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected individuals and relevant supervisory authorities within 72 hours in accordance with GDPR requirements. We will also comply with all applicable state breach notification laws.

While we strive to protect your personal information, no method of transmission or storage is completely secure. We cannot guarantee absolute security but are committed to maintaining the highest practicable level of protection.

We use cookies, web beacons, pixels, and similar technologies to operate the Platform and enhance your experience. These technologies are used for:

• Essential Functions: Session management, authentication, shopping cart persistence, and security (CSRF protection).
• Preferences: Remembering your language, theme, and layout settings.
• Performance Measurement: Aggregated analytics to measure platform usage and performance. This includes internal sales attribution — an internal measurement process that does not involve sharing your personal data with third parties.

We do not use cookies for behavioral advertising, cross-site tracking, or selling your data.

For comprehensive information about the cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

We may update this Privacy Policy periodically to reflect changes in our practices, technologies, legal requirements, or other factors.

How We Notify You

• Material Changes: For significant changes that affect how we process your data, we will notify you by email (if you have an account) or by displaying a prominent notice on the Platform at least 30 days before the changes take effect.
• Minor Changes: For non-substantive changes (such as formatting or clarifications that do not alter the meaning), we will update the "Last Revised" date at the top of this policy.

Your Continued Use

Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should discontinue use of the Platform and request deletion of your account.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Centerpiece Lab, Inc. 131 Continental Dr, Suite 305 Newark, DE 19713, US

Email: legal@centerpiecelab.com

For data protection inquiries from the EEA, UK, or Switzerland, please include "GDPR Request" in your email subject line. For California privacy requests, please include "CCPA Request" in your email subject line.

We aim to respond to all legitimate requests within 30 days. If your request is particularly complex or you have made multiple requests, we may need up to 60 days and will notify you of any extension.