Privacy Policy

1. Introduction

Misfit Cookies ("Misfit," "we," "us," or "our") respects your privacy and is committed to handling personal information responsibly.

This Privacy Policy explains what information we collect, how we use it, when we disclose it, how long we retain it, and the choices available to you.

This Policy applies when you:

• Visit or browse our website.
• Place an online order.
• Arrange an order directly with us.
• Submit a contact form or custom-order inquiry.
• Subscribe to our email newsletter.
• Otherwise communicate or interact with our business.

Misfit Cookies is a Connecticut cottage food business owned and operated by Kevin Galarza, a sole proprietor.

Website: https://www.misfitcookies.com

We operate a guest-based ordering experience. You do not need to create a customer account to browse our website or purchase cookies.

This Policy provides notice of our information practices. It does not replace any separate consent that may be required by applicable law.

If you have questions about this Policy or your personal information, you can contact us using the information at the end of this document.

2. Information We Collect

The information we collect depends on how you interact with our website and business.

A. Information You Provide When Ordering

When you place an online order, we collect information such as:

• First and last name.
• Email address.
• Telephone number.
• Selected products, quantities, and pack configurations.
• Pickup date and time window.
• Order totals, applicable taxes, and payment status.
• Order history and fulfillment information.
• Order changes, cancellations, and refunds, where applicable.
• Required pickup acknowledgment and applicable policy acceptance records.
• Your optional marketing-email preference.

We use this information to process and fulfill purchases, communicate about orders, provide customer support, maintain business records, and resolve transaction issues.

Some information may be recorded when a checkout or payment attempt begins, even if the purchase is not ultimately completed.

B. Payment Information

Payments are handled through third-party payment-processing services.

When you pay by card, the payment provider may collect information such as payment card details, billing information, transaction amounts, and information necessary to verify or authorize payment.

Our business receives information needed to administer transactions, such as payment status, transaction references, amounts, refunds, and relevant billing or customer details.

Our own ordering system does not store full payment card numbers or card security codes.

Payment providers may also process information for fraud prevention, security, legal compliance, and other purposes described in their own privacy notices.

C. Information from Direct and Manual Orders

If you arrange an order by telephone, text message, or another direct communication method, we may record information necessary to manage that order.

This may include your name, telephone number, email address if provided, requested products, quantities, payment arrangements, and pickup or delivery details.

Some information may be entered into our business records by staff based on your communications.

D. Contact and Custom-Order Inquiries

When you use our contact form, we collect the name, email address, inquiry topic, and message you submit.

For custom-order requests, we may also collect:

• Telephone number.
• Approximate quantity.
• Requested products or arrangements.
• Event date, if applicable.
• Organization name, if provided.
• Other details you choose to include.

We use this information to review requests, respond to questions, provide estimates, and coordinate potential orders.

Submitting a form does not automatically create a customer account or subscribe you to marketing communications.

E. Newsletter Information

If you choose to subscribe to our email newsletter, we collect your email address and information necessary to manage your subscription.

This may include the date and source of your subscription, your preferences, and records of subscription or unsubscribe actions.

We use this information to send requested marketing communications and honor your email preferences.

F. Website and Device Information

When you visit our website, we and our service providers may automatically collect certain technical information.

This may include:

• IP address and network information.
• Browser and device type.
• Operating system.
• Pages visited and approximate access times.
• Referring websites or traffic sources.
• General usage and interaction information.
• Technical errors and diagnostic information.
• Information needed to maintain website security and prevent misuse.

Some of this information is collected as part of the normal operation of the website. Additional information may be collected through analytics technologies as described below.

G. Customer Service and Operational Information

We may maintain records related to customer inquiries, order support, cancellations, missed pickups, refunds, payment disputes, and other customer interactions.

We may also collect or generate limited operational information to detect fraudulent activity, prevent misuse, protect our services, and maintain reliable business operations.

Such information may include transaction history, technical identifiers, and records of relevant activity.

We do not use this information to create advertising profiles of customers.

3. How We Use Your Information

We collect and use information for the following purposes.

Processing orders: To accept payments, record purchases, prepare products, manage inventory, and fulfill customer orders.

Coordinating pickup and fulfillment: To identify orders, communicate about pickup arrangements, and address fulfillment problems.

Customer service: To answer questions, respond to messages, handle custom requests, and resolve complaints or other concerns.

Payments and financial records: To process transactions, issue refunds, handle disputes, maintain accounting records, and fulfill tax or other legal obligations.

Operating our website: To deliver website content, maintain shopping-cart functionality, troubleshoot problems, and improve reliability.

Website analytics and improvements: To understand how customers use our website, evaluate products and the ordering experience, and identify opportunities for improvement.

Security and fraud prevention: To protect our website, detect suspicious activity, prevent abuse, and maintain the integrity of transactions.

Marketing: To send newsletters and promotional updates to individuals who have voluntarily subscribed.

Legal compliance: To meet applicable legal, regulatory, reporting, recordkeeping, and other lawful obligations.

We use information for the purposes described in this Policy and other purposes permitted by applicable law.

Where separate consent is legally required, we will obtain it before carrying out the relevant activity.

4. Shopping Cart, Cookies, and Browser Storage

Our website uses browser storage and certain cookies or similar technologies to support its functionality.

Shopping Cart

Your browser may store selected products, quantities, and pack information so that your shopping cart remains available as you navigate or return to our website.

Shopping-cart storage is not a customer account and does not contain your full payment card information.

You can change or clear the cart using our website or your browser settings.

Clearing the cart does not delete an order or inquiry that has already been submitted.

Essential Website Services

Certain browser technologies may be used to support payment processing, website security, fraud prevention, and other necessary functionality.

These technologies help us deliver the services you request and maintain the reliability and security of our website.

Analytics Storage

When website analytics are enabled, cookies or similar browser storage may be used to recognize visits and understand how the website is used over time.

Your analytics preference may also be saved in your browser so the website can remember your choice.

You can manage optional browser analytics using the control on this Privacy Policy page.

Blocking or clearing browser storage may affect saved cart contents, analytics preferences, or certain website functions.

5. Website Analytics

We use website analytics to understand how visitors interact with Misfit Cookies and how we can improve our website and services.

Analytics help us evaluate matters such as:

• Which pages and products visitors explore.
• How customers navigate the ordering process.
• General website traffic and engagement.
• The effectiveness of website improvements.
• Shopping-cart and checkout activity.
• Overall purchase and conversion trends.
• Technical problems affecting the website experience.

Analytics information may include device and browser characteristics, general browsing activity, referring sources, pseudonymous identifiers, and limited transaction-related measurements.

Analytics may be active when you visit our website unless you have disabled optional browser analytics through the available preference control.

We take steps to limit the collection of unnecessary personal information through our analytics tools.

We do not intentionally include full payment card details, private order-access information, or the contents of customer inquiry messages in ordinary website analytics events.

Analytics information may not be completely anonymous. Some information may be associated with a browser, transaction, or other identifier.

Your Analytics Preference

You can turn optional browser analytics on or off using the Analytics cookies control on this page.

Your preference is saved in your browser when browser storage is available.

Turning analytics off prevents subsequent optional browser analytics collection through that browser, as supported by our website's analytics controls.

This choice does not delete previously collected information or prevent necessary payment processing, security activities, operational records, or limited business reporting associated with transactions.

If you clear your browser storage, use a different browser or device, or prevent preference storage, you may need to select your preference again.

You can also contact us with questions about analytics information or applicable privacy rights.

6. Marketing Emails

We may offer an optional email newsletter with product announcements, seasonal releases, bakery news, and other updates.

You can subscribe through our newsletter form or by selecting the optional marketing checkbox during checkout.

You are not required to subscribe to marketing emails to place an order.

We do not automatically enroll customers in marketing communications simply because they:

• Purchase a product.
• Submit a contact form.
• Request a custom order.
• Contact us about an existing purchase.

If you subscribe, you can unsubscribe at any time using the instructions provided in our marketing emails or by contacting us directly.

We maintain information necessary to manage subscriptions and honor unsubscribe requests.

Unsubscribing from marketing does not prevent necessary communications about an order, payment, refund, or customer-service request.

We do not currently operate a promotional SMS subscription program.

7. Order-Related Communications

We may use your contact information to communicate with you about purchases and customer-service matters.

These communications may include:

• Questions about an order.
• Pickup coordination.
• Product availability or fulfillment issues.
• Order modifications.
• Cancellations and refunds.
• Responses to questions or complaints.

Communications may occur by telephone, individual text message, or email.

Our website provides on-screen order confirmations and downloadable receipts.

We do not guarantee automated confirmation emails, pickup reminders, or other automated notifications.

Order-related communications are separate from optional marketing communications.

8. When We Share Information

We do not sell personal information or use it for targeted advertising.

We do, however, disclose certain information to trusted service providers and other parties when necessary to operate our business, fulfill requests, protect our services, or comply with the law.

The categories of recipients include the following.

Payment Processors

We share information necessary to process payments, authenticate transactions, prevent payment fraud, handle refunds, and resolve disputes.

This may include contact or billing information, transaction amounts, and order-related references.

Website Hosting and Technology Providers

We use technology providers to host and operate our website, store business records, support application functions, and maintain reliable services.

These providers may process customer information, order data, technical records, and other information necessary to provide their services.

Email and Communication Providers

We may use service providers to deliver newsletters, support business notifications, and facilitate customer communications.

These providers may process contact information, subscription preferences, message content, and delivery-related information.

Analytics Providers

We may share website usage information, pseudonymous identifiers, and limited business or transaction information with analytics providers to understand website activity and improve our services.

Security and Fraud-Prevention Providers

We use services that help protect public forms, payment activity, and website operations against fraud, automated abuse, and other security threats.

These services may process relevant browser, network, and verification information.

Professional Advisers

We may share limited information with accountants, legal advisers, and other professional service providers when reasonably necessary for business administration or legal compliance.

Legal Requirements

We may disclose information when required by applicable law, valid legal process, or authorized governmental requests, or when otherwise permitted by law to protect legal rights, safety, and security.

Business Changes

If Misfit Cookies is sold, reorganized, or transferred in the future, relevant business records may be transferred as part of a lawful business transaction, subject to applicable legal and privacy obligations.

We do not provide customer lists to third parties for their independent marketing purposes.

We limit disclosures to information reasonably relevant to the purpose for which it is shared, subject to applicable law and the independent responsibilities of certain service providers.

9. External Websites and Social Media

Our website may link to external services such as social media platforms, mapping tools, or payment-related websites.

If you follow one of these links, you may leave our website and interact with a service that has its own privacy practices.

We do not control the privacy practices of independent third-party websites.

We encourage you to review the privacy policies of external services you choose to use.

10. Information About Allergies and Health

We provide ingredient and allergen disclosures to help customers make informed purchasing decisions.

We do not ask customers to submit medical histories, diagnoses, or other unnecessary health information.

However, customers may voluntarily include allergy information, dietary concerns, or other health-related details in contact forms, custom-order requests, or direct communications.

When provided, we use this information only as reasonably necessary to understand and respond to the relevant request and for any other purpose required or permitted by applicable law.

We do not maintain separate customer medical records or build customer health profiles.

Please avoid submitting unnecessary medical or other sensitive personal information through our website.

For general product information, visit our Ingredients & Allergens page.

11. Information Retention

We retain personal information for as long as reasonably necessary to operate our business, fulfill orders, provide customer support, maintain accurate financial records, resolve disputes, prevent fraud, and comply with applicable legal obligations.

Retention periods may vary based on the type of information and the purpose for which it was collected.

For example:

Order and payment records may be retained for fulfillment, accounting, tax reporting, refunds, and dispute resolution.

Contact and custom-order inquiries may be retained while requests are being handled and for a reasonable period afterward to address related matters.

Marketing subscription records may be retained to manage subscriptions and honor unsubscribe preferences.

Website analytics and operational records may be retained as reasonably necessary for business measurement, reliability, and security.

Customer communications may be retained as needed for customer service and legitimate business records.

Certain information may be retained longer when required by law or reasonably necessary for legitimate legal or business purposes.

The expiration of a private order link, payment link, or browser session does not necessarily delete the underlying business records.

Information may also remain temporarily in service-provider backups or other retained records, subject to applicable operational and legal requirements.

Customers may request deletion of eligible personal information as described below.

12. How We Protect Information

We take reasonable administrative and technical measures intended to protect personal information from unauthorized access, misuse, alteration, or disclosure.

These measures include appropriate access restrictions, secure payment-processing services, and safeguards intended to protect website operations and customer records.

Access to customer information is limited according to business needs.

However, no website, network transmission, or electronic storage system can be guaranteed completely secure.

We encourage customers to avoid sending sensitive payment information through ordinary messages or public contact forms.

If you believe your information has been exposed or misused, please contact us so we can review the concern.

We will assess and respond to security incidents, including providing notifications when required by applicable law.

13. Your Privacy Rights

Depending on applicable law and your circumstances, you may have rights concerning personal information we maintain about you.

These may include the right to:

• Request confirmation of whether we process your personal information.
• Request access to certain personal information.
• Request correction of inaccurate information.
• Request deletion of eligible personal information.
• Request a copy of certain information in an available or legally required format.
• Withdraw consent for certain optional uses.
• Opt out of certain processing activities where applicable law provides that right.
• Appeal a privacy-request decision when applicable law provides an appeal right.

These rights may be subject to legal exceptions.

For example, we may need to retain certain information to complete an existing transaction, comply with tax or accounting obligations, resolve disputes, prevent fraud, or protect our legal rights.

How to Make a Privacy Request

You can contact us through our website contact form or business phone.

Contact form: https://www.misfitcookies.com/contact
Phone: (203) 600-6587

Please indicate that you are making a privacy-related request and briefly explain what you would like us to review.

We may ask for reasonable information to verify your identity or confirm that you are authorized to make a request involving the relevant records.

We generally use information already associated with your order or correspondence when appropriate.

You do not need to create a customer account to submit a request.

We review these requests manually and will respond in accordance with applicable legal requirements.

If a legally applicable request is denied, you may ask us to reconsider or appeal the decision through the same contact methods, where an appeal right applies.

We will provide any additional explanation or information required by law.

14. Automated Checks and Fraud Prevention

We may use automated checks to help maintain reliable ordering, identify suspicious activity, prevent duplicate or abusive transactions, and protect our customers and business.

These checks may consider operational information, transaction activity, and relevant technical or contact-related indicators.

Certain transactions may be declined or referred for additional review when necessary for legitimate business or security reasons.

We do not use customer information to make automated decisions about eligibility for employment, credit, insurance, housing, or similar services.

If you believe an order has been incorrectly restricted or declined, you can contact us for assistance.

We will honor any additional rights concerning automated processing that apply under relevant law.

15. Children and Minors

Our website is intended for a general consumer audience and is not specifically directed toward children under 13.

We do not intentionally solicit personal information directly from children under 13.

Parents or legal guardians should handle purchases, inquiries, and other information submissions on behalf of children under 13.

We do not require visitors to create accounts or provide birthdates to browse or place an ordinary order.

If we become aware that we have collected personal information from a child in circumstances requiring additional protections, we will take appropriate action in accordance with applicable law.

Parents or legal guardians may contact us with questions or requests concerning a child's information.

16. Where Information Is Processed

Misfit Cookies operates in Connecticut and primarily serves customers purchasing products for direct fulfillment within Connecticut.

Our business uses service providers that may process or store information in other states or countries as part of providing their services.

Information may therefore be processed outside Connecticut, subject to applicable legal requirements.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our business, website, services, information practices, or applicable laws.

When changes are made, we will publish an updated version with a revised effective date.

Where required by law, we will provide additional notice or obtain appropriate consent before introducing certain new uses of personal information.

Changes to this Policy do not automatically authorize uses that legally require separate consent.

We encourage you to review this Policy periodically.

18. Contact Us

If you have questions about this Privacy Policy, your personal information, or a privacy-related request, please contact:

Misfit Cookies
Owned and operated by Kevin Galarza, sole proprietor
177 Carter Avenue Ext
Meriden, CT 06451
United States

Phone: (203) 600-6587
Website: https://www.misfitcookies.com
Contact: https://www.misfitcookies.com/contact