Privacy policy.

This policy describes how Mahalo Brands (“we,” “us,” “our”) collects, uses, and shares information about you when you visit mahalobrands.com, place an order, or interact with our services.

What we collect

We collect only the information we need to run the business, and never sell it.

• Order information — name, email, shipping and billing address, phone number (optional), and the items you purchase. Payment card details are handled by Shopify and never touch our servers.
• Account information — if you sign in to the customer portal, we use Shopify's Customer Account API to look up your orders and subscriptions on your behalf.
• Wholesale applications — business name, contact name, email, phone, license number, and shipping address when you apply for a wholesale account.
• Reviews and damage claims — the name, email, rating, and text you submit, plus any photos you attach (damaged-box photos are stored privately).
• Usage analytics — a first-party session cookie, the pages you visit, referring site, UTM parameters, device type, browser, and approximate country/region. We do not store your IP address.
• Email interactions — delivery and bounce status for transactional email we send via Resend. We do not track email opens by default.

How we use it

• To fulfill and ship your order, process refunds, and support you after a purchase.
• To show approved reviews on product pages.
• To send transactional email (order updates, review requests, wholesale status).
• To understand which products, pages, and referrers drive sales so we can improve the site.
• To comply with legal obligations (tax, accounting, fraud prevention).

Cookies

We use a small set of first-party cookies: a session ID for analytics, an authentication cookie when you sign in to your account, and a short-lived cookie to remember your cart. We do not use third-party advertising cookies, and we do not participate in cross-site tracking networks.

Service providers

We share the minimum data necessary with service providers who help us run the site — for example, a payments and fulfillment platform, a database provider, a hosting provider, a transactional email service, a spam-prevention service, and a mapping service. Each is contractually required to protect your data and use it only on our behalf. We do not sell your personal information and we do not share it for cross-context behavioral advertising. If you'd like a list of the specific providers we currently use, contact us at the address below.

Data retention

Order records are kept for seven years to meet tax and accounting requirements. Analytics events are retained for up to 18 months. Review content stays live as long as the product is sold unless you ask us to remove it. We delete accounts and associated personal data within 30 days of a verified request.

Your rights

Depending on where you live, you may have the right to access, correct, or delete your personal information, or to opt out of its sale (we don't sell it). To exercise any of these rights, use our contact form from the address on your account, or reach us by email (Show email address), and we'll respond within 30 days.

Children

The site is not directed at children under 16, and we do not knowingly collect their data.

Changes

If we update this policy, we'll change the “last updated” date at the top. Material changes are announced by email to account holders.

Contact

Questions? Use our contact form or email us (Show email address).