PRIVACY POLICY

Effective date: August 3, 2026

Twenty One Doors, LLC ("Twenty One Doors," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit twentyonedoors.com, make a purchase, create or use an account, subscribe to communications, contact us, submit a review or survey, or otherwise interact with our website, products, and services (collectively, the "Services").

By using the Services, you acknowledge that you have read this Privacy Policy. This Privacy Policy does not create contractual rights beyond those required by applicable law.

1. Personal Information We Collect

The personal information we collect depends on how you interact with us and which features you use.

Information you provide directly

We may collect:

• Contact information, such as your name, email address, telephone number, billing address, and shipping address.
• Account information, such as login credentials, saved addresses, communication preferences, and account settings.
• Order and transaction information, such as products purchased, order history, payment status, refunds, discounts, promotional codes, subscription information, and fulfillment details.
• Communications, such as customer-service requests, accessibility requests, product questions, survey responses, contest or promotion entries, reviews, testimonials, and other messages you send us.
• Marketing preferences, including email or text-message subscription choices and records of consent or withdrawal.
• Information you voluntarily provide when asking about product suitability or using an optional product-recommendation feature.

Payment card information is processed by third-party payment providers. We do not store complete payment card numbers or card security codes on our own systems.

Information collected automatically

When you use the Services, we and the providers that support our website may automatically collect:

• Device and network information, such as IP address, browser type, operating system, device type, device identifiers, and general or approximate location derived from an IP address.
• Usage information, such as pages viewed, links clicked, products viewed or added to a cart, referring URLs, search activity on the site, checkout activity, dates and times of visits, and interactions with emails or advertisements.
• Cookie and similar technology information collected through cookies, pixels, tags, software development kits, local storage, and similar technologies.
• Inferences about likely preferences or interests drawn from purchase history or interactions with the Services. We do not intend to use this information to diagnose a health condition or create a medical profile.

Information from other sources

We may receive personal information from:

• Shopify and other providers that host or support our online store.
• Payment processors, shipping carriers, fulfillment providers, fraud-prevention providers, and customer-support platforms.
• Email, text-message, analytics, and advertising providers.
• Social media platforms when you interact with our pages, advertisements, shops, or content, subject to your settings and the platform's policies.
• Referral, affiliate, promotional, or business partners when you use a referral link, discount code, or jointly offered promotion.

2. How We Use Personal Information

We may use personal information to:

• Provide, operate, maintain, and improve the Services.
• Create and manage accounts.
• Process orders, payments, subscriptions, returns, refunds, and exchanges.
• Ship products and provide delivery and account updates.
• Respond to customer-service, accessibility, and product questions.
• Provide product information or recommendations requested by you.
• Send marketing communications when permitted by law and manage communication preferences.
• Personalize content, offers, and advertising, subject to applicable consent and opt-out requirements.
• Measure site performance, understand use of the Services, and evaluate marketing campaigns.
• Detect, investigate, prevent, and respond to fraud, security incidents, misuse, unlawful conduct, or violations of our terms.
• Maintain records, enforce agreements, protect legal rights, and resolve disputes.
• Comply with tax, accounting, legal, regulatory, and law-enforcement obligations.
• Carry out another purpose disclosed to you at the time information is collected or with your consent.

We will not use personal information for a materially different purpose without providing any notice or obtaining any consent required by law.

3. Cookies, Analytics, and Advertising

We and the providers that support our Services may use cookies and similar technologies to:

• Keep the site and checkout functioning.
• Maintain security and prevent fraud.
• Remember preferences and items placed in a cart.
• Understand how visitors use the Services.
• Measure site performance and communications.
• Personalize content and, where permitted, deliver or measure advertising.

Some cookies are necessary for the Services to operate. Other cookies, including certain analytics and advertising cookies, may be optional depending on applicable law. Where required, we ask for consent before placing or using nonessential cookies.

You may manage available choices through the cookie or privacy preference tool on our site and through your browser settings. Blocking some cookies may affect site functionality. Your choices may be specific to the browser and device you use, so you may need to make the same selection on each browser or device.

Third parties may collect information about your activity on our Services and, depending on the technologies enabled, across other websites or services over time. Their processing is governed by their own privacy notices and any contractual restrictions we place on their use of information.

4. Online Tracking Signals and Global Privacy Control

Some browsers offer a traditional "Do Not Track" setting. Because there is no uniform industry standard for interpreting traditional Do Not Track signals, the Services do not respond to those signals unless applicable law requires otherwise.

Where required by applicable law, we process Global Privacy Control and other legally recognized universal opt-out preference signals as requests to opt out of sale, sharing, or targeted advertising for the browser or device sending the signal. If we can reasonably associate the signal with your account, we will also apply the request to the account as required by law. You may need to enable the signal or submit a separate request on each browser or device.

5. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients for the purposes described in this Privacy Policy:

• Ecommerce and technology providers, including Shopify and providers that host, maintain, secure, or support the Services.
• Payment and transaction providers, including payment processors, fraud-prevention providers, financial institutions, and providers that support refunds and chargebacks.
• Shipping and fulfillment providers, including warehouses, logistics providers, and carriers.
• Customer-service and communications providers, including providers used to respond to requests and send transactional, email, or text communications.
• Analytics and advertising providers, when enabled and permitted by law, to measure performance, understand use, personalize content, or deliver and measure advertising.
• Affiliates, referral sources, and promotional partners, when necessary to administer a referral, discount, affiliate relationship, contest, or joint promotion.
• Professional advisors and insurers, including lawyers, accountants, auditors, consultants, and insurers.
• Government authorities and other parties, when we reasonably believe disclosure is required by law, legal process, or a valid governmental request, or is necessary to protect rights, safety, property, or security.
• Business transaction parties, including an actual or potential buyer, investor, lender, successor, or advisor in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale, or transfer of all or part of our business or assets.
• Other parties at your direction or with your consent.

We do not sell personal information in exchange for money. Certain disclosures to advertising or analytics providers may be considered a "sale," "sharing," or "targeted advertising" under some state privacy laws even when no money is exchanged. Where those laws apply, you may opt out as described below.

6. Email, Text Messages, and Mobile Information

You may unsubscribe from marketing emails by selecting the unsubscribe link in an email. If we offer text-message marketing, you may opt out by following the instructions in the message, including by replying STOP when that option is available. Transactional or service-related messages, such as order, delivery, account, safety, or legal notices, may still be sent where permitted by law.

We may disclose mobile telephone numbers, text-message opt-in information, and consent records to providers that help us deliver and administer our text-message program. We do not sell this information or disclose it to third parties for their own marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. This restriction does not prevent disclosure to providers that support delivery of the messages, to authorities when legally required, or in connection with a business transaction as described in this Privacy Policy.

7. Health-Related Information

Twenty One Doors is a consumer-products company, not a health care provider. Our Services are not intended to provide medical advice, diagnosis, or treatment.

You may voluntarily mention health-related concerns when contacting customer service, submitting a review, responding to an optional survey, or using an optional product-recommendation feature. Depending on the information provided and applicable law, this information may be considered sensitive personal information or consumer health data.

We use voluntarily provided health-related information only to respond to your request, provide a feature you chose to use, maintain appropriate customer-service records, comply with law, or protect safety and legal rights. We do not use it to diagnose a condition. We do not use it to create health-based advertising audiences, and we do not sell it or share it for cross-context behavioral advertising. We disclose it only to providers necessary to fulfill your request or operate the relevant feature, when required by law, in connection with a business transaction subject to appropriate protections, or with your consent.

Please do not send medical records, genetic information, insurance information, or other detailed health information through the Services. Product questions involving pregnancy, medications, allergies, symptoms, diagnoses, or treatment should be directed to a qualified health care professional.

If applicable law gives you additional rights concerning consumer health data, you may exercise them by using the methods in Section 11. If we introduce a feature that collects consumer health data in a manner requiring a separate notice or consent, we will provide the required notice and obtain consent before collecting or sharing that information.

8. State Privacy Disclosures

The following disclosures apply to the extent a U.S. state privacy law covers our processing. The categories below describe personal information we may have collected, used, or disclosed during the preceding 12 months, depending on your interactions with us.

Category	Examples	Sources	Business or commercial purposes	Categories of recipients
Identifiers	Name, email address, telephone number, postal address, account identifier, IP address, device identifier	You, your device, ecommerce and business partners	Orders, accounts, communications, security, marketing, legal compliance	Ecommerce, payment, fulfillment, communications, analytics and advertising providers; advisors; authorities
Customer-record and contact information	Billing and shipping information, account and customer-service records	You and service providers	Orders, support, account administration, recordkeeping	Ecommerce, payment, fulfillment, customer-service providers; advisors; authorities
Commercial information	Products viewed or purchased, order history, subscriptions, discounts, returns	You, your device, ecommerce and payment providers	Transactions, customer service, analytics, personalization, marketing, recordkeeping	Ecommerce, payment, fulfillment, analytics and advertising providers; advisors
Internet or electronic activity	Browsing, clicks, referring pages, cart and checkout interactions, email engagement	Your browser or device; analytics, ecommerce, communications and advertising providers	Site operation, security, analytics, personalization, advertising	Technology, analytics, communications and advertising providers
Approximate geolocation	General location derived from IP address	Your device and technology providers	Security, localization, analytics, advertising	Technology, security, analytics and advertising providers
Audio, electronic, or visual information	Photos, videos, reviews, testimonials, or recorded communications that you choose to submit	You	Customer service, reviews, promotions, legal and security purposes	Technology and customer-service providers; the public if you authorize publication; advisors; authorities
Inferences	Likely product or shopping preferences derived from activity or purchase history	Information described above	Personalization, analytics, marketing, advertising	Ecommerce, analytics and advertising providers
Sensitive personal information or consumer health data	Account credentials; payment information handled by payment providers; health-related information you voluntarily submit	You and payment providers	Account access, transactions, responding to requests, security, legal compliance	Payment, technology and customer-service providers; authorities when required

We do not use or disclose sensitive personal information to infer characteristics about a person except as permitted by applicable law. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Depending on the advertising and analytics technologies enabled on the Services, identifiers, commercial information, internet activity, approximate geolocation, and inferences may be disclosed to analytics or advertising providers in a manner that is considered sale, sharing, or targeted advertising under applicable law. We do not knowingly sell or share sensitive personal information or consumer health data for these purposes.

9. Your Privacy Rights

Depending on where you live and subject to legal exceptions, you may have the right to:

• Confirm whether we process your personal information.
• Know and access the personal information we collect, use, disclose, sell, or share about you.
• Request correction of inaccurate personal information.
• Request deletion of personal information.
• Obtain a portable copy of certain personal information.
• Opt out of sale, sharing, or processing for targeted advertising.
• Opt out of certain profiling or automated decision-making activities that produce legal or similarly significant effects, if we engage in such activities.
• Limit certain uses or disclosures of sensitive personal information.
• Withdraw consent when processing is based on consent.
• Appeal a denial of a privacy request when applicable law provides that right.
• Receive equal service and pricing and not be discriminated against for exercising a privacy right.

These rights are not absolute. We may deny or limit a request when permitted by law, including when we cannot verify your identity, must retain information to complete a transaction or comply with law, or an exception applies.

10. Your Privacy Choices

You may opt out of sale, sharing, or targeted advertising, where applicable, by:

• Using the Your Privacy Choices link in the website footer.
• Using the cookie or privacy preference tool available on the site.
• Sending an email to support@twentyonedoors.com with the subject line "Privacy Opt-Out."
• Enabling Global Privacy Control or another legally recognized opt-out preference signal in a supported browser or extension.

An opt-out does not prevent disclosures to providers that process information for necessary business purposes under legally compliant contractual restrictions. It also does not prevent advertising that is not based on activity across nonaffiliated websites or services.

We will not ask you to opt back in to a sale or sharing of personal information for at least 12 months after an opt-out when applicable law requires that waiting period.

11. How to Submit a Privacy Request

You may submit a request by:

• Emailing support@twentyonedoors.com with the subject line "Privacy Request."
• Writing to Twenty One Doors, LLC, Attn: Privacy Request, 5250 Lankershim Boulevard, Suite 500, North Hollywood, CA 91601, United States.

Please describe the right you wish to exercise and provide enough information for us to identify the relevant records. Do not send a password, complete payment card number, government identification number, or medical records by email.

We may verify your request by matching information you provide with information we maintain and, when appropriate, asking you to confirm control of an email address or account. We will use verification information only to process the request. If we cannot verify a request to the degree required by law, we will explain why we cannot fulfill it.

You may use an authorized agent where permitted by law. We may require proof that you authorized the agent to act for you and may ask you to verify your identity directly, unless the agent has a legally sufficient power of attorney.

We will acknowledge and respond within the periods required by applicable law. Many state laws require a substantive response within 45 days, subject to a permitted extension with notice. We do not charge a fee unless a request is excessive, repetitive, manifestly unfounded, or applicable law otherwise permits a fee.

If we deny your request and your state gives you a right to appeal, email support@twentyonedoors.com with the subject line "Privacy Appeal" within 60 days after receiving our decision. Explain why you believe the decision should be reconsidered. We will respond within the period required by applicable law and, where required, provide information about how to contact the appropriate regulator or attorney general.

12. Retention

We retain each category of personal information only for as long as reasonably necessary and proportionate for the purpose for which it was collected, subject to legal, accounting, tax, security, fraud-prevention, chargeback, warranty, dispute-resolution, and recordkeeping requirements. We use the following criteria:

• Order and transaction records: for the period needed to complete the transaction and meet tax, accounting, payment, warranty, fraud-prevention, and legal obligations.
• Account information: while the account remains active and afterward for the period needed to address security, disputes, legal obligations, and legitimate recordkeeping needs.
• Customer-service communications, reviews, and survey responses: for the period needed to resolve the request, maintain an appropriate business record, administer the submission, and address legal or safety issues.
• Marketing information and consent records: until you unsubscribe or withdraw consent, and afterward as needed to maintain a suppression record, demonstrate compliance, and prevent unwanted communications.
• Cookie, device, analytics, and advertising information: according to the lifespan of the relevant cookie and the retention settings of the technology used, subject to your choices and applicable law.
• Security and fraud-prevention information: for the period reasonably necessary to detect, investigate, prevent, and document security incidents, fraud, misuse, or unlawful activity.
• Voluntarily submitted health-related information: only for the period needed to respond to the request, provide the feature selected by you, meet legal or safety obligations, and maintain an appropriate customer-service record.

When information is no longer needed, we take reasonable steps to delete, deidentify, or securely dispose of it. We may retain deidentified information to the extent permitted by law and will not attempt to reidentify it when the law prohibits reidentification.

13. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. No website, network, storage system, or transmission method is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your account credentials and should contact us if you believe your account or information has been compromised.

14. Children and Teens

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. We do not knowingly sell or share for cross-context behavioral advertising the personal information of anyone under 16. If you believe a child has provided personal information to us, contact us at support@twentyonedoors.com so we can investigate and take appropriate action.

15. Third-Party Websites and Services

The Services may contain links to websites, platforms, payment services, social media services, or applications operated by others. We do not control their privacy or security practices. This Privacy Policy does not apply to information collected independently by those third parties. Review their privacy notices before providing information.

16. International Visitors

Twenty One Doors is based in the United States. If you access the Services from outside the United States, your information may be transferred to, stored in, or processed in the United States and other countries where our providers operate. Privacy laws in those countries may differ from those where you live.

If the law of the European Economic Area, United Kingdom, or Switzerland applies to our processing, Twenty One Doors, LLC is the controller of the personal information described in this Privacy Policy unless we state otherwise. Depending on the processing, we rely on one or more of the following legal bases:

• Performance of a contract or steps requested before entering a contract, including processing and delivering an order.
• Compliance with a legal obligation, including tax, accounting, consumer-protection, and lawful-request obligations.
• Our legitimate interests, including operating and securing the Services, preventing fraud, improving products and customer service, maintaining business records, and conducting proportionate direct marketing, provided those interests are not overridden by your rights.
• Your consent, including where consent is required for marketing or nonessential cookies. You may withdraw consent at any time without affecting processing that occurred before withdrawal.

Where required, international transfers are supported by a legally recognized transfer mechanism or another lawful safeguard. You may contact us for information about safeguards applicable to your information.

In addition to the rights described above, you may have rights to object to or restrict processing and to lodge a complaint with the data-protection authority where you live or work, or where you believe a violation occurred.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, or legal obligations. We will post the revised policy on this page and update the effective date. If a change is material, we will provide additional notice in a manner appropriate to the change, such as a notice on the website or a message to the email address associated with an account, when required by law. We will obtain consent to a change when applicable law requires consent.

18. Contact Us

For questions, privacy requests, or complaints, contact:

Twenty One Doors, LLC
Attn: Privacy
5250 Lankershim Boulevard, Suite 500
North Hollywood, CA 91601
United States
support@twentyonedoors.com