Privacy Policy

This Privacy Policy describes how Unaffiliated Inc. collects, uses, discloses, and protects your personal information in connection with our websites that link to this Privacy Policy from their footer (“ Sites ”), our email newsletters, and our newsletter-related services (together with the Sites, the newsletters, and all associated features, applications, widgets, and their respective contents, the “ Services ”). Most of our Sites and newsletters are branded primarily or entirely with a specific newsletter’s branding.

In some cases, we operate a Site or newsletter with a third party whose own branding is featured on the Site or newsletter (“ Third-Party Brand ”). We may disclose personal information to the Third-Party Brand or allow them to collect it directly, but, to the extent permitted by law, they will use and disclose that information pursuant to their own policies and procedures, not this Privacy Policy. By signing up for a Third-Party Brand’s newsletter, you are opting into our disclosure of your information to that Third-Party Brand.

If you have any questions or concerns about this policy, email us at privacy@unaffiliated.co.

Grapejuice — grapejuice.co, the Grapejuice app and our Grapejuice emails — is one of our Sites and part of the Services. Grapejuice is made by Untraditional, an Unaffiliated brand. Section 12 describes additional practices that apply to Grapejuice.

TABLE OF CONTENTS

1. Information We Collect

2. Use of Information

3. Disclosure of Information

4. Your Rights and Choices

5. Shine the Light (California Only)

6. International Data Transfer

7. Data Retention

8. Protection of Information

9. Children Under 13

10. Updates and Changes to This Policy

11. Contacting Us

12. Additional Information for Grapejuice

1. Information We Collect

a. Information You Provide to Us:

You may provide the following types of information to us:

• Identifiers, such as name and contact details;

• Commercial information, such as:

◦ a record of the content on our Sites or in newsletters that you experience;

◦ details about your purchases and other business interactions with us, responses to surveys, and participation in our events;

• Information about your interests and preferences, including which newsletters you subscribe to through the Services;

• Audio or visual information, such as recordings of calls or online events;

• Rough geolocation (inferred from your IP address);

• Internet or other electronic network activity information, as described in the Cookies and Other Technology section below;

• Interactions you initiate or otherwise have with us, including chats with our customer service team and other interactions you initiate through the Services; and

• Inferences based on any of the above.

b. Cookies and Other Technology

Through our Sites, newsletters, and other aspects of our services, we and third parties may collect information from your computer or other device by automated means such as cookies, web beacons, local storage, JavaScript, mobile-device functionality and other computer code. This information may include unique browser identifiers, IP address, browser and operating system information, device identifiers (such as advertising identifiers), other device information, Internet connection information, as well as details about your interactions with the relevant website, email or other online property (for example, the URL of the third-party website from which you came, the pages on our website that you visit, and the links you click on in a website). In some cases (such as cookies), the tools described here involve storing unique identifiers or other information on your device for later use. Some data collected by these technologies can be used to infer your email address or to otherwise identify you.

c. Information From Third Parties

We may also receive personal information from third parties, including our vendors and service providers, affiliates, and partners such as analytics and advertising partners, data vendors, and publicly available sources, such as social media websites.

Some of our business partners, including our newsletter writers, may provide us with information about you, such as your name and contact information.

We may combine any information we collect about you from you or these various sources. If a combination of information that we collect identifies you as an individual, we will treat the combined information as personal information.

2. Use of Information

We and our vendors and service providers use the information described above for the following purposes:

A. Provide, manage, and improve the Services generally (including to deliver newsletters);

B. Process your registration and verify your information;

C. Customize content, preferences, and advertising on our Services, across the Internet and elsewhere;

D. Send you confirmations, updates, security alerts, and support and administrative messages;

E. Conduct sales and marketing;

F. Conduct business operations such as auditing, security, fraud prevention, invoicing and accounting, analytics, and research and development;

G. Protect against, identify, investigate, and respond to misuse of the Services or other unlawful behavior;

H. Address legal requirements;

I. Establish, exercise, or defend our legal rights; and

J. Create aggregated or de-identified information.

When applicable, the data protection laws of the European Economic Area UK, certain other jurisdictions require businesses like us to have a legal basis for processing personal information. If those laws apply:

• In some cases (B and some situations described by D, F, and G in the list above), our processing of personal information is necessary for us to comply with a contract with you (typically our Terms of Service) or to take steps in anticipation of entering into a contract with you.

• In other cases (some situations described under H in the list above), we process personal information because we are required to do so by laws in jurisdictions such as the United Kingdom and countries in the European Economic Area.

• In certain cases, we process personal information based on your consent, such as certain situations covered by A, C, E, and F in the list above, though those situations do not always require consent. When we process personal information on the basis of consent, it may be express consent or implied consent, depending on the situation and on which laws apply.

• In the remaining situations in A and C–J in the list above, we process personal information because we believe it is necessary for purposes of our legitimate interests (primarily growing and protecting our business) or the legitimate interests of others.

• And if we process personal information in some countries outside the UK and European Economic Area, we do so on additional or other grounds if required by law.

3. Disclosure of Information

We may disclose your information as follows:

• To vendors and service providers: We disclose information to companies that provide services to us, such as providers that host or operate our website or app, analyze data, or provide customer service, data storage, marketing, analytics, security, or fraud prevention. We may engage a third party to host or operate any aspect of the Services and any other aspect of our businesses, including any mechanism through which we send or receive communications, such as our email systems and our Sites.

• To advertising partners: We disclose information to companies that help us provide advertising (in our Services and across the Internet) that we believe will be more interesting to you.

• To newsletter writers: In some cases, we may disclose your contact details and additional information to Third-Party Brands and other newsletter writers that work with Unaffiliated (for example, to help them stay connected with their audiences outside of the Services).

• To affiliates: We may disclose information to current or future parents, subsidiaries, affiliates, and other companies under common control or ownership with Unaffiliated.

• In connection with legal matters: We may disclose information when we believe disclosure is appropriate due to a subpoena or similar investigative demand, a court order, or other request from a law enforcement or government agency; or as otherwise required by law.

• For the protection of Unaffiliated and others: We may disclose information when we believe disclosure is appropriate in connection with efforts to investigate, prevent, or take other action regarding illegal activity, suspected fraud or other wrongdoing; to protect and defend the rights, property or safety of our company, our employees, our customers, or others; and to enforce our contracts.

• In connection with corporate transactions: We may disclose your information as part of, or to take steps in anticipation of, a sale of all or a portion of our business, a divestiture, merger, consolidation, asset sale, bankruptcy, or other significant corporate event.

• In other situations: We may also disclose your information in other situations where legally permitted.

We may use and disclose appropriately aggregated or de-identified information for any purpose.

4. Your Rights and Choices

a. Marketing Communications

You can unsubscribe from a newsletter or from our own marketing emails you receive from us by clicking the unsubscribe link in the email or contacting us at privacy@unaffiliated.co.

b. Cookies and Other Similar Technologies

You can make certain choices regarding the use of cookies and similar technologies. If you replace, change, upgrade or reset your browser or device, or delete your cookies, or if you use a browser that automatically clears your cookies, you may need to update your choices again.

As mentioned above, you may be able to set your browser to refuse certain types of cookies, or to alert you when certain types of cookies are being used. Some browsers offer similar settings for HTML5 local storage and other technologies too. However, if you block or otherwise reject all cookies, local storage, JavaScript or other technologies, certain websites may not function as expected.

We do not respond to browser-based do-not-track signals.

c. Rights Regarding Your Information

Depending on your jurisdiction, you may have the right to make certain requests related to your personal information. For example, you may have the right to ask us to:

• Provide you access to or a copy of certain personal information.

• Correct or update personal information.

• Delete certain personal information.

• Opt you out of certain uses of your information.

• Withdraw any consent that you previously provided.

• Provide you with certain details regarding the processing of your information.

Please note that certain information may be exempt from such requests under applicable law. For example, we need certain information in order to provide the Services to you, so we can’t delete it while still providing you with the Services.

We may take reasonable steps to verify your identity before responding to certain requests, which may require verifying your name and email address. If we are unable to verify your identity, we may be unable to respond to your requests.

If you wish to exercise any privacy rights, or raise a complaint about our handling of your personal information, please contact us as described at the end of this Privacy Policy.

You may have a legal right to designate an authorized agent to make requests on your behalf. In order for an authorized agent to be verified, you must provide the authorized agent with signed, written permission to make such requests or a power of attorney. We may also follow up with you to verify your identity before processing the authorized agent’s request as permitted by applicable law.

Depending on applicable law, you may have the right to appeal our decision to deny your request. We will provide information about how to exercise that right in our response denying the request. You may also have the right to lodge a complaint with a supervisory authority.

Residents of certain jurisdictions have a right to opt out of what the laws in those states call a “sale” of personal information, as well as to opt out of certain uses and disclosures of personal information for certain targeted advertising purposes. To exercise those rights, please visit our Your Privacy Choices page and follow the instructions there. If you use a cookie blocker such as Ghostery, it may block visibility of this tool or link, including in your web footer. See the sections on “Cookies and Other Technology” and “Cookies and Other Similar Technologies” above for more information about how we use cookies and other choices you may have related to those cookies.

You must opt out on each device and each browser where you want your choice to apply. Your preference may be lost if you clear, or your browser is set to clear, cookies. If you have enabled a legally recognized browser-based opt out preference signal (such as Global Privacy Control) on your browser, we recognize such preference in accordance and to the extent required by applicable law. You will need to turn this on for each browser you use.

Additionally, we may disclose or use contact information to enable us and our advertising partners to deliver more relevant (targeted) ads to you (for example to display ads to you on a third-party social media platform) and for other advertising activities. To opt out of such disclosures, please email us at privacy@unaffiliated.co.

Even if you opt out, you will still see advertising, but it may be less relevant to you, or it may be personalized for you based only on a more limited set of data.

5. Shine the Light (California Only)

With certain exceptions, California’s Shine the Light Law (CA Civil Code § 1798.83) allows California residents with which a business has an established business relationship primarily for personal, family, or household purposes (a “customer”) to request a list of the “third parties” to which the business has disclosed certain “personal information” during the preceding calendar year where the business knows or reasonably should know that those third parties used the personal information for the third parties’ own "direct marketing purposes” (each term as defined by the Shine the Light Law). With certain exceptions, direct marketing purposes generally means use of such personal information to solicit or induce a purchase, rental, lease, or exchange of products, goods, property, or services directly to individuals by means of the mail, telephone, or electronic mail for their personal, family, or household purposes. However, a business is not required to provide this information where the business adopts and discloses a policy of not disclosing “personal information” to “third parties” for their “direct marketing purposes” (each term as defined by the Shine the Light Law) (i) unless the customer first affirmatively agrees or (ii) if the customer has exercised an option that prevents that information from being disclosed for such purposes within the meaning of that law. Unaffiliated maintained and maintains such a policy and thus is not required to provide this information. Unaffiliated allows California residents to opt out of such disclosures by sending an email with “Shine the Light opt-out” in the subject line to privacy@unaffiliated.co, after which Unaffiliated will only make such disclosures when the consumer affirmatively opts in (such as by signing up for a particular Third-Party Brand’s newsletter). We will apply those opt-outs to the sender’s email address and to other personal information we have associated with that email address or with other personal information that the sender includes for themselves in the opt-out email.

6. International Data Transfer

We are headquartered in Canada, and recipients of the data disclosures described in this Privacy Policy are generally located in Canada. In some cases, recipients may be located elsewhere in the world, including where privacy laws may not provide as much protection as the laws of your country where you live. For this reason, your personal information may be subject to disclosure to the governments, courts or law enforcement or regulatory agencies of any of the countries where we (or the recipients of disclosures mentioned in this Privacy Policy) operate, pursuant to the laws of such countries. However, this Privacy Policy applies to Unaffiliated’s operations worldwide. To the extent that personal information is transferred from the European Economic Area (“EEA”) and the UK to any non-EEA members of our group or third-party processors who handle the information solely on our behalf, we will take appropriate measures to ensure such companies protect your information adequately in accordance with this Privacy Policy. These measures include signing appropriate contracts in accordance with EEA and UK data protection laws to govern the transfers of such data. For more information about these transfer mechanisms, please contact us as set out below.

7. Data Retention

We keep your information until after we determine its retention is no longer necessary for the purposes described in this Privacy Policy.

8. Protection of Information

To help protect personal information, we have put in place physical, technical, and administrative safeguards. However, we cannot assure you that data that we collect under this Privacy Policy will never be used or disclosed in a manner that is inconsistent with this Privacy Policy.

9. Children Under 13

If you are a parent or legal guardian and think your child under 13 (or a higher age threshold where applicable) has given us personal information, please contact us at privacy@unaffiliated.co so that we can delete it.

10. Updates and Changes to This Policy

We may update this Privacy Policy from time to time, such as to reflect changes in our practices or for legal reasons. We will post those changes here or on a similarly accessible page.

11. Contacting Us

If you have any questions or comments regarding our privacy policy and practices, or to submit a request or complaint, please email us at privacy@unaffiliated.co.

12. Additional Information for Grapejuice

This section applies when you use Grapejuice. It adds to the rest of this Privacy Policy.

a. Information you give us when you shop

When you build a box, create an account, check out, send a gift or contact us, we collect your name, email address, phone number, shipping address and account sign-in details (including through Sign in with Google or Apple); your order history; gift details such as a recipient’s email address and your note to them; your answers to questions about your family’s traditions; and messages you send to Ask Rav, our AI shopping assistant, or to our team.

b. Information about the children you shop for

To build a box, a parent or other adult may tell us the first names, ages and interests of the children the box is for, along with the items chosen for them. First names are optional. We use this information only to build and deliver the box, and we never use it for advertising.

c. Payment information

Payments are processed by Stripe. We receive limited details such as the card brand and last four digits, but we do not receive or store your full card number.

d. Saved boxes for visitors without an account

When you start building a Grapejuice box without signing in, we save your progress — including the first names, ages and interests you enter for the children the box is for, and the items you choose — so you can return to it. This information is stored for up to 60 days (longer if you reopen it) and is deleted when you create an account, which then holds the box, or on request. We store a random visitor identifier in your browser so we can keep your box if you leave and come back.

e. Our identity partner

We work with an identity partner, Retention.com, which may recognize visitors to grapejuice.co who have previously agreed to share their email address with its network. If we receive your email address this way, we may send you a small number of emails about the box you started or about Grapejuice. Every such email includes an unsubscribe link; unsubscribing stops them immediately. We never include children’s names in these emails.

f. Service providers we use for Grapejuice

Companies that run parts of Grapejuice for us include Google (Firebase hosting, database and sign-in), Stripe (payments), Customer.io (email), our shipping and fulfillment partners, and Anthropic, whose AI powers Ask Rav and our box suggestions, and Sentry, which receives technical details about errors on grapejuice.co (such as your browser, device and the page you were on) so we can fix them. To suggest items, we send Anthropic the family details you enter, which can include children’s first names, ages and interests.

g. Advertising and analytics

We use Google Analytics and the Meta Pixel, and share event information (such as pages viewed and purchases) and hashed contact details with Google and Meta to measure and improve our ads. We do not share children’s names, ages or interests with advertising partners. If you send a gift, we share your name and note with the recipient.

We also use Microsoft Clarity to see how visitors use grapejuice.co, through usage measurements, heatmaps and recordings of site sessions (such as clicks, scrolling and page movement), so we can improve the site. Clarity hides what you type into form fields. Microsoft collects this information using cookies and similar technologies; see the Microsoft Privacy Statement (privacy.microsoft.com/privacystatement) for how Microsoft uses it.

h. Your choices on Grapejuice

Use the cookie settings button on grapejuice.co (“Your Privacy Choices”) to turn off non-essential cookies and opt out of the use of your information for targeted advertising.

Email privacy@unaffiliated.co to have a saved box, the related identifiers, and your Grapejuice email profile deleted. Our team can do this in one step.

i. Children

Grapejuice is meant for parents, family members and gift-givers, not for children. We do not knowingly collect personal information directly from children under 13. Information about children is provided by the adults shopping for them. If you want information about your child deleted, email privacy@unaffiliated.co and we will delete it.

j. How long we keep Grapejuice information

Saved boxes for visitors without an account are kept for up to 60 days after they were last opened. Account information is kept while your account is open. Order and payment records are kept as long as needed for tax, accounting and legal purposes.

k. Contact

Privacy questions, requests or complaints: privacy@unaffiliated.co. Order and shipping questions: hello@grapejuice.co.