Privacy policy

Last updated: 2 October 2026

This Privacy Policy explains how Norvelle LLC ("Mendly", "we", "us", "our") collects, uses, shares and protects personal data when you visit https://mendlyshop.com, place an order, contact us or otherwise interact with us. It is effective from 2 October 2026.

1. Who is responsible for your data

The controller – the organisation responsible for your personal data – is:

Norvelle LLC (trading as Mendly)
A single-member limited liability company organized under the laws of the State of Wyoming, USA
30 N Gould St, Sheridan, WY 82801, United States (registered business address – not a returns address)
Email: contact@mendlyshop.com (subject "Privacy request")

Privacy officer. Our managing member is responsible for data protection at Norvelle LLC and acts as our privacy officer, including as the person in charge of the protection of personal information under Québec law. You can reach them at the email address above. We have not appointed a data protection officer.

Representatives. Where required by Article 27 GDPR / UK GDPR, details of our representative will be provided here.

2. What this policy covers

This policy applies to personal data about our customers, website visitors, newsletter and SMS subscribers, people who write reviews and anyone who contacts us. It does not cover third-party websites or services that you reach from our site (such as PayPal, Shop Pay or social networks), which have their own privacy notices (see Section 15).

3. Personal data we collect

Category	Examples	Source
Contact and identity data	Name, email address, phone number (if provided), billing and delivery addresses	You – at checkout, in your account or when you contact us
Order data	Products ordered, prices paid, discounts used, order number, order and delivery status, returns and refunds	You, Shopify, our fulfilment partners and carriers
Payment data	Payment method, card type and last four digits, billing address, transaction and fraud-check results. Full card numbers are handled by our payment providers – we never store them.	You (through our payment providers) and our payment providers
Account data	Login email, saved addresses, order history and preferences	You, if you create a customer account
Communications	Emails and messages, photos or videos you send us (for example, of a damaged item), feedback, survey answers and product reviews	You
Device and usage data	IP address, approximate location derived from your IP address, browser and device type, operating system, language, pages viewed, links clicked, referring website, date and time of visits, and cookie and pixel identifiers	Collected automatically through cookies and similar technologies (see our Cookie Policy)
Marketing data	Subscription status and consent records, interactions with our emails and texts (such as opens and clicks) and interests inferred from your purchases	You and our email and SMS platform
Information from partners	Delivery updates from carriers, fraud-risk signals from payment providers, reports on the performance of our ads from advertising partners, and information from social networks if you interact with our pages or ads (depending on your settings there)	Carriers, payment providers, advertising partners and social networks

Information you must provide. To place an order, we need your name, email address, delivery address and payment details. Without them we cannot process or deliver your order. Everything else – such as subscribing to marketing or writing a review – is optional.

Sensitive data. We do not ask for sensitive data. If you choose to tell us about a health matter (for example, a skin reaction to a cosmetic product), we use that information only to handle your request, to meet our product-safety obligations and, if necessary, to establish or defend legal claims.

4. How we use your data and our legal bases

We use personal data for the purposes below. If you are in the EEA, the UK or another country where a legal basis is required, the right-hand column shows the basis we rely on.

Purpose	Legal basis
Processing, charging for and delivering your order, including order confirmations, shipping updates and customs clearance	Performance of our contract with you; legal obligation (for example, customs requirements)
Customer service, including returns, refunds, withdrawals, guarantee claims and complaints	Performance of our contract; legal obligation (consumer protection law)
Creating and managing your customer account	Performance of our contract
Preventing and detecting fraud, abuse and security incidents, including automated fraud screening by our payment providers	Legitimate interests (protecting our customers and our business); legal obligation where applicable
Keeping tax and accounting records, responding to lawful requests and complying with other legal obligations	Legal obligation
Operating, securing and improving our website (essential functions, troubleshooting and statistics)	Legitimate interests (running an effective online store); you can switch off non-essential cookies at any time in "Cookie preferences"
Sending marketing emails and text messages	Consent, which you can withdraw at any time
Measuring our advertising and showing you personalised ads through cookies, pixels and server-side tools of our advertising partners	Legitimate interests (promoting our store), subject to your right to object and opt out at any time using "Cookie preferences", "Your Privacy Choices" or Global Privacy Control
Inviting you to review a product you bought and publishing reviews you submit	Legitimate interests (sharing genuine customer feedback); consent where local law treats review requests as marketing
Establishing, exercising or defending legal claims, and in connection with a reorganisation or sale of our business	Legitimate interests

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can object to this processing at any time (see Section 13).

5. Cookies, pixels and similar technologies

We and our partners use cookies, pixels and similar technologies to run our store, remember your preferences, understand how our site is used and measure and personalise advertising. We may also use server-side connections (such as Meta's Conversions API, Pinterest's Conversions API or TikTok's Events API) that send information about events in our store – for example, a purchase, its value and a hashed (scrambled) version of your email address – directly to an advertising partner. These technologies are active by default; you can switch off preference, analytics and marketing cookies at any time using "Cookie preferences" in our website footer, and our server-side connections then follow your choice. Details, including how to change your choices, are in our Cookie Policy.

6. Marketing communications

• Email. We send marketing emails only if you have subscribed. You can unsubscribe at any time using the link in every email or by contacting us. Our marketing emails may contain technology that tells us whether an email was opened and which links were clicked, so that we can improve our communications.
• SMS. We send marketing text messages only if you have opted in. Message frequency varies, and message and data rates may apply. Reply STOP to unsubscribe or HELP for help. Consent is not a condition of purchase.
• Your mobile number stays with us. We do not share mobile phone numbers or SMS opt-in data and consent with third parties or affiliates for their own marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except service providers that send messages on our behalf.
• Service messages. We will still send you messages about your orders (such as order confirmations and shipping updates) if you unsubscribe from marketing.

7. Who we share your data with

We share personal data only as described below. We require our service providers to protect your data and to use it only to provide their services to us.

Recipient	Why we share data
Shopify (our e-commerce platform)	Hosts our online store, checkout and customer accounts and processes orders on our behalf. For some services, such as Shop Pay and the Shop app, Shopify acts as an independent controller under its own privacy policy.
Payment and checkout providers – such as Shopify Payments, PayPal and Whop, Inc. – and wallet providers such as Apple Pay and Google Pay	Process payments and refunds and help prevent fraud. Some act as independent controllers under their own privacy notices.
Fulfilment partners and warehouses	Store, pack and ship your order. They receive your name, delivery address, phone number (if provided) and order contents.
Postal operators, couriers and customs authorities	Deliver your order, provide tracking and clear customs. Customs declarations include your name, address and the contents and value of your parcel.
Email and SMS platforms (such as Shopify Email or Klaviyo)	Send order updates and, with your consent, marketing messages.
Customer support and business tools	Help us manage your enquiries and run our business (for example, email and helpdesk services).
Review platform (if enabled)	Sends review requests and collects, verifies and displays product reviews.
Analytics and advertising partners – we may use Google (Analytics and Ads), Meta (Pixel and Conversions API), Pinterest (Tag and Conversions API) and TikTok (Pixel and Events API)	Measure how our site is used and how our ads perform, and show you relevant ads – unless you switch these cookies off in "Cookie preferences". These partners may also use the data for their own purposes as independent controllers. Where we use Meta's tools for visitors in the EEA, we and Meta Platforms Ireland Limited are joint controllers for collecting the data and transmitting it to Meta; Meta is responsible for its subsequent processing.
Professional advisers and insurers	Provide legal, accounting, tax and insurance services.
Authorities and others where required by law	Courts, regulators, tax authorities and law enforcement, where we are required by law or need to protect our rights, our customers or others.
A buyer or successor of our business	If our business (or part of it) is reorganised, sold or merged, personal data may be transferred to the new owner, who must protect it in line with this policy.

We do not sell your personal data for money. However, where we use advertising cookies or pixels, sharing data with advertising partners may count as a "sale", "sharing" or "targeted advertising" under some US state laws. You can opt out at any time – see Section 14.

8. International data transfers

We are based in the United States, so your personal data is processed in the United States. Our service providers may also process it in other countries, including Canada, countries in the EEA and the UK, and the countries where the warehouses of our fulfilment partners and the carriers that deliver your order are located – which may be outside your own country and outside the EEA, the UK and Switzerland. We can tell you which countries are involved in handling your order on request.

Where data protection law restricts transfers abroad, we rely on one or more of these safeguards:

• a decision recognising that the destination country or recipient provides adequate protection – for example, for Canada, the UK, Switzerland, Japan and New Zealand, and for US recipients certified under the EU-US Data Privacy Framework, its UK Extension or the Swiss-US Data Privacy Framework;
• the standard contractual clauses approved by the European Commission, together with the UK International Data Transfer Addendum (or the UK International Data Transfer Agreement) and the adaptations required by Swiss law; or
• where no other safeguard is available, an exception permitted by law – for example, where a transfer is necessary to perform our contract with you (such as sending your order details to the warehouse and carriers that deliver it).

When you give personal data directly to us, our processing of it in the United States is governed by this policy and, where they apply, by the GDPR, the UK GDPR and the other laws described in Section 14. You can ask us for a copy of the relevant safeguards (commercial details may be removed). Data held in other countries may be accessible to the courts, law enforcement and national security authorities of those countries.

9. How long we keep your data

Data	How long we keep it
Order, payment, refund and accounting records	As long as required by tax and accounting laws – generally up to 7 years after the end of the financial year in which the order was placed
Customer account	Until you close your account or ask us to delete it (order records are then kept as described above)
Customer service communications, including photos of faulty items	3 years after your last contact with us, or longer if needed to deal with a claim
Marketing subscriptions	Until you unsubscribe or withdraw your consent. We then keep a minimal record of your opt-out so that we can respect it, and keep proof of your consent for as long as we may need to demonstrate it.
Cookie and similar data	For the periods described in our Cookie Policy
Fraud prevention and security records	As long as necessary for these purposes and to meet our legal obligations
Product reviews	While they are published, or until you ask us to remove them
Data needed for legal claims	Until the claim is resolved and the applicable limitation periods have expired

When we no longer need personal data, we delete or anonymise it.

10. How we protect your data

We use appropriate technical and organisational measures to protect personal data. These include running our store on Shopify's platform, which is certified as PCI DSS Level 1 compliant for handling payment card data; encrypting data in transit (HTTPS/TLS); limiting access to personal data to those who need it; using strong passwords and strong authentication on our administrative accounts; and choosing service providers that commit to protecting data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a data breach affects you, we will notify you and the relevant authorities where the law requires it.

11. Automated decisions and fraud screening

To protect you and us against payment fraud, Shopify and our payment and checkout providers (such as Shopify Payments, PayPal and Whop) use automated fraud-screening tools.

• Personal information used: order details; payment details (such as card type, the bank that issued the card and billing address); contact details and delivery address; IP address and device information; and previous transaction history.
• Decisions made solely by automated means: whether a payment is approved or declined, and whether an order is flagged as high risk. If a payment is declined, the order cannot be placed with that payment method.
• Decisions supported by automated means: when an order is flagged, we may review it manually and decide whether to fulfil or cancel it.

If you think an automated decision about you was wrong, contact us. You can ask for a human review, express your point of view and contest the decision. We do not otherwise make decisions that have legal or similarly significant effects on you based solely on automated processing. We may group subscribers into segments for marketing purposes (for example, by products bought); this does not have such effects, and you can object to it at any time.

12. Children

Our store is not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, please contact us and we will delete it. We do not sell or share the personal information of consumers under 16.

13. Your privacy rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct inaccurate or incomplete data;
• have your data deleted;
• restrict or object to certain processing, including processing based on legitimate interests and – at any time – direct marketing;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting processing carried out before you withdrew it;
• opt out of the sale or sharing of your personal data and of targeted advertising;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects, and to ask for a human review (see Section 11); and
• complain to a data protection authority (see Section 14).

How to make a request. Email contact@mendlyshop.com with the subject "Privacy request" (or use our contact form) and tell us what you would like us to do. To protect your data, we will verify your identity, usually by asking you to confirm details such as your order number and the email address you used. We will not ask for more information than we need.

Authorised agents. Where the law allows, you can ask someone to make a request on your behalf. We may ask for proof that they are authorised and confirm your identity directly with you.

Response times. We respond within the time required by law – for example, within one month under the GDPR and UK GDPR (extendable by two months for complex requests) and within 45 days under US state privacy laws (extendable where permitted). Requests are free of charge unless they are manifestly unfounded or excessive.

Quick opt-outs. You can unsubscribe from marketing using the link in any email or by replying STOP to our texts; change your cookie choices using "Cookie preferences" in our website footer; and opt out of the sale or sharing of your data and of targeted advertising using "Your Privacy Choices" in our website footer or by enabling Global Privacy Control in your browser.

We will not discriminate against you for exercising your privacy rights.

14. Additional information for your region

European Economic Area (EU countries and Norway)

The General Data Protection Regulation (GDPR) applies to our processing of the personal data of people in the EEA – including Norway, through the EEA Agreement – in connection with offering them our products. Your rights under Articles 15 to 22 GDPR are summarised in Section 13. You have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where an alleged infringement took place. A list of authorities is available from the European Data Protection Board. We would appreciate the chance to address your concerns first, so please consider contacting us before you complain. Information about our representative is in Section 1.

United Kingdom

The UK GDPR and the Data Protection Act 2018 apply to our processing of the personal data of people in the UK, and you have the rights described in Section 13. If you complain to us about how we handle your personal data, we will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. Information about our representative is in Section 1.

Switzerland

The Swiss Federal Act on Data Protection (FADP) applies to our processing of the personal data of people in Switzerland. You have the right to request information about your data, to have it corrected or deleted, to object to its processing, to receive it in a portable format and to have an automated individual decision reviewed by a person. Your data is disclosed to the United States (to recipients certified under the Swiss-US Data Privacy Framework, which Switzerland recognises as providing adequate protection, or otherwise on the basis of standard contractual clauses) and to the other countries described in Section 8. You can contact the Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch. Where required by Article 14 FADP, details of our representative in Switzerland will be provided here.

United States: California

This section applies to California residents to the extent that the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), applies to us. It supplements the rest of this policy and serves as our notice at collection.

Categories of personal information. We collect, and may disclose, the categories of personal information below. Their sources are described in Section 3, the business and commercial purposes for which we use them in Section 4 and how long we keep them in Section 9.

Category	Examples	Disclosed for a business purpose to	Sold or shared?
Identifiers	Name, email, postal address, phone number, IP address, cookie and online identifiers	Shopify, payment providers, fulfilment partners, carriers, email/SMS and support tools	Online identifiers and IP addresses may be shared with advertising partners, if advertising cookies are active
Customer records (Cal. Civ. Code § 1798.80(e))	Name, address, phone number, payment card details (handled by payment providers)	Shopify, payment providers, fulfilment partners and carriers	No
Commercial information	Products purchased, order history, returns	Shopify, payment providers, fulfilment partners, email platform	Purchase events may be shared with advertising partners, if advertising cookies are active
Internet or other electronic network activity	Pages viewed, clicks, interactions with our emails and ads	Shopify, analytics providers, email platform	May be shared with advertising partners, if advertising cookies are active
Geolocation data	Approximate location derived from your IP address (not precise geolocation)	Shopify, analytics providers	May be shared with advertising partners, if advertising cookies are active
Audio, electronic or visual information	Photos or videos you send us (for example, of a damaged item)	Customer support tools	No
Inferences	Product preferences inferred from your purchases and browsing	Email/SMS platform	No
Sensitive personal information	Account log-in details, if you create an account with a password	Shopify	No

We do not collect the other categories listed in the CCPA, such as biometric information, precise geolocation, or professional, employment or education information.

"Sale" and "sharing". We do not sell personal information for money. However, if advertising cookies and pixels are active on our site, making identifiers, internet activity, approximate location and purchase information available to advertising partners (such as Google, Meta, Pinterest and TikTok) may be considered a "sale" or "sharing" for cross-context behavioural advertising under California law. You can opt out at any time by using the "Your Privacy Choices" (Do Not Sell or Share My Personal Information) link in our website footer, by enabling Global Privacy Control in your browser (which we treat as a valid opt-out for that browser) or by emailing us. We do not knowingly sell or share the personal information of consumers under 16.

Sensitive personal information. We use sensitive personal information only for purposes permitted by the CCPA – such as providing our products, keeping your account secure and preventing fraud – and not to infer characteristics about you. Payment card details are collected and processed by our payment providers.

Your rights. You have the right to know what personal information we collect, use, disclose, sell and share (including the specific pieces of information we hold); to delete it; to correct it; to opt out of its sale and sharing; and not to be discriminated against for exercising these rights. To make a request, see Section 13. We will confirm receipt within 10 business days and respond within 45 days; if we need more time (up to a further 45 days), we will tell you why.

Financial incentives. From time to time we may offer a discount or other benefit when you sign up for our emails or texts. Taking part is optional, and you can withdraw at any time by unsubscribing. We reasonably estimate the value of your personal information in such a programme to be equal to the value of the benefit offered, based on our expenses related to the offer.

Other California notices. We do not disclose personal information to third parties for their own direct marketing purposes (California's "Shine the Light" law). Where we use de-identified data, we keep it in de-identified form and do not attempt to re-identify it. For how we respond to "Do Not Track" signals, see our Cookie Policy.

United States: other states

If you live in a state with a comprehensive consumer privacy law – such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with similar laws – you may have the right, depending on whether the law applies to us, to confirm whether we process your personal data and to access it; to correct and delete it; to obtain a portable copy; and to opt out of targeted advertising, the sale of personal data and profiling in furtherance of decisions that produce legal or similarly significant effects. You can opt out using "Your Privacy Choices" in our website footer or Global Privacy Control, and exercise your other rights as described in Section 13.

Appeals. If we decline to take action on your request, you can appeal by replying to our decision with the subject "Privacy appeal". We will respond to your appeal within the time required by your state's law (generally 45 to 60 days). If you are not satisfied with the outcome, you can contact your state Attorney General.

Nevada. We do not sell "covered information" as defined by Nevada law, but you can still send us an opt-out request by email.

Canada

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Québec's Act respecting the protection of personal information in the private sector. Our privacy officer – who is also the person in charge of the protection of personal information for Québec – is the managing member of Norvelle LLC, who can be reached at contact@mendlyshop.com.

• We rely on your consent, which may be express (for example, for marketing emails, as required by Canada's anti-spam legislation) or implied (for example, to process and deliver your order). You can withdraw your consent at any time, subject to legal or contractual restrictions, and we will explain the consequences.
• You can access and correct your personal information. Residents of Québec can also ask to receive their information in a structured, commonly used technological format, ask us to stop disseminating it or to de-index links where the law allows, and be informed about decisions based exclusively on automated processing (see Section 11).
• Our store uses technologies that can allow you to be identified, located or profiled, such as analytics and advertising cookies (see Section 5 and our Cookie Policy). You can turn them off at any time using "Cookie preferences" in our website footer.
• Your information is stored and processed outside Canada, including in the United States, and may be accessible to the courts, law enforcement and national security authorities of those countries.
• You can complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or, in Québec, to the Commission d'accès à l'information (www.cai.gouv.qc.ca).

Australia

• We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, to the extent they apply to us.
• You can browse our site without identifying yourself, but we need your name and contact details to fulfil an order.
• We are likely to disclose personal information to overseas recipients in the United States, Canada and the other countries described in Section 8.
• Information about automated decision-making – including the kinds of personal information used and the kinds of decisions made – is in Section 11.
• You can ask to access or correct your personal information (see Section 13). If you have a complaint, please contact us first; we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

New Zealand

We handle personal information in line with the Privacy Act 2020 and its information privacy principles. You have the right to access and ask us to correct your personal information. When we collect information about you from third parties (for example, delivery updates from carriers or fraud signals from payment providers), Sections 3, 4 and 7 explain what we collect, why we collect it and who receives it. When we disclose information overseas, we take reasonable steps to ensure that it is protected by comparable safeguards. If you are not satisfied with our response to a privacy concern, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz.

Japan

We handle personal information in accordance with the Act on the Protection of Personal Information (APPI).

• Business operator: Norvelle LLC, 30 N Gould St, Sheridan, WY 82801, United States. The name of our representative will be provided without delay upon request.
• Purposes of use: as described in Section 4.
• Provision to third parties: we provide personal data to third parties only with your consent or as otherwise permitted by law. Entrusting data to service providers that handle it on our behalf (such as fulfilment, delivery, payment and IT providers) is not a provision to third parties under the APPI; we supervise these providers appropriately.
• Transfers to foreign countries: we handle personal data in the United States, and our service providers may handle it in the other countries described in Section 8. We provide personal data to recipients in foreign countries either with your consent, given after we have provided the information required by the APPI, or where the recipient has established a system for taking measures equivalent to those required under the APPI (for example, through contractual commitments). On request, we will provide information about these measures.
• Personally referable information: where we provide cookie or similar data to advertising partners that are expected to link it to personal data, we confirm that your consent has been obtained as required by the APPI.
• Security control measures: we have adopted this policy and internal rules for handling personal data; designated a person responsible for personal data and set up procedures for responding to incidents; limited access to personal data to those who need it and imposed confidentiality obligations; protected devices and records against theft and loss; used access controls, encryption and strong authentication; and taken measures based on our understanding of the personal-data protection systems in the United States and the other countries where data is handled.
• Your requests: you can ask us to notify you of the purposes of use; to disclose, correct, add to or delete your retained personal data; to stop using it or providing it to third parties; and to disclose records of its provision to third parties. Please contact us as described in Section 13. We do not charge a fee.
• Complaints: please contact us first. You can also consult the Personal Information Protection Commission (www.ppc.go.jp/en).

15. Third-party services

Some services available through our site are provided by third parties that act as independent controllers of your personal data – for example, Shopify (for Shop Pay and the Shop app), PayPal, Whop and other payment or wallet providers, and social networks when you interact with them. Their own privacy notices apply, including Shopify's Privacy Policy and Whop's Privacy Policy; PayPal's privacy statement is available on the PayPal website.

16. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new "Last updated" date and, if the changes are significant, let you know in advance by email or with a notice on our site.

17. Contact us

Email: contact@mendlyshop.com (subject "Privacy request")
Post: Norvelle LLC, 30 N Gould St, Sheridan, WY 82801, United States

Related information: Cookie Policy · Terms of Service · Legal Notice · Contact information