Privacy Policy
In force from October 21, 2026
Who we are: Hendrano LLC, 27001 US Highway 19 North, Clearwater, FL 33761, United States. We decide what happens to the information described here.
In the United States, your privacy rights depend on your ZIP code. A customer in California can demand a copy of her data, correct it, delete it, and opt out of its sale. A customer in Florida, where we are based, has far fewer statutory rights against a company our size. Virginia, Colorado, Connecticut, Texas, Oregon, and others each have their own rules, their own thresholds, and their own deadlines.
Most retailers deal with this by publishing a state-by-state matrix that nobody reads, and by granting each right only to the residents who can legally demand it.
We have gone the other way. This policy takes the strongest version of each right found anywhere in US law and gives it to everyone, whichever state you are in. Each section below says which state's law the standard came from, so you can see that we are not inventing a generous-sounding version of it.
One note of accuracy, since this page is about honesty: we are not telling you that the California Consumer Privacy Act applies to us. It has revenue and volume thresholds, and a store this size may well fall under them. We honor these rights because we have decided to, not because we have been caught by a statute — and that is a weaker guarantee than a law, which is exactly why we are saying so rather than implying otherwise.
THE STANDARD WE APPLY TO EVERYONE
| Right | What it means | Modeled on |
|---|---|---|
| Know and access | A copy of what we hold about you, and why | Cal. Civ. Code § 1798.100 |
| Delete | Deletion, except what we must keep by law | § 1798.105 |
| Correct | Fix anything inaccurate | § 1798.106 |
| Portability | Receive it in a readable, portable format | § 1798.130 |
| Opt out of sale or sharing | Stop any disclosure for advertising purposes | § 1798.120 |
| Limit use of sensitive information | Restrict us to what the transaction needs | § 1798.121 |
| No retaliation | Same prices, same service, same products | § 1798.125 |
| Appeal | If we refuse a request, ask us to reconsider — and get a written answer | Virginia and Colorado consumer privacy acts |
How to use any of them: email support@hendrano.com. You do not need to cite a statute, live in a particular state, or use the words "verifiable consumer request."
We respond within 45 days, the California standard, with one extension of up to 45 more where a request is genuinely complex — and we tell you inside the first 45 days if we are extending, with the reason.
It is free, and we may ask you to confirm your identity only so far as needed to be sure we are not handing your order history to someone else.
An authorized agent may act for you. We will ask for proof that you authorized them.
WHAT WE ACTUALLY HOLD
Order information — your name, billing and shipping addresses, email address, phone number, order contents, and order history.
Device information — IP address, browser type and version, time zone, the pages and products you viewed, how you arrived at the site, and date and time stamps.
And what we do not hold
Your full card number. Card details are entered in our payment processor's own fields and never reach our systems. What comes back to us is the last four digits, the card type, and whether the payment succeeded. A store that cannot see your card number cannot leak it.
Sensitive categories. We do not collect information about health, religion, precise geolocation, union membership, or the other categories that CPRA treats as sensitive personal information. We sell blankets, including heated ones, and we have no interest in why you want one. If you mention something medical in an email because it is relevant to your question, we answer the question and do not build a record of it.
Anything from a child under 13. See below.
Purchased marketing lists. We buy none.
DO WE SELL OR SHARE YOUR INFORMATION?
This deserves a straight answer, because the words have specific meanings.
Under Cal. Civ. Code § 1798.140, "sell" covers disclosing personal information for monetary or other valuable consideration — not just for money — and "share" covers disclosing it for cross-context behavioral advertising, even with no payment at all.
We do not sell your personal information, under either half of that definition.
On "sharing," we will tell you where the live question is rather than hide it. Advertising and analytics tags can transmit identifiers to the platforms that supply them, and whether that amounts to "sharing" has been the subject of regulatory attention. So we treat it as if it does. No advertising or profiling identifier is set unless you opt in, and if you decline, no audience list is built from your visit.
DO NOT TRACK, AND GLOBAL PRIVACY CONTROL
This section stays in our policy for a reason worth explaining, because in a US policy it is required rather than decorative.
California's Online Privacy Protection Act (Cal. Bus. & Prof. Code § 22575(b)(5)) requires us to disclose how we respond to a "Do Not Track" browser signal. So here is the disclosure, and the answer is better than the one the previous version of this page gave.
Do Not Track: the signal was never standardized and most sites ignore it. We do not rely on it as your opt-out mechanism, because it would be unreliable to tell you that we did.
Global Privacy Control (GPC): we honor it. GPC is the signal that actually works, and under the CCPA regulations a business must treat an opt-out preference signal as a valid request to opt out of sale and sharing. If your browser or extension sends GPC, you are opted out — with no banner interaction required, and whatever state you live in.
That is the substance of this section: one signal we do not pretend to rely on, and one we actually act on.
COOKIES, AND YOUR AD CHOICES
Strictly necessary — cart, checkout, session, security. The store cannot operate without them.
Analytics — our own measurement of how pages perform, including Google Analytics.
Advertising and profiling — set only with your opt-in, as above.
Your controls, in order of how well they work:
- Our cookie settings, reachable from any page
- Global Privacy Control, via your browser or an extension — see above
- The industry opt-outs: the Digital Advertising Alliance at youradchoices.com and the Network Advertising Initiative at optout.networkadvertising.org
- Your browser's own privacy settings
The previous version of this page pointed only at an educational article about how targeted advertising works. The links above are the ones that actually change something.
TEXT MESSAGES AND EMAIL
Texts. If you opt into our text program, you consent to receive marketing messages. Under the Telephone Consumer Protection Act (47 U.S.C. § 227) marketing texts require your prior express written consent, which is separate from placing an order and is never a condition of buying anything.
Reply STOP to any message to opt out, or HELP for assistance. We act on a STOP immediately.
And one line from the previous version that is accurate here, unlike in some other countries: standard message and data rates may apply, depending on your carrier plan. We have kept it because in the US it is true.
Email. Under CAN-SPAM (15 U.S.C. § 7704) every commercial email we send carries a working unsubscribe, identifies us, and includes our physical postal address — and we must honor an opt-out within 10 business days. We act on them the same day.
Message frequency varies. We do not have a set schedule, and we would rather send less.
HOW LONG WE KEEP IT
This is the section the previous version got wrong, and it is the one that limits your right to deletion.
The old wording: "we will maintain your Order Information for our records unless and until you ask us to delete this information."
That is indefinite retention by default. "Until someone complains" is not a retention period, and a policy that states one is not stating anything.
| What | How long | Why |
|---|---|---|
| Financial and tax records: name, address, amounts | 7 years | Federal and state tax record-keeping requirements |
| Order records for claims purposes | 5 years | Fla. Stat. § 95.11(2)(b) — the limitation period for an action on a written contract in Florida |
| Correspondence attached to an order | with the order | Same |
| Correspondence with no order attached | 2 years | Continuity of service |
| Marketing consent records | until you opt out — then we keep the record of the opt-out | So we do not contact you again by mistake |
| Analytics and advertising data | as stated in our cookie settings, and no longer | Consent |
So a deletion request has one boundary, and only one. We delete marketing data, browsing data, correspondence, and account data on request. We cannot delete a tax record inside its retention period — and when we decline a deletion for that reason, we say which record and the date it goes. A refusal without a date is not an answer.
SECURITY, AND WHAT HAPPENS IF THERE IS A BREACH
We use access controls, encryption in transit, and vendors who are contractually bound to equivalent standards. No system is perfect, and a policy claiming otherwise would be the first thing in it you should not believe.
If there is a breach, Florida law sets our deadline and we apply it to everyone.
Under the Florida Information Protection Act (Fla. Stat. § 501.171), we must notify affected individuals within 30 days of determining that a breach of personal information occurred, and notify the Florida Attorney General where 500 or more Florida residents are affected.
Other states set different deadlines — some shorter, some vaguer. We use 30 days for everyone, consistent with the single-standard approach of this whole policy.
What a notice from us will contain: what happened, which information was involved, what we have done, and what you should do. We will not describe it as a "technical issue." If your information was exposed, that is what the message will say.
CHILDREN
We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.; 16 C.F.R. Part 312). Ordering requires an adult.
And a stricter rule we apply above that age: under Cal. Civ. Code § 1798.120(c), selling or sharing the personal information of a consumer under 16 requires opt-in consent rather than opt-out. We do not sell or share, so this does not arise — but if it ever did, the opt-in standard would apply to every under-16 customer, not only Californian ones.
If you believe a child's information has reached us, tell us and we will delete it.
LAW ENFORCEMENT AND LEGAL REQUESTS
We disclose information where we are legally required to — in response to a subpoena, court order, search warrant, or other lawful process.
We require it in writing, and we check it. An informal request by phone or email, with no legal process behind it, gets a refusal and a note of who asked.
We tell you, unless telling you would itself be unlawful or we are specifically prohibited from doing so.
We do not volunteer information, and there is no standing arrangement with anyone.
SERVICE PROVIDERS
Shopify — the platform the store runs on; a service provider acting on our instructions under contract, which may not use your information for its own purposes.
Our payment processor — what is needed to take payment and meet its own regulatory obligations.
The carrier — recipient name, shipping address, ZIP, and a contact for delivery notifications. Not payment details, not order history, not correspondence.
Google Analytics — site usage, with your consent.
Our accountant — financial records, under contract.
If we add a recipient that materially affects you, we will say so here and tell you directly rather than relying on you to re-read the page.
CHANGES TO THIS POLICY
The date at the top is the version in force. If we change something that materially affects you — a new recipient, a new purpose, a longer retention period — we tell you directly. Previous versions are available on request.
WHERE THINGS ARE WRITTEN DOWN
Terms and Conditions — the contract and the five rulebooks that govern it. Shipping Policy — times, tracking, and the FTC shipping rule. Returns Policy — the 30-day window, the implied warranties, and how refunds run.
CONTACT
| Company name | Hendrano LLC |
| Address | 27001 US Highway 19 North, Clearwater, FL 33761, United States |
| support@hendrano.com | |
| Phone | +1 727-205-3670 |
| Customer service hours | Mon–Fri: 9:00 AM–5:00 PM |
| Sat & Sun | Closed |
| Response time | Within one business day |