Privacy Policy

Effective Date: April 13, 2026

Industrial CNT LLC, a Wyoming limited liability company doing business as Troll Hair ("we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data when you use our website at trollhair.com (the "Site").

1. Information We Collect

Information You Provide

• Account information: Email address (required to create an account). Optionally, your name and phone number.
• Profile information: Billing address, shipping address, job title, and company name, if you choose to add them to your account.
• Order information: Shipping address, billing method, and purchase order number (for business accounts) when you place an order. Payment card details are collected directly by Stripe and never touch our servers.
• Form submissions: Name, email, phone number, company, job title, and message content when you submit a contact form, sample request, or career application.
• Business account information: Company name, company shipping addresses, billing address, tax exemption certificates (uploaded as PDF or image files), and payment terms preferences.
• Quote requests: Product details, quantities, and any notes you include when requesting a quote through a business account.

Information Collected Automatically

• Server logs: When you visit the Site, our hosting infrastructure (AWS) automatically logs standard request data such as your IP address, browser type, referring URL, and pages visited. These logs are used for security and infrastructure monitoring and are not used for tracking or advertising.
• Authentication cookies: When you sign in, we set two cookies on your browser (see Section 4 for details). We do not use any tracking cookies, analytics tools, advertising pixels, or third-party tracking scripts.

2. How We Use Your Information

• Provide our services: Process and fulfill orders and preorders, manage your account, and deliver products.
• Communicate with you: Send transactional emails including sign-in links, order confirmations, shipping notifications, and account deletion confirmations.
• Process payments: Transmit order details to Stripe for payment processing and tax calculation.
• Respond to inquiries: Review and respond to your contact form submissions, sample requests, and career applications.
• Manage business accounts: Process company invitations, manage member roles, review tax exemption certificates, and administer payment terms and quotes.
• Maintain security: Authenticate your identity, prevent fraud, and protect the Site.
• Comply with legal obligations: Maintain order records for tax, accounting, and regulatory purposes.

3. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties. We share your information only with the following service providers, solely to operate our business:

• Stripe — Payment processing and sales tax calculation. Stripe receives your payment card details directly (we never see or store them), plus order amounts and shipping addresses for tax computation. See Stripe's Privacy Policy.
• Amazon Web Services (AWS) — Cloud hosting and infrastructure. Your data is stored on AWS infrastructure in the United States. See AWS's Privacy Policy.
• Shipping carriers — We share your name and shipping address with carriers to deliver your orders.

We may also disclose your information if required by law, legal process, or government request, or to protect our rights, property, or safety.

4. Cookies

We use only two cookies, both strictly necessary for authentication. We do not use any tracking cookies, analytics cookies, or advertising cookies.

• trollhair_user — Contains your account information (email, name, role) so the Site can personalize your experience. This cookie is readable by the Site's JavaScript. Expires after 60 days.
• trollhair_session — Contains a cryptographic signature used to verify your identity on each request. This cookie is HttpOnly (not accessible to JavaScript) and Secure (only sent over HTTPS). Expires after 60 days.

Both cookies are set on the trollhair.com domain with SameSite=Lax. They are set only when you sign in and are cleared when your session expires. Because we use no tracking cookies, there is no cookie consent banner — the only cookies we set are strictly necessary for the Site to function.

5. Data Storage and Security

• Your data is stored on secure cloud infrastructure in the United States, encrypted at rest.
• All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Authentication uses a split-token pattern where your session signature is stored in an HttpOnly cookie, protecting against cross-site scripting (XSS) attacks.
• Payment card data is handled entirely by Stripe and never passes through or is stored on our servers.
• Tax exemption certificates are stored in secure cloud storage with restricted access.

While we implement industry-standard security measures, no system is 100% secure. We cannot guarantee absolute security of your data.

6. Data Retention

• Account data: Retained as long as your account is active. Deleted upon your request (see Section 7).
• Order and preorder records: Retained indefinitely, even after account deletion, as required for tax, accounting, and legal compliance.
• Form submissions (contact, sample requests, career applications): Retained indefinitely or until you request deletion.
• Authentication cookies: Expire automatically after 60 days.
• Server logs: Retained according to our hosting provider's default retention policies.

7. Your Rights

You have the following rights regarding your personal data:

• Access and export: You can download a copy of all your personal data at any time from your account settings. The export is provided as a JSON file and includes your profile, order history, and form submissions.
• Correction: You can update your profile information directly in your account settings, or contact us to request corrections.
• Deletion: You can request account deletion from your account settings. This sends a confirmation email with a secure link. Upon confirmation, we permanently delete your profile information, form submissions, and company memberships. Order records are retained for legal and tax compliance but are no longer linked to an active account. If you are a company administrator, you must first promote another member to admin and demote yourself, or remove all other members and delete the company, before deleting your account.
• Restriction and objection: You may contact us to request that we restrict or stop processing your data in certain circumstances.

To exercise any of these rights, you can use the built-in tools in your account or contact us at info@trollhair.com. We will respond within 30 days.

8. International Users

• Our services are operated from the United States. If you are located outside the U.S., your information will be transferred to and processed in the United States. By using the Site, you consent to this transfer.
• We do not use tracking cookies or behavioral profiling, and we do not sell your data. We believe this minimizes the privacy impact of cross-border data transfers.

European Economic Area (EEA) and UK Users

• Our legal basis for processing your personal data is: (a) performance of a contract (to fulfill your orders and manage your account); (b) legitimate interests (security, fraud prevention, and service improvement); and (c) compliance with legal obligations (tax and accounting records).
• You have additional rights under GDPR, including the right to data portability and the right to lodge a complaint with your local data protection authority.
• Because we do not use tracking cookies, no cookie consent is required under GDPR/ePrivacy Directive for our Site's cookies — they are strictly necessary for authentication.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know: You may request the categories and specific pieces of personal information we have collected about you.
• Right to delete: You may request deletion of your personal information, subject to certain legal exceptions.
• Right to correct: You may request correction of inaccurate personal information.
• Right to opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at info@trollhair.com. We will verify your identity before processing your request and respond within 45 days.

10. Children's Privacy

Our Site and products are not intended for children under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected data from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at info@trollhair.com.

11. Third-Party Links

The Site may contain links to third-party websites, including social media platforms and content hosts. We are not responsible for the privacy practices of these sites. We encourage you to review their privacy policies before providing any personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a new effective date. Your continued use of the Site after changes are posted constitutes acceptance of the updated policy. We encourage you to review this page periodically.

13. Contact

If you have questions about this Privacy Policy or our data practices, contact us at info@trollhair.com or call (212) 602-1401.

Mailing address: Industrial CNT LLC, 3 Monell Place, Beacon, NY 12508, USA