Cookie Policy

1. What cookies are

Cookies (and similar technologies such as localStorage and pixels) are small data items that a website places on your device to make it work, to remember your preferences, to analyse traffic and to support marketing. This policy explains what we use, why, and your choices, in line with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 ("DPA 2018"), the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), and the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA") for California residents.

2. The categories we use

• Strictly necessary (always on). Required to operate the Site — form submission, security, session state and remembering your language choice. These do not require consent under regulation 6(4) PECR.
• Functional (opt-in). Optional convenience, e.g. a random device identifier used to autofill your details if you return before completing the form.
• Analytics (opt-in). Aggregated usage stats (for example, via Google Analytics 4) so we can improve the Site. Not loaded unless you consent.
• Marketing (opt-in). Advertising and audience tools such as Meta Pixel, Google Ads, TikTok Pixel and Klaviyo onsite tracking. Used to measure campaigns and to tailor promotions. Not loaded unless you consent.

3. Third parties

When you consent to marketing or analytics cookies, the relevant third parties may set cookies or receive limited event data. These may include:

• Klaviyo, Inc. — email and SMS marketing platform we use to hold your waitlist details and to send launch messages. Klaviyo may set cookies to identify your browser and measure email/SMS engagement.
• Google (Analytics / Ads) — measurement and advertising.
• Meta Platforms (Facebook / Instagram Pixel) — advertising.
• Shopify — checkout and fraud prevention.

Where these providers are based outside the UK/EEA, transfers rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

4. How to change your choice

You can change or withdraw your consent at any time by clicking Cookie Settings (also available in the footer of every page), or by clearing cookies in your browser. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

5. California residents (CCPA/CPRA)

We do not sell personal information for money. Sharing personal information with advertising partners for cross-context behavioural advertising is treated as a "sale" or "share" under the CCPA/CPRA. If you do not opt-in to Marketing cookies (or you select "Reject Non-Essential"), we treat that as a Global Privacy Control / opt-out of sale and sharing. You also have the right to know, delete, correct, and limit use of sensitive personal information. To exercise a right, email sales@cnframing.com. We will not discriminate against you for exercising a right.

6. Consent records

Separately from cookies, when you submit a sign-up form on the Site, CN Framing stores the submission (including SMS opt-in state, the consent language shown, timestamp, page URL, IP address and user-agent) in its internal admin consent records database solely to provide proof of consent if ever requested by Klaviyo or by US SMS carriers and aggregators for compliance and audit purposes. These records are not used for any other purpose and are never shared or sold to third parties or affiliates.

7. Contact

Questions about this policy? Email zac@cnframing.com.