Flexfire LEDs, Inc. — Privacy Policy

www.flexfireleds.com

Effective Date: April 1, 2026 | Revised: May 2026

Flexfire LEDs, Inc. (“Flexfire LEDs,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website located at www.flexfireleds.com (the “Site”), make a purchase, or interact with our marketing communications, including email and SMS/text message programs.

Please read this policy carefully. By using the Site, you agree to the practices described herein. If you do not agree, please discontinue use of the Site.

1. Information We Collect

We collect personal information in several ways:

1.1 Information You Provide Directly

• Contact information: name, email address, phone number, billing and shipping address

• Account credentials: username and password (if you create an account)

• Purchase information: order history, product preferences, and transaction details

• Communications: messages you send us via email, contact forms, live chat, or customer service and marketing channels

1.2 Information Collected Automatically

When you visit our Site, we and our third-party partners automatically collect:

• Device and browser information: IP address, browser type and version, operating system, device identifiers

• Usage data: pages viewed, links clicked, time spent on pages, referring URLs, search queries

• Location data: general geographic location derived from IP address

• Cookie and tracking data: information collected via cookies, web beacons, pixels, and similar technologies (see Section 6)

1.3 Information from Third Parties

We may receive information about you from:

• Analytics providers (e.g., Google Analytics)

• Advertising and social media platforms (e.g., Meta Pixel, Google Ads, TikTok Pixel)

• Our email and SMS marketing platform, Klaviyo

• HubSpot, our customer relationship management and live chat platform

• Payment processors (note: we do not receive or store full payment card numbers)

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 To Process Transactions

• Process and fulfill your orders

• Send order confirmations, shipping notifications, and delivery updates

• Handle returns, exchanges, and refunds

• Respond to customer service inquiries

2.2 To Communicate with You

• Send promotional emails and SMS/text messages about products, offers, and updates (with your consent)

• Send transactional messages such as order confirmations and shipping updates via email and SMS

• Respond to inquiries and provide support via email and live chat

2.3 To Improve Our Business

• Analyze usage trends and preferences

• Personalize the Site experience and product recommendations

• Improve our products, services, and website

• Conduct research and analytics

2.4 For Marketing and Advertising

• Serve targeted advertisements on our Site and third-party platforms

• Measure the effectiveness of marketing campaigns

• Create lookalike audiences for advertising

2.5 For Legal and Compliance Purposes

• Comply with applicable laws and regulations

• Detect and prevent fraud or unauthorized transactions

• Enforce our Terms & Conditions

• Respond to legal processes or government requests

3. How We Share Your Information

We do not sell your personal information. We may share information with:

3.1 Service Providers

We share information with vendors who perform services on our behalf, including:

• Klaviyo — email and SMS marketing platform

• HubSpot — customer relationship management (CRM), live chat, and customer communications platform

• Third-party payment processors (e.g., Stripe, PayPal, or similar)

• Shipping and fulfillment providers

• Web hosting and cloud service providers

• Analytics providers (e.g., Google Analytics)

• Advertising platforms (e.g., Meta, Google, TikTok)

These service providers are contractually required to use your information only to provide services to us and in a manner consistent with this Privacy Policy.

3.2 Business Transfers

If Flexfire LEDs is involved in a merger, acquisition, asset sale, or similar transaction, your personal information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

3.3 Legal Requirements

We may disclose your information if required by law, regulation, or legal process, or if we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

3.4 With Your Consent

We may share your information for other purposes with your explicit consent.

3.5 Chat and Live Support Data

We use HubSpot to power the live chat feature on our Site. When you initiate a chat conversation, HubSpot receives, processes, and stores the content of that conversation on our behalf as a service provider. Chat conversations may be recorded and retained for customer service and quality assurance purposes in accordance with our data retention schedule in Section 7.

Before any chat session begins, you will be asked to consent to the recording and processing of your chat by HubSpot on our behalf. You may decline, in which case live chat will not be available, and you may contact us by email at info@flexfireleds.com instead.

If you proceed and initiate a chat session, you acknowledge and consent to the collection and processing of your chat messages as described in this Privacy Policy and in accordance with HubSpot’s Privacy Policy, available at legal.hubspot.com/privacy-policy.

If you prefer not to have your communications processed through HubSpot’s chat platform, you may contact us directly by email at info@flexfireleds.com or by calling us through contact information listed on our Site.

4. Email Marketing

We use Klaviyo as our email marketing platform. When you subscribe to our email list or make a purchase, your email address and related information are transmitted to and stored by Klaviyo. Klaviyo’s privacy policy is available at www.klaviyo.com/legal/privacy.

You may unsubscribe from marketing emails at any time by clicking the “unsubscribe” link in any email we send. Opting out of marketing emails will not affect transactional messages related to your orders.

5. SMS / Text Message Marketing

We operate an SMS/text message marketing program through Klaviyo. By subscribing, you consent to receive recurring marketing and transactional text messages from Flexfire LEDs. Message and data rates may apply. Message frequency varies.

For full details regarding our SMS program, including how to opt in and opt out, please review our SMS Terms & Conditions available at www.flexfireleds.com/sms-terms.

To opt out of SMS marketing, reply STOP to any marketing text message. You may also email info@flexfireleds.com to request removal. Opting out of marketing SMS will not prevent transactional messages where permitted by law.

6. Cookies and Tracking Technologies

6.1 What We Use

We and our third-party partners use cookies, web beacons, tracking pixels, and similar technologies to collect information about your browsing activity. These include:

• Essential cookies — required for the Site to function (e.g., shopping cart, login sessions)

• Analytics cookies — help us understand how visitors use the Site (e.g., Google Analytics)

• Marketing/advertising cookies — used to serve targeted ads and measure campaign effectiveness (e.g., Meta Pixel, Google Ads Tag, TikTok Pixel)

• Preference cookies — remember your settings and preferences

6.2 Your Choices

You may manage your cookie preferences by visiting our cookie preference center on the Site. Most browsers also allow you to refuse or delete cookies. You may additionally opt out of interest-based advertising through:

• Google: https://adssettings.google.com

• Meta/Facebook: https://www.facebook.com/ads/preferences

• Network Advertising Initiative: https://optout.networkadvertising.org

• Digital Advertising Alliance: https://optout.aboutads.info

Note that disabling cookies may affect the functionality of our Site, including your ability to add items to your cart or complete a purchase.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. The following retention periods generally apply:

• Order and transaction data: 7 years from the date of the transaction, to comply with applicable tax and accounting requirements

• Account information: For the duration of your active account, plus 3 years following account closure or your last interaction with us

• Marketing contact data (email and SMS): Until you unsubscribe or opt out, plus 12 months

• Customer service records and chat transcripts: 3 years from the date of the interaction

• Website usage and analytics data: Up to 26 months from collection, consistent with Google Analytics data retention settings

• Cookie and advertising data: Up to 13 months from collection

• Legal, compliance, and dispute records: As required by applicable law, typically between 4 and 7 years

When we no longer need your personal information, we will securely delete or anonymize it in accordance with these retention periods.

8. Data Security

We implement reasonable administrative, technical, and physical security measures designed to protect your personal information from unauthorized access, use, alteration, or disclosure. Our payment processing is handled by third-party processors who maintain PCI-DSS compliance; we do not store full payment card numbers on our systems.

Despite our efforts, no security system is impenetrable. We cannot guarantee the absolute security of your information and are not responsible for unauthorized access resulting from circumstances beyond our reasonable control.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). These rights include:

9.1 Your Rights

Right to Know — You may request that we disclose what personal information we have collected about you, the categories of sources, the business purposes for collection, the categories of third parties with whom we share it, and the specific pieces of personal information we hold.

Right to Delete — You may request that we delete personal information we have collected from you, subject to certain exceptions.

Right to Correct — You may request that we correct inaccurate personal information we maintain about you.

Right to Opt-Out of Sale or Sharing — We do not sell personal information. However, our use of advertising and analytics technologies (such as cookies and pixels) may constitute “sharing” personal information for cross-context behavioral advertising under California law. To exercise your right to opt out of sharing, you may:

• Click the “Do Not Sell or Share My Personal Information” link in the footer of our website

• Visit our cookie preference center on the Site

• Contact us at info@flexfireleds.com with the subject line “California Opt-Out Request”

We also honor the Global Privacy Control (GPC) signal. If your browser or browser extension is configured to broadcast the GPC opt-out preference signal, we will treat that signal as a valid opt-out of the sharing of your personal information for cross-context behavioral advertising in California, consistent with applicable California law.

Right to Limit Use of Sensitive Personal Information — To the extent we collect sensitive personal information (as defined by CPRA and described in Section 9.2 below), you may request that we limit its use to the purposes permitted by law.

Right to Non-Discrimination — We will not discriminate against you for exercising any of your privacy rights.

9.1A Privacy Rights for Residents of Other States

Residents of certain US states have rights over their personal information substantially similar to those described in Section 9.1 for California residents, including rights to access, delete, correct, and opt out of the sale or sharing of personal information. As of 2026, these states include Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas (subject to applicable exemptions).

We recognize and honor the Global Privacy Control (GPC) browser signal. When we detect a GPC signal from your browser, we will treat it as an opt-out from the sale or sharing of your personal information, consistent with the laws of California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. To exercise any state-specific privacy right, please contact us at info@flexfireleds.com with the subject line “State Privacy Rights Request” and indicate your state of residence.

9.2 Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information from consumers:

• Identifiers (name, email address, phone number, IP address, account login)

• Commercial information (products purchased, order history, transaction details)

• Financial information (payment details submitted to our third-party payment processors for the purpose of completing transactions; we do not store full payment card numbers)

• Internet and network activity (browsing history on our Site, interaction with advertisements)

• Geolocation data (general location derived from IP address)

• Audio, electronic, visual, thermal, olfactory, or similar information (specifically: live-chat session content collected via HubSpot)

• Inferences drawn from the above categories (e.g., product preferences, purchase likelihood)

Sensitive Personal Information: Under CPRA, account login credentials (username and password) are classified as sensitive personal information. We collect account credentials only from users who create an account on our Site and use them solely to authenticate account access. We do not use account credentials for advertising, marketing profiling, or any purpose other than account security and authentication.

9.3 How to Submit a Request

To process your request, we will verify your identity using information already in our records. For a Right to Know, Delete, or Correct request, you will be asked to provide your full name, the email address(es) associated with your account, and the approximate date of your most recent order or interaction with Flexfire. We may also ask you to confirm receipt of a verification code sent to that email address. If we cannot verify your identity from the information you provide, we may ask for additional information or decline the request and explain why. We will not require you to create an account in order to make a request.

To submit a request, you may:

• Email us at: info@flexfireleds.com (subject line: “California Privacy Rights Request”)

• Write to us at: Flexfire LEDs, Inc., 3554 Business Park Dr, Suite F, Costa Mesa, CA 92626

We will respond within 45 days of receiving a verifiable consumer request. If we need an extension, we will notify you within the initial 45-day period.

9.4 Authorized Agent

You may designate an authorized agent to make a request under the CCPA on your behalf. To do so, the agent must submit a written request to info@flexfireleds.com that (a) identifies you by full name and the email address associated with your account, (b) attaches a signed permission from you authorizing the agent to act in this matter, and (c) identifies the specific right being exercised (know, delete, correct, opt-out, or limit). We may contact you directly to confirm that you authorized the agent to act on your behalf, and we may verify the agent’s own identity. If the agent holds a power of attorney that complies with California Probate Code sections 4121 through 4130, the additional consumer-confirmation step is not required.

10. Nevada Privacy Rights

Nevada residents have the right to opt out of the sale of certain covered information. We do not currently sell covered information as defined under Nevada law. For questions, please contact us at info@flexfireleds.com.

11. International Visitors

Our Site is operated from the United States. If you are located outside the United States, please be aware that information you provide to us may be transferred to, stored, and processed in the United States, where our servers are located and our primary operations are conducted.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the legal basis for the transfer of your personal information to the United States depends on the nature of the transfer:

• Transfers to our service providers (e.g., our email/SMS provider Klaviyo and our CRM provider HubSpot, each certified to the EU-US Data Privacy Framework and the UK Extension) rely on the EU-US Data Privacy Framework adequacy decision, or alternatively on Standard Contractual Clauses (Commission Implementing Decision 2021/914).

• Transfers that you initiate directly — for example, when you place an order or send us a message — rely on the contract-performance derogation in Article 49(1)(b) of the GDPR, or on your explicit consent under Article 49(1)(a).

We process your data in accordance with applicable data protection laws to the extent applicable, including relying on appropriate legal bases for processing such as contractual necessity, legitimate interests, or consent. Copies of the applicable safeguards are available on request by contacting us at info@flexfireleds.com.

12. Children’s Privacy

Our Site is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without parental consent, we will promptly delete that information. If you believe we may have collected information from a child under 13, please contact us at info@flexfireleds.com.

Flexfire LEDs does not knowingly sell or share the personal information of consumers under 16 years of age. If a consumer is between 13 and 15, we will not sell or share their personal information unless the consumer has affirmatively authorized the sale or sharing. If a consumer is under 13, we will not sell or share their personal information unless a parent or legal guardian has affirmatively authorized it.

13. Third-Party Links

Our Site may contain links to third-party websites, applications, or services. This Privacy Policy does not apply to those third-party sites, and we are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Effective Date” at the top of this policy and, where appropriate, provide additional notice (such as a notification on our Site or via email). Your continued use of the Site after any changes constitutes your acceptance of the updated policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Flexfire LEDs, Inc.
3554 Business Park Dr, Suite F
Costa Mesa, CA 92626

Website: www.flexfireleds.com
Email: info@flexfireleds.com

For California residents exercising rights under CCPA/CPRA, please direct requests to the email address above and indicate in the subject line: “California Privacy Rights Request.”