Privacy Policy

Who this policy covers

This Privacy Policy explains how GoySlop (“we,” “us,” or “our”) handles personal information in connection with drinkgoyslop.com, our linked checkout, product updates, preorders and customer requests. GoySlop is the storefront brand; the seller of record is identified in your payment checkout and receipt. Contact us using our contact form, selecting a privacy-related topic. Third-party services have their own privacy notices.

Information we collect

Email signup: your email address, subscription status, signup and update times, consent wording and version, consent time, and the signup source. We record unsubscribe status and time when you opt out.

Customer requests: your email address, topic, message, submission time and request status. Do not submit card numbers, passwords, government identifiers, medical records or other sensitive information in these forms.

Orders: when you purchase through PayPal, PayPal collects payment and checkout information. Information available to the merchant may include your name, email, delivery address, order details, transaction identifier, payment status, amount and dispute or refund records. Our website forms do not collect full card numbers or payment credentials.

Technical information: hosting and payment providers may process IP addresses, device/browser information, requested pages and security logs. Our form service derives a short-lived rate-limit identifier from an IP address and an hourly time value to limit abuse; the subscriber record itself does not contain your raw IP address.

How we use information

We use information to record and manage email consent; provide requested product updates and marketing; administer preorders, payments, shipping, cancellations and refunds; respond to support and privacy requests; maintain suppression records; understand aggregate site usage and preorder interest; detect abuse, fraud and unauthorized activity; meet legal and accounting obligations; and establish, exercise or defend legal claims. Signing up for marketing is optional and is not a condition of purchase. Order-related messages may be sent independently of marketing preferences.

Email choices and consent

The signup form requests affirmative permission for product updates and promotional emails. You can withdraw that permission at any time through our unsubscribe page, an unsubscribe option provided in marketing emails, or the contact form. Withdrawing consent does not affect processing that was lawful before withdrawal. We honor applicable opt-out deadlines and do not charge for unsubscribing. A minimal suppression record may remain so your choice is respected. Unsubscribing does not cancel an order or stop necessary order, security or legal communications.

Who receives information

Information is accessible to authorized personnel and service providers when needed for their work. This includes the ChatGPT Sites/Cloudflare hosting and database infrastructure, PayPal as payment provider, and any shipping, fulfillment or email-delivery providers engaged to perform the relevant service. Providers receive information appropriate to their role and may have independent obligations or privacy practices. Signup records are not publicly listed or exposed through a public subscriber-directory endpoint.

We may disclose information when required by law or valid process, to protect rights and safety, or in connection with a merger, acquisition, financing, reorganization or sale, subject to applicable safeguards and notice requirements. We do not sell email signup lists. This implementation does not share signup information for cross-context behavioral advertising.

Cookies, storage and analytics

The storefront records first-party aggregate analytics: page-view counts, preorder-click counts, calendar date, page path and referring website hostname. It does not record full referring URLs, query strings, analytics visitor IDs or analytics cookies. These counts are approximate and do not identify unique people or confirm a purchase. There are no third-party advertising pixels or third-party analytics scripts in this implementation. Essential hosting/security infrastructure and PayPal may use cookies or similar technologies under their own policies. The current signup process does not store your email in browser storage. The administrator dashboard uses a secure, HttpOnly session cookie and server-side session records with a 12-hour expiration. Temporary browser state may support ordinary page behavior; third-party checkout may maintain its own session.

Your browser can restrict cookies and local storage, which may affect checkout or security functions. If we introduce nonessential tracking, we will update our notices and provide consent or opt-out controls where required. Because this implementation does not sell personal information or use cross-context advertising, there is no corresponding sale/sharing activity for a Global Privacy Control signal to disable.

Retention

We retain active signup records while maintaining the subscription, unless you request deletion or the records are no longer needed. We retain limited suppression information to respect opt-outs. Customer requests are retained while being handled and for a reasonable period afterward for accountability and dispute handling; order, tax and payment records may need longer retention under applicable requirements. We periodically review records for deletion or de-identification.

Form abuse-control identifiers have an approximately two-hour expiration and are cleared during subsequent form activity. Aggregate analytics may be retained for historical comparisons because they do not contain subscriber emails or persistent visitor identifiers. Administrator session records expire after 12 hours and are cleaned up on later logins. Providers may maintain independent logs and backups on their own schedules. Deletion from active systems may precede expiration from protected backups. We may retain information necessary for legal holds, fraud prevention or other lawful exceptions.

Security

We use HTTPS, server-side input validation, prepared database statements, access restrictions, and rate limits to protect form information. Access is limited according to operational needs. No system or transmission is guaranteed completely secure, and these measures are not a promise that a breach can never occur. If we become aware of an incident requiring notice, we will provide notices as required by applicable law.

Privacy rights and requests

Depending on your location and the law that applies, you may be entitled to request access, a copy, correction, deletion, portability, restriction of processing, withdrawal of consent, or an objection to certain uses. Some US state laws also provide rights concerning sales, targeted advertising, sensitive information, authorized agents and appeals. We will not unlawfully discriminate for exercising applicable rights.

Use the contact form to submit a request. Choose access, deletion or privacy; explain your request without including sensitive identity documents. We may take proportionate steps to verify you or an authorized agent before disclosing or deleting information. We respond within applicable deadlines, explain any lawful refusal or extension, and provide an appeal route where required. To appeal, submit a privacy request and identify the prior response. You may also contact the relevant regulator.

International visitors and legal bases

Our store is operated for a US-focused audience. Information may be processed in the United States and other locations where service providers operate. Those locations may have different privacy rules. Where applicable law requires safeguards for international transfers, we use the legally required arrangements; visiting the site alone does not waive statutory privacy protections.

Where a legal-basis framework applies, processing may be based on your consent for marketing, steps necessary to enter or perform a purchase contract, compliance with legal obligations, or legitimate interests such as security, support and fraud prevention, subject to your rights. You may complain to a competent data-protection authority where that right applies.

Children

Purchases and marketing signup are intended for adults aged 18 or older. We do not knowingly solicit personal information from children under 13 or direct this storefront to them. If you believe a child provided information, use the contact form so we can investigate and delete it as appropriate. Do not submit information on behalf of a child through our marketing form.

Changes and contact

We may revise this policy as our operations or legal requirements change. We will update the effective date and provide additional notice or seek renewed consent when required. Changes do not retroactively authorize incompatible uses of information. For questions, requests or complaints, use the GoySlop contact form. You can also use the merchant contact details shown in your PayPal receipt for an order-related matter.