Privacy Policy.

This policy explains how Cabana Filters, LLC, a Wyoming limited liability company (“Cabana”, “we”, “us”), collects, uses, discloses and keeps personal information when you use cabanafilters.com, take Doctor Merv’s air quality assessment, or subscribe to filter deliveries. It applies to consumers in the United States. We use California’s privacy law, the most demanding in the country, as our standard for everyone, whichever state you live in. Our partner portal for businesses has its own policy.

Your answers about allergies, asthma and immune health are also covered by our Consumer Health Data Privacy Policy, written for Washington’s My Health My Data Act and Nevada’s consumer health data law.

The short version

Notice at collection

This is our notice at collection. The assessment and the checkout link to it where they ask for your information.

• What we collect: identifiers (name, email, shipping address, IP address); customer records; your age range and the make-up of your household; information about your home; commercial information (your prescription, subscription, orders and payments); activity on our site; approximate location from your ZIP code and address; the prescription we infer from your answers; and two kinds of sensitive personal information: health information you give in the assessment, and your payment card, which Stripe collects for us. The full list is below.
• Why: to prescribe, sell and deliver your filters, charge for them, email you about your order, keep the site secure, and meet our legal obligations. More detail.
• Sold or shared? No. We do not sell personal information or share it for cross-context behavioral advertising.
• How long we keep it: see How long we keep it.
• Your rights: see Your privacy rights.

What we collect, why, and who receives it

These are the categories of personal information we have collected in the last 12 months, named as California law names them. “Service providers” are companies that process information for us, under contract, only to do work for us (see Who we disclose it to). How long we keep each kind is under How long we keep it.

Identifiers

• What: your first and last name, email address and shipping address; your IP address; the random ID in our cabana_quiz cookie; and the references Stripe gives us for your saved card and your payments.
• Source: you; your browser; Stripe.
• Why: to prescribe, sell and deliver your filters; to charge your card; to email you about your order; to keep the site secure.
• Disclosed to: Google Cloud (hosting); Postmark (your email address and first name, to send email); our manufacturing partner, EasyPost and the shipping carriers (name and shipping address, to pack and deliver your box); Stripe (shipping address, to calculate tax); Google Maps Platform (the address text you type, to suggest addresses); Google Fonts (your IP address, when your browser fetches our typefaces).

Customer records

• What: the records described in Cal. Civ. Code §1798.80(e): your name, shipping address and email address, and your payment card. You type your card into a form provided by Stripe, so it goes directly to Stripe: we never receive or store your full card number or security code.
• Source: you.
• Why: to take payment and deliver your order.
• Disclosed to: Stripe (your card); the service providers listed under Identifiers.

Characteristics of protected classifications

• What: your age range (for example 30–44); how many adults live in your home, how many children in each age group, and whether anyone elderly lives there. We ask for numbers only, never names or anything else about a child. Health conditions are also a protected characteristic; they are covered under sensitive personal information.
• Source: you, in the assessment.
• Why: only to prescribe your filters and work out how many your home needs. Never to decide what we charge you or whether we serve you.
• Disclosed to: Google Cloud (hosting) only.

Information about your home

• What: the kind of home you live in; your pets, what kinds and how many; whether anyone smokes in the home and whether you often keep the windows open; how many return-air vents your home has, the filter size for each and where each one is.
• Source: you, in the assessment.
• Why: to prescribe your filters and make a box that fits your vents.
• Disclosed to: Google Cloud (hosting); our manufacturing partner (the filter sizes and quantities in your box, not the reasons for them).

Commercial information

• What: the filter tier you lean towards and the one you confirm; your subscription and its schedule; the prices we quoted and charged, and the tax; each payment’s amount, date and outcome; your consent to automatic renewal; your shipments; any discount or partner code you used; and a record of the emails we sent you.
• Source: you; Stripe; our carriers; our own records.
• Why: to sell and deliver your filters, run your subscription, credit a partner whose code you used, and keep tax, accounting and consumer-protection records.
• Disclosed to: Google Cloud; Stripe (payment amounts); Postmark (the content of emails about your order); our manufacturing partner, EasyPost and carriers (what is in your box). A partner whose code you used sees only counts and totals: see Partner codes.

Internet or other electronic network activity

• What: our server logs of each request (IP address, browser user-agent, the page requested and the time), and your progress through the assessment. Unless you turn it off, your browser also reports how quickly each page loaded (the Core Web Vitals); that report holds the measurement, the page’s path, a random number for that one page view, and whether you are on a phone, tablet or desktop, and nothing that identifies you.
• Source: your browser.
• Why: to run the site securely, fix problems and make pages faster.
• Disclosed to: Google Cloud (hosting and logs) only.

Geolocation data

• What: approximate location only: the ZIP code and shipping address you give us, and the general area an IP address implies. We do not collect precise geolocation from your device.
• Source: you; your browser.
• Why: to deliver your box and calculate sales tax.
• Disclosed to: as for Identifiers.

Inferences

• What: your filter prescription: the filter tier (MERV rating) and how often your filters should be changed, which we work out from your answers.
• Source: drawn from your assessment answers.
• Why: to recommend and deliver the right filters. It is not used to profile you for any other purpose.
• Disclosed to: Google Cloud (hosting); our manufacturing partner (the filter tier in your box).

What we do not collect

We do not collect your phone number, date of birth, Social Security, driver’s license or other government ID numbers, biometric information, precise geolocation, employment or education information, or account passwords (there are no accounts to log in to). We do not buy personal information about you from anyone.

Sensitive personal information

We collect two kinds of sensitive personal information:

• Health information. The assessment asks whether anyone in your home has allergies (and to what: dust, pollen, pet dander or mold), asthma, or a compromised immune system. “None of the above” is always an answer, and you can skip these questions. We ask for your separate consent before you answer them, and you can withdraw it at any time. We use these answers only to choose your filter tier and change schedule, and to keep a record of what we recommended and why. They are stored by Google Cloud on our behalf and disclosed to no one else: not Stripe, not our manufacturing partner, not carriers, not partners. We never use them for advertising or marketing.
• Your payment card number and security code, which you type into Stripe’s form and Stripe keeps so that we can charge your subscription. We never receive them.

We use and disclose sensitive personal information only for the purposes permitted by Cal. Code Regs. tit. 11, §7027(m): to provide the goods you asked for, to process your payments, to keep our site secure and prevent fraud, and to meet our legal obligations. We do not use it to infer characteristics about you. Because we use it only for those purposes, California law does not require a “Limit the Use of My Sensitive Personal Information” link, and we do not show one: there is no other use to limit.

How we use personal information

• To prescribe your filters from your assessment answers.
• To take your order and your renewals, including charging your saved card on your schedule and calculating sales tax.
• To make and deliver your box, including the welcome letter in your first box, which uses your first name.
• To email you about your order and subscription: your email confirmation code, receipts, the confirmation of your subscription terms, a reminder before each renewal charge, a notice if a payment is declined with a secure link to update your card, and the links to confirm cancelling or deleting your data. We do not send marketing email.
• To credit a partner whose code you used.
• To answer your questions and requests, including privacy requests.
• To keep the site secure and working, including detecting and preventing fraud and abuse, and fixing errors.
• To meet legal obligations, such as keeping tax and accounting records and the record of your consent to automatic renewal.

We do not use personal information for targeted advertising, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We do not offer financial incentives in exchange for personal information.

Who we disclose it to

We disclose personal information only for a business purpose, to these service providers, which act on our behalf and under contract:

• Google Cloud hosts the website, our database and our logs, in the United States.
• Stripe processes payments, keeps your card for automatic renewals, screens payments for fraud, and calculates sales tax from your shipping address (Stripe Tax). Stripe may also use payment information for its own fraud prevention and legal compliance, as its privacy policy explains.
• Postmark delivers our emails.
• Google Maps Platform suggests addresses as you type yours. The characters you type are sent from our server, not your browser, so Google receives the text but not your IP address or any cookie of yours.
• Google Fonts serves the site’s typefaces. Your browser fetches them from Google, which therefore receives your IP address and browser details. Google Fonts sets no cookies.
• Our manufacturing partner, which packs your box, receives your name, your shipping address and what goes in the box. It does not receive your assessment answers.
• EasyPost and the shipping carriers receive your name, shipping address and the parcel’s details, to buy the label and deliver it.

Partner codes

Some discount codes belong to a partner, such as an HVAC contractor or a dealer. If you use one, your subscription is recorded as referred by that partner and the partner earns a commission on it. Partners see how many active subscriptions are credited to them and the commission they have earned. We do not give them your name, contact details, address or assessment answers.

Other disclosures

We may also disclose information when the law requires it, such as in response to a valid subpoena or court order; to protect the rights, property or safety of Cabana, our customers or others; or to a buyer or successor if Cabana’s business is merged, acquired or sold, in which case this policy continues to apply to the information transferred.

No sale, no sharing, and Global Privacy Control

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the past 12 months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We do not use personal information for targeted advertising or for profiling that produces legal or similarly significant effects. So there is no “Do Not Sell or Share” choice to make, and we do not show that link.

Global Privacy Control. We honor the Global Privacy Control (GPC) signal. If your browser sends it, we treat it as a request to opt out of sale and sharing for that browser (which we do not do in any case). We also switch off the one optional thing the site does, our anonymous performance measurement, and do not show the cookie banner. The signal takes priority over an earlier choice to accept. See our cookie policy.

How long we keep it

• An unfinished assessment expires 30 days after you last worked on it and is then deleted.
• Your household file (identifiers, assessment answers including health answers, information about your home, and your prescription) is kept while you have a subscription, and after that until you ask us to delete it.
• Your saved card is kept by Stripe while you have a subscription; deleting your data deletes it.
• Records of orders, payments, shipments and tax are kept for as long as tax and accounting laws require, generally 7 years. The record of your consent to automatic renewal is kept for at least 3 years, or 1 year after your subscription ends if that is longer. Both are kept after you cancel or delete your data, linked to a reference that no longer identifies you once your data is deleted.
• Server logs and performance measurements are kept for about 30 days.
• Records of privacy requests and how we answered them are kept for at least 24 months, as California law requires.
• Emails you send us are kept for as long as we need them to answer you and to keep a record of what we agreed.
• A link to update your card works once and expires after 14 days; a link to cancel or delete your data works once, for 24 hours.

Your privacy rights

California residents have these rights under the CCPA. We give the same rights to every consumer in the United States, whichever state you live in:

• Right to know and access. You can ask what personal information we have collected about you, the categories of sources, why we collected it, the categories of recipients, and the specific pieces of information we hold.
• Right to delete. You can ask us to delete personal information we collected from you, subject to the exceptions the law allows (for example, records we must keep for tax).
• Right to correct. You can ask us to correct inaccurate personal information.
• Right to portability. You can ask for a copy of your information in a portable, machine-readable format.
• Right to opt out of sale and sharing. We do not sell or share personal information, so there is nothing to opt out of. If you ask anyway, we record it.
• Right to limit the use of sensitive personal information. We use it only for the permitted purposes described above, so there is nothing to limit.
• Right to non-discrimination. We will not deny you goods, charge you a different price, or give you a different level of quality or service because you exercised a privacy right.

How to make a request

• To delete your data, use our delete my data form. It works on its own, without contacting us.
• For any other request (to know, access, correct or get a copy), or to delete by email, email darren@cabanafilters.com from the address you used with us, and say what you are asking for.

Cabana operates only online and deals with you directly, so, as California law allows (Cal. Civ. Code §1798.130(a)(1)(A)), we take requests by email and through our online form rather than by telephone.

Verifying your identity

We must make sure a request comes from you before we act on it. We do this by matching the email address you used with us: the delete form emails a single-use link to that address, and for emailed requests we reply to that address and may ask you to confirm your shipping address or a recent order. For a request for the specific pieces of information we hold, we may ask for one more detail that matches our records. We use what you give us only to verify you. If we cannot verify you, we will tell you why.

Authorized agents

You can have someone else make a request for you. We will ask the agent for your signed permission and may ask you to verify your own identity with us directly, unless the agent holds a power of attorney under California Probate Code §§4121 to 4130.

When we respond

We confirm that we have received a request within 10 business days and tell you how we will handle it. We answer within 45 calendar days. If we need longer, we will tell you why within those 45 days, and take no more than 45 days more. Requests are free, unless they are manifestly unfounded or excessive, in which case we will explain.

What deleting your data does

The delete my data form emails a link to the address you give us. It works once, for 24 hours, so nobody else can delete your data. When you confirm:

• we erase your assessment answers (including your health answers), your household details and your email address, and we delete your saved card from Stripe;
• your subscription is cancelled, because we cannot deliver to you without these details;
• if a box you have already paid for has not shipped yet, we keep your name and shipping address only until it ships, because its label needs them, and then erase them;
• we keep the records the law requires (orders, payments, shipments, tax, and your consent to automatic renewal), linked to a reference that no longer identifies you.

If you only want to stop deliveries and charges, cancel your subscription instead.

Your privacy rights in other states

Many states give their residents rights over personal information, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. Depending on where you live, you may have the right to:

• confirm whether we process your personal information, and access it;
• correct inaccuracies;
• delete it;
• get a copy in a portable format;
• opt out of the sale of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. We do none of these;
• in some states, get a list of the specific third parties we have disclosed personal information to.

We give these rights to every US consumer, and you use them as described under How to make a request. We treat Global Privacy Control as an opt-out signal wherever you live. We answer within 45 days, and may extend by another 45 days where the law allows, telling you why.

Appeals. If we decline your request, in whole or in part, you can appeal. Reply to our answer with the word “Appeal”, or email darren@cabanafilters.com with “Privacy appeal” in the subject. Someone who did not make the original decision will review it, and we will tell you the outcome and our reasons in writing within 45 days (60 days in Colorado and Minnesota). If you are not satisfied with the outcome, you can contact your state’s Attorney General; our answer will tell you how.

Health data. Residents of Washington and Nevada have further rights over consumer health data, described in our Consumer Health Data Privacy Policy.

California Shine the Light

California Civil Code §1798.83 lets California residents ask which personal information a business disclosed to third parties for their own direct marketing. We do not disclose personal information to third parties for their direct marketing purposes. You can still ask by emailing darren@cabanafilters.com.

Children

Cabana is for adults. The site is not directed at children, you must be 18 or older to order, and we do not knowingly collect personal information from anyone under 16. The assessment asks an adult how many children live in the home, by age group, and nothing more about them. If you believe a child has given us information, email darren@cabanafilters.com and we will delete it.

Security

We protect personal information with reasonable security measures suited to its sensitivity. It is encrypted in transit and at rest. Our database sits on a private network with no public address, and access is limited to the people and systems that need it. Card payments are handled entirely by Stripe. No system is perfectly secure; if a breach affected your information, we would notify you as the law requires.

Cookies

We use a small number of cookies the site needs to work, and no advertising or tracking cookies. The full list, and the choice you can make about performance measurement, is in our cookie policy.

Changes to this policy

If we change this policy, we will post the new version here and update the dates at the top. If a change is material, for example a new use of information we already hold, we will email you before it takes effect, and where the law requires your consent, we will ask for it first.

Contact us

For questions about this policy or your information, or to make a request, email darren@cabanafilters.com or write to Cabana Filters, LLC, 1309 Coffeen Ave., Suite 1200, Sheridan, WY 82801, USA.

If you have a disability and need this policy in another format, email darren@cabanafilters.com and we will provide it.