Privacy Policy.

This policy explains how Cabana Filters, LLC, a Wyoming limited liability company (“Cabana”, “we”, “us”), collects, uses, shares and keeps personal information when you use cabanafilters.com, take Doctor Merv’s air quality assessment, or subscribe to filter deliveries. It applies to customers in the United States. Our partner portal for businesses has its own policy.

Your answers about allergies, asthma and immune health are also covered by our Consumer Health Data Privacy Policy.

The short version

What we collect and why

• Your contact and delivery details: your first and last name, email address and shipping address. We use them to deliver your filters, charge for them and email you about your order.
• Your assessment answers: your age range; how many adults and children (by age group) live in your home, and whether anyone elderly does; the kind of home; your pets; whether anyone smokes or you often keep the windows open; your return-air vents, their filter sizes and where they are; and, if you choose to answer them, questions about allergies, asthma and immune health. We ask for numbers only about the people in your home, never names. We use these answers only to work out your filter prescription: the filter tier (MERV rating), how often to change your filters, and a box that fits your vents.
• Your order and subscription: the tier you choose, your subscription and its schedule, the prices and tax charged, each payment’s amount, date and outcome, your consent to automatic renewal, your shipments, any discount or partner code you used, and a record of the emails we sent you. We use these to run your subscription and to keep the tax and accounting records the law requires.
• Your payment card, which you type into a form provided by Stripe. It goes directly to Stripe; we never receive or store your card number or security code.
• Technical information: our server logs of each request (IP address, browser type, the page requested and the time), the random ID in our cabana_quiz cookie that saves your progress through the assessment, and, unless you turn it off, an anonymous report of how quickly each page loaded. We use these to run the site securely, fix problems and make pages faster.
• Clicks through to a retailer: when you press a button on our products page to buy at Amazon, Walmart or Target, we record the product, the retailer, the time, where on the page the button was, any campaign tags in the page’s address, the name of the website that sent you to us, and whether you are on a phone or tablet or a computer. No IP address. If you have started the assessment in this browser, and you have not rejected measurement or sent a Global Privacy Control signal, we link the click to your assessment. We use these records to understand which products and retailers our customers choose, and share them with no one. More in our cookie policy.

We do not collect your phone number, date of birth, government ID numbers, precise location or account passwords (there are no accounts to log in to), and we do not buy information about you from anyone. We do not send marketing email.

Your health answers

The assessment asks whether anyone in your home has allergies (and to what: dust, pollen, pet dander or mold), asthma, or a compromised immune system, one question per screen. You can answer yes or no, or skip any question. We save no health answer without your separate consent, which you give by ticking a box on the first health question, and you can withdraw it at any time with our withdraw consent form. We use these answers only to choose your filter tier and change schedule, and to keep a record of what we recommended and why. They are stored by Google Cloud on our behalf and given to no one else. Our Consumer Health Data Privacy Policy has the details.

Who receives it

We share personal information only with these companies, which work for us under contract and only to provide our service:

• Google Cloud hosts the website, our database and our logs, in the United States.
• Stripe processes payments, keeps your card for automatic renewals, screens payments for fraud, and calculates sales tax from your shipping address. Stripe may also use payment information for its own fraud prevention and legal compliance, as its privacy policy explains.
• Postmark delivers our emails (your email address, first name and the content of the email).
• Google Maps Platform suggests addresses as you type yours. The characters you type are sent from our server, not your browser, so Google receives the text but not your IP address or any cookie of yours.
• Google Fonts serves the site’s typefaces. Your browser fetches them from Google, which therefore receives your IP address and browser details. Google Fonts sets no cookies.
• Our manufacturing partner, which packs your box, receives your name, your shipping address and what goes in the box. It does not receive your assessment answers.
• EasyPost and the shipping carriers receive your name, shipping address and the parcel’s details, to buy the label and deliver it.

Partner codes

Some discount codes belong to a partner, such as an HVAC contractor or a dealer. If you use one, your subscription is recorded as referred by that partner and the partner earns a commission on it. Partners see how many active subscriptions are credited to them and the commission they have earned. We do not give them your name, contact details, address or assessment answers.

Other disclosures

We may also disclose information when the law requires it, such as in response to a valid subpoena or court order; to protect the rights, property or safety of Cabana, our customers or others; or to a buyer or successor if Cabana’s business is merged, acquired or sold, in which case this policy continues to apply to the information transferred.

We do not sell your information

We do not sell personal information, and we do not use or share it for advertising. We honor the Global Privacy Control (GPC) signal: if your browser sends it, we switch off our anonymous performance measurement, stop linking clicks through to a retailer to your assessment, and do not show the cookie banner. See our cookie policy.

How long we keep it

• An unfinished assessment expires 30 days after you last worked on it and is then deleted.
• Your details and assessment answers are kept while you have a subscription, and after that until you ask us to delete them.
• Your saved card is kept by Stripe while you have a subscription; deleting your data deletes it.
• Records of orders, payments, shipments and tax are kept for as long as tax and accounting laws require, generally 7 years. The record of your consent to automatic renewal is kept for at least 3 years, or 1 year after your subscription ends if that is longer. Both are kept after you cancel or delete your data, without your name, email address or other details that identify you.
• Server logs and performance measurements are kept for about 30 days.
• Records of clicks through to a retailer are kept while we use them to see which products and retailers our customers choose. Deleting your data removes their link to your assessment and household, and keeps only the anonymous count.
• Emails you send us are kept for as long as we need them to answer you and to keep a record of what we agreed.
• Backups of our database are replaced within days, and archived copies are deleted within 6 months, so information you delete is gone from every copy within 6 months.

Seeing, correcting and deleting your information

You can ask us, at any time and for free:

• to see the personal information we hold about you;
• to correct anything that is wrong;
• to delete it. We delete your name, email address, shipping address and assessment answers, including your health answers. The order, payment and tax records the law requires us to keep are kept without anything that identifies you.

We will not charge you more or treat you differently for asking.

How to make a request

• To delete your data, use our delete my data form. It emails a single-use link to the address you used with us, so nobody else can delete your data.
• To see or correct your information, or for anything else, email support@cabanafilters.com from the address you used with us and say what you are asking for. You can also ask to delete your data this way.

We reply to the address you used with us, so we know the request comes from you. We answer within 45 days.

If we refuse a request, reply to our email and we will reconsider it; if we still refuse, you may contact your state Attorney General.

What deleting your data does

The delete my data form emails a link to the address you give us. It works once, for 24 hours. When you confirm:

• we erase your assessment answers (including your health answers), your household details and your email address, and we delete your saved card from Stripe;
• from any return or claim you made, we erase what you wrote, your photos and the links we emailed you, and keep the claim’s type, dates, amounts, refunds and our decision with the order records;
• we remove the link between your assessment and any clicks you made through to a retailer, and keep only the anonymous count;
• your subscription is cancelled, because we cannot deliver to you without these details;
• if a box you have already paid for has not shipped yet, we keep your name and shipping address only until it ships, because its label needs them, and then erase them;
• we keep the records the law requires (orders, payments, shipments, tax, and your consent to automatic renewal), without anything that identifies you.

If you only want to stop deliveries and charges, cancel your subscription instead.

Children

Cabana is for adults. The site is not directed at children, you must be 18 or older to order, and we do not knowingly collect personal information from anyone under 16. The assessment asks an adult how many children live in the home, by age group, and nothing more about them. If you believe a child has given us information, email support@cabanafilters.com and we will delete it.

Security

We protect personal information with reasonable security measures suited to its sensitivity. It is encrypted in transit and at rest. Our database sits on a private network with no public address, and access is limited to the people and systems that need it. Card payments are handled entirely by Stripe. No system is perfectly secure; if a breach affected your information, we would notify you as the law requires.

Cookies

We use a small number of cookies the site needs to work, and no advertising or tracking cookies. The full list, and the choice you can make about performance measurement, is in our cookie policy.

Changes to this policy

If we change this policy, we will post the new version here and update the dates at the top. If a change is material, for example a new use of information we already hold, we will email you before it takes effect, and where the law requires your consent, we will ask for it first.

Contact us

For questions about this policy or your information, or to make a request, email support@cabanafilters.com.

If you have a disability and need this policy in another format, email support@cabanafilters.com and we will provide it.