Legal

Privacy Policy

Effective Date: July 25, 2026  |  Last Updated: July 25, 2026

BottomBinky ("we," "us," or "our") operates bottombinky.com (the "Site"). We understand that privacy is not just a legal checkbox for you — it's personal. This is an adult boutique, and what you buy, browse, and communicate is your business. This Privacy Policy explains exactly what data we collect, why we collect it, how we protect it, who we share it with, and the rights you have over it.

We will never sell your personal information. We do not share your purchase history, browsing data, or contact details with any data broker, advertiser network, or third-party marketing platform.

1. Information We Collect

1.1 Information You Provide Directly

  • Contact information — name, email address, phone number (optional), when you create an account, place an order, or contact support
  • Shipping information — recipient name, street address, city, state, ZIP/postal code, country
  • Account credentials — email and hashed password if you create an account
  • Order information — products purchased, quantities, pricing, promo codes, shipping method selected
  • Payment information — processed securely by our authorized PCI-DSS compliant payment processor. Your card number, CVV, and expiration date are transmitted directly to the processor via their encrypted checkout and are never stored on our servers
  • Communications — messages you send via our contact form, support email, or customer service channels
  • Waitlist submissions — email address provided before launch, used only to notify you when the store goes live

1.2 Information Collected Automatically

  • Device and browser data — IP address, browser type, operating system, screen resolution, device type
  • Usage data — pages visited, time on page, click patterns, search queries within the store, referral source, exit pages
  • Age verification data — a cookie confirming you verified you are 18+ (no date of birth is collected or stored)
  • Cart data — items you add to your cart are stored in your browser's localStorage, not on our servers
  • Cookies and similar technologies — see Section 6 for details

1.3 Sensitive Personal Information

Because we sell adult products, certain data we collect is especially sensitive under privacy laws like the CCPA/CPRA:

  • Purchase history — the specific products you buy may reveal information about your sexual preferences, practices, and personal interests
  • Browsing behavior — categories you browse, products you view, and search terms you use within the store

We treat this information with heightened care. Purchase and browsing history is never shared with third parties except where strictly necessary to fulfill your order (see Section 4). We do not use this data to build a profile of your sexual preferences for advertising, marketing, or any purpose beyond order fulfillment and internal site improvement.

2. How We Use Your Information

2.1 Core Business Purposes

  • Order processing and fulfillment — routing your order to our dropship partner (Nalpac) for packing and shipping. Only your name and shipping address are transmitted — not the product names or your purchase history
  • Payment processing — transmitting transaction details to our payment processor for authorization and settlement
  • Order communications — sending order confirmation, shipping updates, tracking numbers, and delivery notifications
  • Customer support — responding to your inquiries, processing returns and exchanges, resolving disputes
  • Age verification — confirming you are 18 or older before granting access to the store
  • Security and fraud prevention — detecting and preventing fraudulent orders, chargebacks, and unauthorized access
  • Legal compliance — meeting our obligations under federal, state, and international law

2.2 Analytics and Improvement

  • Aggregated, anonymized analytics to understand site traffic patterns, popular categories, and conversion rates
  • We use Google Analytics 4 (GA4) with IP anonymization enabled. GA4 receives anonymized usage data; we have configured it to not receive personally identifiable information

2.3 Marketing Communications

  • We may send promotional emails about new products, sales, or educational content only if you opt in by providing your email and checking a consent box
  • Every marketing email includes a one-click unsubscribe link
  • We do not send unsolicited marketing communications to customers who have not opted in
  • We do not share your email address or contact information with any third party for their marketing purposes

3. Discreet Billing and Shipping

3.1 Discreet Billing

All charges on your credit card or bank statement appear under a discreet descriptor — not as "BottomBinky" or any name that identifies the nature of the purchase. The billing descriptor will appear as "BB Online" or similar neutral identifier. Payment is processed by our authorized payment processor, a PCI-DSS compliant provider.

3.2 Discreet Shipping

All orders ship in plain, unmarked packaging:

  • Standard brown boxes or padded mailers with no branding, logos, or markings that indicate the contents
  • Return address shows "BB Online" — not BottomBinky
  • No product images or descriptive text on the exterior
  • Customs declarations (for international orders) use generic product descriptions such as "novelty item" or "personal care product"

3.3 Order Packing

Orders are packed by our dropship partner, Nalpac, a professional distribution warehouse. Packing staff see a shipping label and product SKU — they do not have access to your account information, purchase history, or payment data.

4. How We Share Your Information

We share the minimum information necessary with the following categories of recipients:

  • Our payment processor — receives transaction amount, billing address, and card data (transmitted directly from your browser to the processor; we never see or store your full card number). Subject to the processor's own privacy policy.
  • Nalpac (fulfillment partner) — receives your name, shipping address, and the product SKUs to pack and ship. They do not receive your email address, phone number, payment information, or purchase history. Subject to Nalpac's data handling policies.
  • Google Analytics — receives anonymized, aggregated usage data. IP addresses are truncated before processing. Subject to Google's Privacy Policy.
  • Service providers — email delivery, web hosting (cPanel/WHM), and DNS/SSL providers. Each operates under a data processing agreement and receives only the data necessary for their function.
  • Legal authorities — only when required by valid legal process (subpoena, court order, or law enforcement request). We will notify you of the request unless prohibited by law.

We do not share your information with: data brokers, advertising networks (beyond anonymized GA4 data), social media platforms, or any third party for their own commercial purposes.

5. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy:

  • Order records — retained for 7 years for tax, accounting, and legal compliance, then permanently deleted
  • Account data — retained while your account is active. You may request deletion at any time (see Section 10). Deleted data is purged within 30 days, except where retention is required by law
  • Waitlist emails — retained until we send the launch notification, then deleted within 90 days unless you create an account
  • Support communications — retained for 2 years for quality assurance and dispute resolution
  • Browsing/cart data — stored in your browser's localStorage, not on our servers. Clearing your browser data removes this information
  • Server logs — IP addresses and request data retained for 30 days for security and troubleshooting, then automatically purged

6. Cookies and Tracking Technologies

6.1 Cookies We Use

  • Essential cookies (cannot be disabled):
    • bb_age_verified — confirms you passed the age gate. HttpOnly, 365-day expiration. Does not contain personal data.
    • PHPSESSID — session management for contact form CSRF protection. Deleted when you close your browser.
  • Analytics cookies (Google Analytics 4):
    • _ga, _ga_* — anonymous usage statistics. 14-month expiration. Can be disabled via Google's opt-out tool.
  • Preference cookies:
    • Theme and language preferences if set by the user. Can be cleared in your browser settings.

6.2 Managing Cookies

You can disable non-essential cookies in your browser settings without affecting your ability to browse the store or place orders. Essential cookies are required for age verification and form security.

6.3 Do Not Track

We respect Do Not Track (DNT) signals. If your browser sends a DNT header, we do not set non-essential cookies.

7. Age Verification and Adult Content

This website contains adult content and is intended solely for individuals 18 years of age or older (or the age of majority in your jurisdiction, whichever is higher). By accessing this site and making a purchase, you confirm you meet this age requirement.

  • We use a cookie-based age gate — you click "Yes, I'm 18+" to proceed. We do not collect your date of birth.
  • We reserve the right to refuse service to anyone we believe to be a minor and to cancel orders where we suspect the purchaser is under 18.
  • If we become aware that a minor has submitted personal information, we will delete it immediately.

8. Children's Privacy (COPPA)

This website is not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. The Children's Online Privacy Protection Act (COPPA) imposes requirements on websites directed to children under 13. Because our site is restricted to adults 18+, COPPA does not apply to our operations. However, as stated above, if we learn that a minor has submitted personal information, we will delete it immediately and take steps to prevent future collection from that individual.

9. Data Security

We implement industry-standard security measures to protect your personal information:

  • Encryption in transit — all connections use TLS 1.3 with HSTS enabled
  • Server security — SSL certificates, firewall rules, and regular security scans
  • Access controls — admin panel protected by bcrypt-hashed passwords, IP whitelisting, and CSRF tokens
  • Payment security — card data never touches our servers; all payment processing handled by our authorized PCI-DSS compliant payment processor
  • Data minimization — we collect only the data necessary for the purposes described in this policy
  • Regular audits — security configurations reviewed periodically

9.1 Data Breach Notification

In the event of a data breach affecting your personal information, we will:

  • Investigate and contain the breach immediately
  • Notify affected users within 72 hours of discovery via email (if we have your email) and/or a prominent notice on this Site
  • Notify applicable regulatory authorities where required by law
  • Provide details about what data was affected, what we're doing to fix it, and what steps you should take

10. Your Privacy Rights

10.1 Rights for All Users

  • Access — request a copy of the personal data we hold about you
  • Correction — request correction of inaccurate or incomplete data
  • Deletion — request deletion of your personal data (subject to legal retention requirements)
  • Portability — receive your data in a structured, machine-readable format
  • Opt-out — unsubscribe from marketing communications at any time via the unsubscribe link in any email or by contacting us
  • Withdraw consent — withdraw any consent you previously gave at any time

10.2 California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, California residents have additional rights:

  • Right to know — the categories and specific pieces of personal information we collect, the sources, the purpose, and the third parties we share it with
  • Right to delete — request deletion of your personal information
  • Right to opt out of sale or sharing — we do not sell or share your personal information for cross-context behavioral advertising. No action needed.
  • Right to limit use of sensitive personal information — your purchase and browsing history is used only for order fulfillment and internal improvement, not for any secondary purpose. You may request we limit further use by contacting us.
  • Right to non-discrimination — we will not discriminate against you for exercising any privacy right

Categories of personal information we collect (per CCPA): identifiers (name, email, address), commercial information (purchase history, order data), internet activity (browsing data, search queries), and inferences (limited; we do not build preference profiles).

Categories of sensitive personal information (per CPRA): purchase history that may reveal sexual preferences. We use this solely for order fulfillment and do not use it for any purpose that would require opt-in consent under CPRA.

10.3 EU and UK Residents (GDPR)

If you are located in the European Union or United Kingdom, you have rights under the General Data Protection Regulation (GDPR) and the UK GDPR:

  • Lawful basis — we process your data under: (a) contract (order fulfillment), (b) legitimate interests (security, fraud prevention), and (c) consent (marketing). You may withdraw consent at any time.
  • Right to access, rectify, erase, restrict, port, and object — as described above
  • Right to lodge a complaint — with your local data protection authority or the ICO (UK)

International data transfers: If you are outside the United States, your data is processed on servers located in the US. By using this site, you consent to the transfer of your data to the US. We do not transfer data to countries without adequate data protection safeguards.

10.4 Other State Privacy Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy laws have similar rights to those described above. To exercise any right, contact us at privacy@bottombinky.com. We will respond within 45 days.

10.5 Exercising Your Rights

To exercise any privacy right, email privacy@bottombinky.com with:

  • Your full name and email address associated with your account
  • The specific right you wish to exercise
  • Any relevant details to help us locate your data

We will verify your identity before processing your request and respond within 45 days (30 days for California residents). We do not charge a fee for processing privacy requests, unless the request is excessive or unfounded.

11. Third-Party Links

Our site may contain links to third-party websites (e.g., our payment processor, RTA labeling, social media). We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party site you visit.

12. State Law Notice

Adult product sales are subject to varying state and local laws. We do not ship to jurisdictions where the sale of adult novelties is prohibited by law. If you reside in a jurisdiction with restrictions on adult product purchases, you are responsible for ensuring your order complies with local law. We reserve the right to refuse or cancel orders shipped to restricted jurisdictions.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do:

  • We will update the "Last Updated" date at the top of this page
  • Material changes will be announced with a prominent notice on the homepage for at least 30 days
  • Continued use of the site after the effective date constitutes acceptance of the updated policy
  • If we materially reduce your rights, we will obtain your consent before the change takes effect

14. Contact Us

Questions, concerns, or privacy requests? We're here to help:

This Privacy Policy is provided for informational purposes and does not constitute legal advice. If you have specific legal concerns about your data, we recommend consulting with a qualified privacy attorney.