PRIVACY POLICY
Effective date: September 9, 2026
NAT COS INC ("NAIPACHE," "we," "us," or "our") operates https://naipache.us/ and related Shopify-hosted storefront pages, including technical domains associated with https://naipache.myshopify.com/ (collectively, the "Site"). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit the Site, create an account, place or return an order, contact us, interact with advertising or analytics technologies, or use an AI shopping agent or other automated tool to interact with the Site.
This Policy is intended for customers and visitors in the United States. State-specific rights are described below and in our U.S. State Privacy Notice.
1. Who is responsible for your information
The merchant and seller is NAT COS INC. Our corporate mailing and legal contact address is 312 W 2ND STREET STE A9715, CASPER, WY 82601, United States. This address is not a customer return warehouse. Privacy questions and requests may be sent to contact@naipache.us.
The Site is hosted on Shopify. For some processing activities, Shopify acts as our service provider or processor; for other activities described in Shopify's applicable terms and privacy notices, Shopify acts as an independent data controller and determines its own purposes and means of processing. Payments on the Site are processed through Shopify Payments. Shopify and the applicable payment processors, financial institutions, payment networks, and fraud-prevention or compliance providers may process payment and transaction information as necessary to provide and secure the payment service and to satisfy applicable legal and payment-network requirements. We use Ecomflow for fulfillment and cross-border delivery and Return Helper for return management.
2. Personal information we collect
Depending on how you use the Site, we may collect the following categories of personal information:
- Identifiers and contact information, such as name, email address, telephone number, billing address, shipping address, account identifiers, and customer or order number.
- Commercial and transaction information, such as products viewed, items placed in a cart, purchases, order history, discounts, refunds, returns, exchanges, shipping method, and transaction status.
- Payment-related information, such as billing details, payment method type, transaction amount and currency, authorization or decline status, transaction identifiers, refund or dispute information, fraud or risk indicators, and limited card metadata (for example, card brand and the last four digits where made available through Shopify). Full payment-card credentials are entered into and processed through Shopify Payments and its applicable payment processors. NAT COS INC does not store full payment-card numbers or CVC/CVV values in systems we control.
- Account and authentication information, such as login details or authentication tokens processed through Shopify or other authorized account systems.
- Internet and device information, such as IP address, browser type, device identifiers, operating system, referring URLs, pages viewed, clicks, session activity, cookie or pixel identifiers, and approximate location derived from IP address.
- Communications, such as customer-service messages, emails, product questions, feedback, return requests, and records of communications with us.
- Return and logistics information, such as return reason, return status, label and tracking data, delivery status, package information, item-inspection results, and photographs of returned products where the return service records them.
- Advertising and analytics information, such as campaign identifiers, conversion events, audience segments, product interactions, and inferences used to measure or personalize advertising.
- AI and automated-shopping information, such as product-search requests, cart actions, checkout-session information, agent identifiers or technical logs, and other data necessary to respond to a user-authorized AI agent or Model Context Protocol (MCP)/Universal Commerce Protocol (UCP) interaction.
3. Sources of personal information
We collect personal information directly from you; automatically from your browser or device; from Shopify and Shopify Payments in connection with checkout, payment status, fraud prevention, refunds, chargebacks, or disputes; from applicable payment processors or financial partners where information is made available to us through Shopify; from Ecomflow and delivery partners; from Return Helper and return carriers; from advertising and analytics providers; and from AI agents or other services you authorize to interact with the Site on your behalf.
4. How we use personal information
We may use personal information to:
- operate, maintain, secure, personalize, and improve the Site;
- create and manage accounts, carts, checkouts, orders, returns, exchanges, and refunds;
- process payments and prevent fraud, abuse, chargebacks, and unauthorized transactions;
- calculate shipping, fulfill and dispatch orders from China, prepare shipping and customs documentation, complete customs clearance, provide tracking, and deliver orders in the United States;
- provide customer support and respond to requests;
- operate the Return Helper return process, including return authorization, labels, tracking, inspection, and refund decisions;
- support user-authorized AI shopping, product discovery, cart management, checkout creation, and authenticated account functions;
- perform analytics, attribution, conversion measurement, advertising, audience creation, and marketing;
- send transactional communications and, where you have subscribed or where permitted, marketing communications;
- comply with tax, accounting, customs, sanctions, consumer-protection, privacy, and other legal obligations; and
- establish, exercise, or defend legal claims and enforce our policies.
5. How we disclose personal information
We may disclose personal information to the following categories of recipients for the purposes described in this Policy:
- Shopify and its affiliates and service providers, which host and operate the ecommerce platform and related customer-account, checkout, security, analytics, and commerce services.
- Shopify, Shopify Payments, and their applicable payment processors, financial institutions, payment networks, fraud-prevention, identity-verification, and compliance providers as needed to process, authenticate, route, secure, refund, reconcile, and dispute payments and to comply with applicable payment-network and legal requirements.
- Ecomflow HK Limited, its warehouses, carriers, customs brokers, last-mile partners, and other logistics service providers for fulfillment, shipping, customs clearance, delivery, and tracking. Orders are fulfilled from China and shipped to the United States.
- Return Helper Service Limited, its return portal, warehouses, carriers, and logistics partners to authorize, route, receive, inspect, process, and report on returns.
- Provider privacy notices: Ecomflow privacy policy: https://ecomflow.com/privacy-policy. Return Helper privacy policy: https://www.returnhelper.com/privacy. These notices govern processing those providers perform as independent controllers; processing they perform on our behalf is also subject to our contracts and instructions.
- Shopify privacy notice: https://www.shopify.com/legal/privacy/consumers. Shopify may act as an independent controller for certain Shopify consumer services and other processing described in its privacy documentation.
- Advertising, analytics, attribution, and marketing providers described in Section 7 below.
- Professional advisers, insurers, auditors, accountants, attorneys, and other service providers that support our business.
- Government agencies, regulators, law enforcement, customs authorities, courts, or other persons when disclosure is required or permitted by law or reasonably necessary to protect rights, safety, or property.
- A buyer, investor, lender, successor, or other participant in a merger, acquisition, financing, restructuring, sale of assets, insolvency, or similar corporate transaction, subject to appropriate protections.
6. Payments and Shopify Payments
Payments on the Site are processed through Shopify Payments, Shopify's integrated payment service. When you submit payment information at checkout, Shopify Payments and its applicable payment processors may collect and process payment credentials and related transaction information through the Shopify checkout environment.
Depending on the payment method and transaction, payment-related information may include payment-card number, expiration date, CVC/CVV, billing details, transaction amount and currency, authentication information, device or security signals, fraud or risk indicators, authorization status, refunds, chargebacks, and dispute information. Full payment-card credentials are processed through Shopify Payments and its applicable payment processors. NAT COS INC does not store full payment-card numbers or CVC/CVV values in systems we control.
We may receive limited payment and transaction information made available through Shopify, such as payment status, payment method type, card brand and last four digits where available, transaction identifiers, refund or dispute information, and fraud-analysis indicators. Shopify, the applicable payment processors, financial institutions, payment networks, and fraud-prevention or compliance providers may process payment data to authorize and settle transactions, prevent fraud, administer refunds and disputes, comply with payment-network rules, and satisfy legal obligations such as sanctions or other financial-compliance requirements. For certain processing activities, Shopify or an applicable payment processor may process personal information for its own legal or compliance purposes under its own privacy notice.
For more information about how Shopify handles consumer personal data, please review Shopify's Consumer Privacy Policy at https://www.shopify.com/legal/privacy/consumers. The specific payment methods available to you are those displayed at checkout.
7. Advertising, analytics, pixels, and marketing technologies
We use cookies, pixels, tags, software development kits, server-side events, and similar technologies for analytics, advertising, attribution, audience measurement, and marketing. Depending on the configuration and your privacy choices, these tools may receive identifiers, cookie or device IDs, IP address, browser and device information, pages or products viewed, cart activity, purchase or conversion events, approximate location, and, in some cases, pseudonymized or hashed contact information.
The platforms and services we currently use include:
- Meta Platforms, Inc. (Facebook and Instagram): advertising targeting, conversion tracking, and audience analytics.
- Google LLC (Google Analytics, Google Ads, and DoubleClick): analytics, advertising targeting, attribution, and conversion measurement.
- Snap Inc. (Snapchat): advertising targeting and campaign measurement.
- TikTok: advertising targeting and conversion tracking.
- X (formerly Twitter): advertising targeting.
- Pinterest: advertising targeting and conversion measurement.
- RTB House: advertising targeting.
- Mixpanel: product and website analytics.
- Microsoft Advertising (Bing Ads): advertising targeting and conversion measurement.
- Impact: advertising, affiliate/partner attribution, and conversion tracking.
- Braze: marketing communications and related engagement measurement.
- UpSellit: advertising and conversion optimization.
- AddShoppers: advertising targeting and conversion measurement.
- Fitness Commerce: advertising targeting.
- Shopify Audiences: We do not currently use Shopify Audiences. If we begin using Shopify Audiences or another Shopify feature that relies on Shopify Network Intelligence for advertising audiences, we will update this Policy and implement applicable privacy notices and opt-out controls before using customer data for that purpose.
Affiliate / Influencer Disclosure
NAIPACHE may work with influencers, content creators, affiliates, brand ambassadors, and other marketing partners. Some promotional content may involve a material connection with NAIPACHE, including compensation, commissions, free products, discounts, gifts, or other benefits. We require sponsored, affiliate, or otherwise incentivized endorsements to be disclosed clearly and conspicuously in accordance with applicable Federal Trade Commission (FTC) advertising requirements. Disclosures may include clear terms such as “Ad,” “Sponsored,” “Paid partnership,” or an understandable affiliate-commission disclosure, as appropriate to the content and platform.
Affiliate and influencer partners must not make false or misleading statements about NAIPACHE products, prices, promotions, or services and must accurately describe any material connection with the brand.
User-Generated Content (UGC)
NAIPACHE may display or repost customer-created photos, videos, reviews, testimonials, social-media posts, or other user-generated content when we have permission, when content is submitted under applicable campaign or submission terms, or where use is otherwise permitted by law and platform rules. Reviews and testimonials reflect individual experiences and do not guarantee that every customer will have the same experience. We do not edit reviews or testimonials in a manner that materially changes their meaning.
We do not sell personal information for money. However, disclosures through advertising technologies may be considered a "sale," "sharing," or processing for "targeted advertising" under some U.S. state privacy laws. Where applicable, you may opt out through the Your Privacy Choices link in the Site footer or by using a legally recognized universal opt-out preference signal, such as Global Privacy Control (GPC).
8. Cookies and similar technologies
We and our service providers use cookies and similar technologies that are necessary to operate the Site, remember settings, understand use of the Site, measure performance, prevent fraud, and support advertising. More information is available in our Cookie & Tracking Technologies Policy.
Some browsers offer a legacy "Do Not Track" (DNT) setting. Because there is no uniform industry standard for DNT, the Site does not respond to legacy DNT signals. We do, however, honor GPC and other legally recognized universal opt-out preference signals where required by applicable law and where the signal is technically detected.
9. AI shopping agents, MCP/UCP, and automated access
The Site may permit user-authorized AI assistants or automated agents to search our public catalog and policies, retrieve product and availability information, create or modify a cart, estimate totals, create a checkout session, and direct a buyer to complete checkout. Authenticated access to customer account or order information must use appropriate authentication and authorization controls.
AI agents and MCP/UCP integrations are not intended to receive full payment-card numbers, CVC/CVV values, Shopify Payments credentials, Shopify administrative credentials, payment-processor credentials, Ecomflow credentials, or other unnecessary secrets. Payment is completed through the Shopify checkout using Shopify Payments. An AI agent may assist with a purchase only within the authority granted by the user and subject to the final order details shown before purchase.
10. Shipping, customs, and international processing
Orders are fulfilled from China for delivery to customers in the United States. To fulfill an order, we may transfer the information reasonably necessary for fulfillment, shipping, customs clearance, tracking, and delivery to Ecomflow, carriers, customs brokers, and related service providers in China, Hong Kong, the United States, and other countries involved in the route. Return information may be processed by Return Helper and its service providers in the United States, Singapore, China, Hong Kong, or other locations used for return logistics.
Privacy and data-protection laws in other countries may differ from those in your state. We use contractual, technical, organizational, and data-minimization measures designed to protect personal information appropriate to the nature of the processing.
11. Data retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to maintain your account, complete orders and returns, provide customer service, maintain accounting and tax records, prevent fraud and abuse, manage chargebacks and disputes, comply with customs and other legal requirements, enforce agreements, and protect legal rights. The retention period depends on the type of information, the purpose for which it was collected, legal requirements, and whether a dispute or investigation is pending.
Marketing contact information is retained until you unsubscribe or we no longer need it for the stated purpose, subject to maintaining a limited suppression record so we can respect your opt-out. Cookie and advertising identifiers are retained in accordance with the applicable tool settings, our configuration, and your privacy choices.
12. Security
We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, least-privilege practices, secure transmission, vendor management, logging and monitoring, and incident-response procedures appropriate to the nature of the data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
13. Your U.S. privacy rights
Depending on your state of residence and whether the applicable law applies to us, you may have rights to: confirm whether we process your personal information; access or obtain a copy; correct inaccuracies; delete certain information; obtain portable data; opt out of sale, sharing, or targeted advertising; opt out of certain profiling; obtain information about categories or specific third parties that received personal information where state law provides that right; and appeal certain decisions on privacy requests.
To exercise an access, correction, deletion, portability, third-party-list, or appeal right, email contact@naipache.us with the subject line "Privacy Request" and describe the right you want to exercise. We may need to verify your identity and request only information reasonably necessary for verification. If applicable law permits an authorized agent to submit a request for you, we may request proof of the agent's authority and may verify your identity directly.
To opt out of sale, sharing, or targeted advertising, use the clear and conspicuous “Your Privacy Choices” link in the Site footer. Our “Your Privacy Choices” page is intended to serve as our “Do Not Sell or Share My Personal Information” opt-out mechanism where applicable. Where required by applicable law, we will also treat a recognized GPC or similar universal opt-out signal as an opt-out request for the browser or device sending the signal.
We will not unlawfully discriminate against you for exercising applicable privacy rights. If we deny a request and applicable law provides a right to appeal, you may reply to our decision with the subject line "Privacy Appeal."
14. California-specific disclosures
California residents may have rights under the California Consumer Privacy Act (CCPA), as amended, if the law applies to our processing. Our U.S. State Privacy Notice includes a California Notice at Collection describing the categories of personal information collected, purposes, retention criteria, and categories that may be disclosed for cross-context behavioral advertising or otherwise treated as sale/sharing under California law.
For purposes of California law, we do not sell personal information for monetary consideration. Certain advertising-related disclosures may constitute sale or sharing under the CCPA. You may opt out through Your Privacy Choices or a recognized GPC signal. We do not knowingly sell or share personal information of consumers under 16 where affirmative authorization is required.
California "Shine the Light" law may provide certain customers with rights regarding disclosure of personal information to third parties for their own direct-marketing purposes. If applicable, you may submit a request to the email address listed below.
15. Sensitive personal information
We do not intentionally collect sensitive personal information for the purpose of inferring characteristics about you. Certain information necessary to provide services may be treated as sensitive under some laws, such as account credentials or payment-related information handled through Shopify and Shopify Payments. We use such information only as reasonably necessary to provide requested services, secure accounts and transactions, prevent fraud, process payments and refunds, resolve disputes, and comply with law. We do not use or disclose sensitive personal information for purposes that require a separate right to limit under California law.
16. Children and teens
The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13 without legally required parental consent. We do not knowingly sell or share the personal information of consumers under 16 or use it for targeted advertising where applicable law prohibits that activity or requires affirmative authorization.
17. Marketing communications
If you subscribe to marketing emails, you may unsubscribe at any time by using the unsubscribe link in the message. We may still send non-marketing communications about your orders, returns, security, account, or other transactions.
18. Changes to this Policy
We may update this Policy to reflect changes in our services, technology, vendors, legal requirements, or data practices. We will post the updated Policy on the Site and change the effective date above. If a change is material and applicable law requires additional notice, we will provide that notice.
19. Contact us
NAT COS INC
Corporate mailing and legal contact address: 312 W 2ND STREET STE A9715, CASPER, WY 82601, United States
Email: contact@naipache.us
Website: https://naipache.us/