Acorn HopeStories for healing hearts
Privacy Policy

How we handle your information.

Plain-language explanation of what we collect, why, and how you can control it.

Privacy Policy

theAcornbook.com

Effective Date: April 22, 2026 | Last Updated: April 22, 2026

Note: This document describes our privacy practices. It is not legal advice. For questions, contact us using the details in Section 13.

1. Introduction

This Privacy Policy explains how Acorn, LLC ("we," "us," "our") collects, uses, discloses, and protects personal information when you visit theAcornbook.com (the "Site"), purchase our book, or otherwise interact with us. By using the Site, you agree to this Privacy Policy. If you do not agree, please do not use the Site.

This policy is designed to comply with the EU and UK General Data Protection Regulation (GDPR/UK GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable privacy laws.

2. Who We Are (Data Controller)

For the purposes of the GDPR, the data controller is:

3. Information We Collect

We collect the following categories of information:

3.1 Information You Provide Directly

  • Identifiers: name, email address, postal/shipping address, phone number (optional).
  • Order information: items purchased, order history, and correspondence about your order.
  • Payment information: handled by our payment processor(s) — we do not store full card numbers on our servers. See Section 6.
  • Account information (if you create an account): username, password (stored in hashed form), preferences.
  • Communications: messages you send us through contact forms, email, newsletter signups, reviews, or social media.
  • Marketing preferences: your opt-in/opt-out choices for our newsletter or promotional emails.

3.2 Information Collected Automatically

  • Device and connection data: IP address, browser type and version, operating system, device identifiers, language settings, referring URL.
  • Usage data: pages viewed, time on page, clicks, scroll depth, search queries on the Site, dates/times of visits.
  • Location data: approximate location inferred from IP address (city/country level).
  • Cookies and similar technologies: see Section 7.

3.3 Information From Third Parties

  • Payment processors confirming transaction status.
  • Shipping carriers providing delivery status.
  • Analytics and advertising providers (e.g., aggregated or pseudonymous identifiers).
  • Social media platforms if you interact with our pages or log in via a social account.

3.4 Sensitive Personal Information

We do not intentionally collect sensitive personal information (as defined under CCPA/CPRA or GDPR special categories). If you choose to submit such information (for example, in a message to us), we will treat it with appropriate care and limit its use to the purpose for which you provided it.

4. How We Use Your Information

We use your information for the following purposes:

  • To process and fulfill orders, including payment, shipping, and customer service.
  • To create and manage your account (if applicable).
  • To communicate with you about orders, updates to this policy, and service-related announcements.
  • To send marketing emails and newsletters where you have opted in, with an unsubscribe link in every message.
  • To operate, maintain, and improve the Site, including analyzing usage and troubleshooting.
  • To prevent fraud, enforce our Terms of Use, and protect the security and integrity of the Site.
  • To comply with legal obligations, respond to lawful requests, and defend legal claims.

5. Legal Bases for Processing (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following legal bases under Article 6 GDPR:

  • Contract (Art. 6(1)(b)): to process your order, deliver the book, and provide customer support.
  • Legal obligation (Art. 6(1)(c)): for tax, accounting, and regulatory recordkeeping.
  • Legitimate interests (Art. 6(1)(f)): to operate and secure the Site, prevent fraud, and analyze aggregated usage to improve our services — balanced against your rights and freedoms.
  • Consent (Art. 6(1)(a)): for marketing emails, non-essential cookies, and any optional data collection. You may withdraw consent at any time without affecting prior processing.

6. How We Share Your Information

We do not sell your personal information for money. We share information only as described below:

6.1 Service Providers (Processors)

We share information with trusted third parties who perform services on our behalf under written data-processing terms. Typical categories include:

  • Payment processor: Stripe — to process card and digital payments. See stripe.com/privacy.
  • Shipping and fulfillment: national postal and courier services (e.g., USPS, UPS) and print-on-demand providers used for physical copies.
  • Email: standard email services used to respond to inquiries and, where you have opted in, send occasional updates.
  • Analytics: Google Analytics 4 (provided by Google LLC) — to understand aggregate Site usage. See policies.google.com/privacy.
  • Hosting and security: our website host and security/CDN providers.

6.2 Legal and Safety Disclosures

We may disclose information when we reasonably believe disclosure is necessary to comply with a law, regulation, subpoena, or court order; to enforce our Terms; to detect or prevent fraud or security issues; or to protect the rights, property, or safety of us, our users, or others.

6.3 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. We will notify you (e.g., by email and/or a prominent notice on the Site) of any change in ownership or use of your personal information.

6.4 With Your Consent

We may share information for other purposes with your explicit consent.

6.5 "Sharing" Under CCPA/CPRA

California law defines "sharing" broadly to include disclosures for cross-context behavioral advertising. If we engage in such sharing (for example, through advertising cookies), we will provide a "Do Not Sell or Share My Personal Information" link on our Site and honor Global Privacy Control (GPC) signals. See Section 10.

7. Cookies and Similar Technologies

Cookies are small text files stored on your device. We and our service providers use cookies, pixels, SDKs, local storage, and similar technologies (collectively, "Cookies") to operate the Site, remember your preferences, analyze usage, and — where you consent — deliver relevant marketing.

7.1 Categories of Cookies We Use

  • Strictly necessary: required for core functions such as shopping cart, checkout, login, and security. These cannot be switched off.
  • Functional / preference: remember language, currency, and display preferences.
  • Analytics / performance: help us understand how visitors use the Site in aggregate (e.g., which pages are popular).
  • Marketing / advertising: used to measure campaign performance and, where applicable, show you relevant ads on other sites. Only set with your consent.

7.2 Third-Party Cookies

Some Cookies are set by third parties, including Google Analytics (analytics) and Stripe (checkout and fraud prevention). Those parties are responsible for their own cookie use under their own policies.

7.3 Your Cookie Choices

  • Cookie banner: EEA/UK/Swiss visitors see a consent banner on first visit and can accept, reject, or customize non-essential Cookies. You can change your choice at any time via our "Cookie Preferences" link in the footer.
  • Browser controls: most browsers let you block or delete cookies in settings. Blocking strictly-necessary cookies may break parts of the Site.
  • Opt-out tools: for interest-based advertising, you can use industry tools such as youronlinechoices.eu (EU/UK), optout.aboutads.info (US DAA), and optout.networkadvertising.org (NAI).
  • Global Privacy Control: we treat a valid GPC browser signal as a request to opt out of "sale" and "sharing" under CCPA/CPRA.

7.4 Do Not Track

Because there is no industry-standard response to "Do Not Track" (DNT) browser signals, we do not currently respond to DNT signals. We do honor Global Privacy Control as described above.

8. Data Retention

We keep personal information only as long as necessary for the purposes described in this policy, to comply with legal obligations (e.g., tax and accounting — typically 7 years under U.S. federal and Colorado recordkeeping guidance), to resolve disputes, and to enforce our agreements. When data is no longer needed, we delete or anonymize it.

Typical retention windows:

  • Order and transaction records: as required by applicable tax law (commonly 6–7 years).
  • Account data: until you delete your account, plus a short archive period.
  • Marketing contacts: until you unsubscribe or request deletion.
  • Analytics data: typically retained in aggregated/pseudonymous form; identifiable logs are kept no longer than 14 months (the Google Analytics default).

9. International Data Transfers

We are based in the United States, and some of our service providers are located in other countries. Where we transfer personal information from the EEA, UK, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and UK Addendum / Swiss equivalents where applicable), and supplementary measures as needed. You may request a copy of these safeguards by contacting us.

10. Your Privacy Rights

10.1 EEA, UK, and Swiss Residents (GDPR)

Subject to limited exceptions, you have the right to:

  • Access the personal information we hold about you and receive a copy.
  • Rectify inaccurate or incomplete personal information.
  • Erase your personal information ("right to be forgotten").
  • Restrict processing in certain circumstances.
  • Object to processing based on legitimate interests or direct marketing.
  • Data portability: receive your data in a structured, commonly used, machine-readable format.
  • Withdraw consent at any time where processing is based on consent.
  • Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects (we do not engage in such processing).
  • Lodge a complaint with your local supervisory authority. A list is available at edpb.europa.eu. UK residents may contact the ICO (ico.org.uk).

10.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

  • Know what personal information we collect, use, disclose, and "sell" or "share."
  • Access a copy of the personal information we have collected about you in the past 12 months (and, on request, further back).
  • Delete personal information we have collected, subject to exceptions.
  • Correct inaccurate personal information.
  • Opt out of the "sale" or "sharing" of personal information, including via a "Do Not Sell or Share My Personal Information" link and Global Privacy Control.
  • Limit the use and disclosure of sensitive personal information (we do not use sensitive personal information for purposes requiring this right, but you may still submit a request).
  • Non-discrimination: we will not deny goods or services, charge different prices, or provide a different level of quality because you exercised a privacy right.

Categories Collected and Disclosed (last 12 months)

  • Identifiers (name, email, address, IP): collected from you and automatically; disclosed to payment, shipping, hosting, email, and analytics providers.
  • Commercial information (purchases): collected from you; disclosed to payment and fulfillment providers.
  • Internet/network activity (browsing, cookies): collected automatically; disclosed to analytics and, if enabled, advertising providers.
  • Geolocation (approximate): collected automatically; disclosed to analytics providers.
  • Inferences (preferences): created internally; not sold.

Authorized Agents

You may use an authorized agent to submit a request; we may require proof of the agent's authorization and verify your identity directly.

10.3 Other U.S. State Rights

Residents of other U.S. states with comprehensive privacy laws (including, as of the effective date, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others) have similar rights to access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale, or certain profiling. You may exercise these rights using the contact details in Section 13.

10.4 How to Exercise Your Rights

To exercise any of these rights, email us at michele@theacornbook.com with the subject line "Privacy Request." We will verify your identity (for example, by matching information you provide against our records) before fulfilling the request and will respond within the timeframes required by applicable law (generally 30 days under GDPR; 45 days under CCPA, extendable once).

11. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including TLS encryption in transit, access controls, and reputable service providers. However, no method of transmission or storage is 100% secure. You are responsible for keeping your account password confidential. If you believe your information has been compromised, contact us immediately at michele@theacornbook.com.

12. Children's Privacy

The Site is not directed to children under 16 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it. Parents and guardians in California may also request deletion under CCPA.

13. Contact Us

Questions, requests, or complaints about this Privacy Policy? Contact us:

If you are not satisfied with our response, EEA/UK residents may contact their local supervisory authority, and California residents may contact the California Privacy Protection Agency (cppa.ca.gov) or Attorney General (oag.ca.gov).

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top and, where required by law, provide additional notice (for example, by email or a banner on the Site). Your continued use of the Site after changes take effect constitutes acceptance of the updated policy.