Privacy policy

Last updated: September 20, 2026

TuckTrail (“we”, “us”, “our”) sells pet travel carriers to customers in the United States and Canada through tucktrail.com. This policy explains what personal information we collect, how we use and share it, and the choices and rights you have. It applies to tucktrail.com and the emails we send.

Information we collect

You provide: name, shipping and billing address, email, phone, and order details when you shop, create an account, sign up for our newsletter, leave a review, or contact us. If you message us on WhatsApp, WhatsApp (Meta) processes those messages under its own privacy policy.
Automatically: device and browser information, IP address, approximate location (country, region, city), pages viewed, products viewed, items added to cart, checkout activity, and purchases — collected through cookies and similar technologies described in Cookies and Analytics & advertising below.
Payment: payments are processed by PayPal. Your card or PayPal details go directly to PayPal — we never receive or store full card numbers. PayPal handles your payment data under its own privacy statement.
Marketing attribution: first-party cookies record which channel (for example a Google ad or a search result) brought you to the store, so we know which marketing works.

How we use your information

To process and ship your orders and provide customer support.
To send order and account communications, invite you to review a purchase, and — only if you subscribe — send marketing emails you can unsubscribe from with one click.
To operate, secure, and improve our store, and to analyze traffic and shopping behavior.
To comply with legal obligations and prevent fraud.

Cookies

The cookies on tucktrail.com fall into four groups:

Essential — cart and checkout session cookies (WooCommerce). Always on; the store cannot function without them.
Preferences — your cookie choice itself (tt_consent, kept 180 days).
Analytics — anonymous visitor and session IDs for our self-hosted analytics (_tt_aid, 12 months; _tt_sid, 30 minutes) and first-party marketing-attribution cookies.
Advertising — Google cookies (for example _ga, _gcl_au) and Meta Pixel cookies (for example _fbp) used for ad measurement, attribution, personalization, and delivery.

On your first visit, a banner lets you accept or decline non-essential cookies. Declining turns off our own browsing analytics, Google advertising and analytics tags, and Meta Pixel; what we still record on an order itself is described under Analytics & advertising. You can change your choice anytime via the Cookie preferences link in the footer, and you can also control cookies through your browser settings.

Analytics & advertising

Our own analytics: we run self-hosted analytics on our own servers (no third party receives it) to count visits and understand shopping behavior. If you decline cookies, this browsing tracking is switched off — we stop recording the pages you view, and the visit records we keep carry no visitor ID, IP address, or location. Orders are the exception: whether or not you accept cookies, we attach to your order, on our own servers only, what we need in order to tell which channel produced the sale — a first-party visitor ID, the IP address and browser it was placed from, the page it came from, and any advertising click ID your browser was already carrying. We use this for our own measurement and bookkeeping; declining stops it from being shared with Meta or Google, and we share it with no other third party.
Google: like most online stores, we use Google Analytics and Google Ads tags for traffic measurement, conversion tracking, and ad personalization. This shares limited activity data (pages viewed, device identifiers, approximate location) with Google, which California law may treat as “sharing” for cross-context behavioral advertising — see Your privacy rights for how to opt out. You can also opt out directly via Google Ads Settings, the NAI opt-out page, or the DAA opt-out page.
Meta: we use Meta Pixel to share limited website event data with Meta, including pages viewed, products viewed, items added to cart, checkout activity, purchases, device and browser information, IP address, and approximate location. If you have given us your email address or phone number — for example by claiming a discount code, creating an account, or placing an order — we also include a hashed (irreversibly scrambled) copy with these events so that Meta can recognize the activity as yours; we never send Meta your email address or phone number in readable form. Meta may use this information to provide measurement services and to target and deliver ads. To opt out, click Decline on our cookie banner or reopen Cookie preferences; you can also use Meta’s off-Facebook activity controls, the NAI opt-out page, or the DAA opt-out page.
PayPal: PayPal’s scripts load on the store to render the payment buttons and help PayPal prevent fraud.

We honor Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a request to opt out of advertising “sharing”, and Google advertising tags and Meta Pixel are turned off regardless of your banner choice. We do not respond to older “Do Not Track” signals.

How we share information

We do not sell your personal information for money. We share it only in these situations:

Service providers: PayPal (payments), shipping carriers (name, address, and phone, for delivery), Zoho (sends our order, review-invitation, and newsletter emails), Cloudflare (content delivery, security, and the approximate-location lookup above), Google (analytics and advertising), and Meta (advertising measurement, attribution, personalization, and delivery) — each only as needed to provide its service.
Advertising measurement: the Google and Meta tools above may count as “sharing” under California law. You can opt out at any time — see below.
Legal: when required by law, or to protect our customers and our store from fraud or abuse.

Government and law-enforcement requests

Sometimes a government body or law-enforcement agency asks a business to hand over personal data. This is what we do when that happens.

We check that the request has a valid legal basis before we respond to it. If we believe a request is unlawful, overbroad, or made through the wrong channel, we do not simply comply — we challenge it or decline it.

When we do have to respond, we disclose the narrowest set of data the request actually requires, and nothing beyond it.

We keep a record of every request we receive: what was asked for, how we responded, the reasoning behind that decision, and whose data was involved.

Your privacy rights

Wherever you live, you can ask us to access, correct, or delete the personal information we hold about you, and you can unsubscribe from marketing emails at any time. To make a request, email [email protected] or use our contact form.

California (CCPA/CPRA): you have the right to know what we collect, to correct or delete it, to opt out of the “sale” or “sharing” of personal information, and not to be discriminated against for exercising these rights. We do not sell personal information for money. To opt out of ad-related “sharing”, click Decline on our cookie banner (reopen it via Cookie preferences in the footer), enable GPC in your browser, or email us.
Other US states (including Virginia, Colorado, Connecticut, Texas, and Oregon): you have similar access, correction, deletion, and opt-out rights. If we decline a request, you may appeal by replying to our response; if your appeal is unsuccessful, you can contact your state Attorney General.
Canada (PIPEDA / Québec Law 25): you may request access to and correction of your personal information. Our servers are located in the United States, so Canadian customers’ information is transferred to and processed in the US.

How we handle requests: we verify requests by matching them to the email address (and, if needed, an order number) we have on file, and we respond within 45 days or as otherwise required by law. An authorized agent may submit a request on your behalf with your written permission.

Data retention

Order and transaction records: up to 7 years, as required by tax and accounting rules. The marketing-attribution details attached to an order (see Analytics & advertising) are kept with that record.
Account data: until you delete your account or ask us to.
Analytics events: deleted after 24 months.
Newsletter subscription: until you unsubscribe.
Support correspondence: as long as needed to resolve your request.

Data security

The entire site runs over HTTPS, payments are handled end-to-end by PayPal, and access to customer data is limited to what running the store requires. We use reasonable technical and organizational measures to protect your data; no online service can guarantee absolute security. Our store and the systems behind it run on servers located in the United States, and your data is stored there.

Children

Our store is not directed to children under 13, and we do not knowingly collect their information. We also do not knowingly sell or share the personal information of anyone under 16.

Changes

We may update this policy from time to time; the “last updated” date reflects the latest version. If we make material changes, we will post a notice on the site.

Contact

Questions or requests about your privacy? Email [email protected] or use our contact form.

Mailing address: TuckTrail, No. 57 Huimin Road, Houjie Town, Dongguan, Guangdong 523960, China.