Privacy Policy

Pepper & Moss is a retail brand operated by D & L Army Surplus, LLC, a limited liability company registered in the State of Washington, United States, with its place of business at 801 Benton Way, Wenatchee, WA 98801. D & L Army Surplus, LLC ("we," "our," or "us") owns and operates the website pepperandmoss.us (the "Site") and is the business responsible for the personal information described in this Privacy Policy.

This Privacy Policy explains what information we collect when you visit the Site, place an order, subscribe to our email list, or contact customer service; why we collect it; who we share it with; how long we keep it; and what choices you have. It applies to the Site and to email we send you. It does not apply to third party websites we link to, such as Instagram, which have their own policies.

1. Information You Give Us

You provide most of this information directly, and in every case you can see what you are typing before you send it:

• Order information. Your name, email address, shipping address, billing address and phone number. We need these to accept an order, print a label and contact you if something goes wrong with delivery.
• Payment information. Card and PayPal details are entered on PayPal's own checkout, not on our servers. We receive a transaction identifier, the amount, the payment status and the billing name and address. We never receive your full card number, expiry date or security code, and we cannot see them at any point.
• Customer service messages. Anything you write to us through the contact form or by email, including photographs you attach to a damage or defect claim.
• Email subscription. Your email address if you subscribe to our newsletter, plus the date you subscribed.
• Order lookup. Your order code and email address when you use the Track Order page.

2. Information Collected Automatically

• Log data. Our web server records the IP address, browser type and version, operating system, the pages requested, the time of each request and the referring URL. This is standard server logging and is used for security, fraud prevention and diagnosing errors.
• Cookies and local storage. See section 5 for the full list and what each one does.

We do not use device fingerprinting, we do not buy personal information from data brokers, and we do not combine your activity here with data from other sites.

3. How We Use Your Information

• To accept, process, pack and ship your order, and to give the carrier the address it needs
• To send transactional email: order confirmation, shipping confirmation with tracking, refund confirmation, and replies to your questions
• To handle returns, refunds, replacements and warranty claims
• To send marketing email about new designs and seasonal restocks, only if you subscribed, and only until you unsubscribe
• To detect and prevent fraudulent orders, chargeback abuse and attacks against the Site
• To keep the records that tax, accounting and consumer protection law require us to keep
• To understand, in aggregate, which pages and products people look at, so we can decide what to make next

We do not use your personal information to make automated decisions that produce legal or similarly significant effects about you.

4. Who We Share It With

We do not sell your personal information, we do not rent it, and we do not share it for cross context behavioural advertising. We disclose it only to the categories of recipient below, only for the purposes listed, and only to the extent each one needs:

• PayPal (payment processing). Receives the order amount, currency, your billing details and the payment method you chose. PayPal acts as its own controller for that data under its own privacy policy.
• Shipping carriers: USPS, UPS, FedEx. Receive the recipient name, shipping address, phone number where required for delivery, and parcel details.
• Email and hosting providers. Store the Site and deliver our transactional and marketing email on our instructions, under contract, and may not use your data for their own purposes.
• Professional advisers. Our accountant and, if ever needed, our lawyers, under a duty of confidentiality.
• Legal and safety. Law enforcement, regulators or courts where we are legally required to disclose, and where necessary to establish, exercise or defend legal claims, or to protect the rights and safety of our customers.
• Business transfer. If the business or its assets are ever sold or reorganised, customer records may transfer to the buyer. You would be told before your information became subject to a different privacy policy.

5. Cookies and Similar Technologies

The Site uses a small number of cookies and browser storage entries. All of them are strictly necessary or functional; none of them are advertising cookies.

What	Purpose	Lifetime
Cart storage	Remembers the items in your cart and any order note between pages and visits, so your cart is still there when you come back	Until you clear it or clear your browser storage
Cookie choice	Records whether you accepted or declined the cookie banner, so you are not asked on every page	Until cleared
Session and security	Keeps a checkout session consistent and protects form submissions from abuse	Session

We do not currently run Google Analytics, Meta Pixel, TikTok Pixel, advertising retargeting or any other third party tracker on this Site. If we add analytics or advertising measurement in the future, this section will be updated to name the provider and describe the data before it starts collecting anything. You can refuse cookies with the Decline button on the banner, or block them in your browser settings; the cart may then stop remembering items between pages, which is the only function that breaks.

6. Marketing Email

We only send marketing email to people who asked for it. Every marketing message has a working unsubscribe link at the bottom, unsubscribing takes effect immediately, and we do not ask you why. Unsubscribing from marketing does not stop transactional email about an order you have actually placed, because we still have to tell you when it ships.

7. How Long We Keep It

• Order records: seven years from the order date, which is the period our tax and accounting obligations require
• Customer service messages: two years from the last message in the thread
• Marketing subscribers: until you unsubscribe, plus a suppression record so we do not accidentally add you back
• Server logs: ninety days

When a retention period ends, the record is deleted or anonymised.

8. Security

The entire Site is served over HTTPS. Payment card data never touches our systems because PayPal collects it on its own pages. Administrative access to order records requires a separate password protected login and is limited to the people who fulfil and support orders. No method of transmission or storage is perfectly secure, so we cannot promise absolute security, but we can promise that we do not store what we do not need.

9. Your Rights

Wherever you live, you can ask us to:

• Know what personal information we hold about you and what we have done with it
• Access a copy of it in a portable format
• Correct anything that is inaccurate, such as a misspelled address
• Delete it, except records we are legally required to keep, such as completed order and tax records
• Opt out of marketing email at any time

California residents (CCPA/CPRA). In the preceding twelve months we collected the categories of information described in sections 1 and 2: identifiers, customer records, commercial information about your purchases, and internet activity limited to our own server logs. We collected them for the business purposes in section 3 and disclosed them to the categories of recipient in section 4. We did not sell or share personal information, and we have no financial incentive programme, so there is nothing for you to opt out of. You may still exercise your rights to know, access, correct, delete and to non discrimination for exercising them.

Residents of Colorado, Connecticut, Virginia, Utah, Texas and other states with comprehensive privacy laws. You have equivalent rights of access, correction, deletion, portability and appeal. If we refuse a request you may appeal by replying to our decision, and we will respond to the appeal in writing.

Residents of the United Kingdom and the European Economic Area. We currently sell and ship only within the United States, so we do not target or knowingly process data of people in the UK or EEA. If you contact us from there, we process your message on the basis of our legitimate interest in answering it, and you keep the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your supervisory authority.

10. How to Exercise a Right

Use the contact form or write to us at the postal address at the end of this policy, and tell us which right you want to exercise. We will acknowledge within 10 business days and respond substantively within 45 days, extendable once by a further 45 days if the request is complex, in which case we will tell you why before the first period ends. To protect your data we will verify your identity by matching the request against details of an order you placed, for example the order code and the email address used at checkout. We do not charge for this, and an authorised agent may act for you with written permission.

11. Children

The Site is intended for adults. We do not knowingly collect personal information from anyone under 13, and we do not knowingly sell products to them. If you believe a child has given us personal information, contact us and we will delete it.

12. International Transfers

We store data in the United States. If you order from outside the United States, or contact us from outside it, your information will be processed in the United States under United States law.

13. Changes to This Policy

If we change this policy we will update the "Last updated" date at the top of this page. If a change materially affects how we use information we already hold, we will say so on this page and, where the law requires it, notify subscribers by email before the change takes effect.

14. Contact