We sell vinyl and leather repair products, not your personal information!
Effective date: October 30, 2026 (replaces the policy dated November 6, 2024)
Rub 'n Restore, Inc. ("we," "us," or "our"), PO Box 1149, Paonia, CO 81428, operates rubnrestore.com (the "Service"). This policy explains what personal data we collect when you visit our site, chat with our assistant, or buy from us; how we use it; who we share it with; and the choices you have. We are the data controller for the personal data described here.
We collect only what we need to sell and support our products. We do not sell your personal data for money, and we never have. Some of the advertising tools described in Section 3 may count as "sharing" or a "sale" under certain state privacy laws, and Section 10 explains how to opt out.
This policy covers rubnrestore.com and the emails, chat assistant, forms, and checkout that run on it. It does not cover our Amazon storefront, which is governed by Amazon's privacy notice, or third-party sites we link to. Terms not defined here have the meaning given in our Terms of Service.
1. Information We Collect
We collect three kinds of information: what you give us, what your browser sends automatically, and what our service providers pass back to us.
Information you provide
- Account and order details: name, email address, phone number, billing and shipping address, items ordered, and order history. Payment card numbers go directly to our payment processors (Section 6) and are never stored on our systems.
- Chat messages: anything you type into our chat assistant, including order numbers or email addresses you provide so it can look up your order (Section 4).
- Project Planner answers: your responses to our Project Planner (also called the quiz) and, if you provide one, your email address so we can send your results.
- Photos: images you upload for a Professional Consultation, Custom Color order, or product review.
- Reviews and comments: the text, star rating, name, and photos you submit with a product review or blog comment.
- Correspondence: emails, contact-form submissions, phone orders, and support requests.
- Newsletter sign-ups: your email address and any preferences you select.
Information collected automatically
- IP address, browser type and version, device type, operating system, and screen size
- Pages you view, products you look at, items you add to your cart, and the time and date of each visit
- The site, search engine, or ad that referred you to us ("order attribution")
- Cookie and pixel identifiers described in Section 3
Information from third parties
- Payment processors confirm whether a payment succeeded and flag suspected fraud.
- Shipping carriers return tracking status for your order.
- Our affiliate program records which affiliate link, if any, brought you to the site.
2. How We Use Information
We use personal data to run the store, support your project, and tell you about products you have shown interest in. Specifically, we use it to:
- Process, ship, and track your orders, and send order confirmations, shipping notices, and receipts
- Answer your questions by email, phone, or chat, and evaluate consultation or Custom Color requests
- Send Project Planner results and follow up on your project
- Send newsletters, promotions, abandoned-cart reminders, and review requests, unless you opt out
- Publish reviews and review photos you submit, with the name you provide
- Measure how the site is used, test page variations, and fix technical problems
- Measure whether our advertising works and show you relevant ads (Section 3)
- Pay affiliate commissions on referred sales
- Detect and prevent fraud, abuse, and security incidents
- Comply with the law, enforce our Terms of Service, and defend legal claims
Legal basis (EEA and UK visitors). We process your data to perform our contract with you (orders, support), with your consent (newsletters, cookies where consent is required), for our legitimate interests (site analytics, fraud prevention, defending claims) where those interests are not overridden by your rights, and to comply with legal obligations such as tax and accounting rules.
3. Cookies, Analytics, and Advertising Technologies
We use cookies, pixels, and similar tags for four purposes: to run the store, to measure how it is used, to measure and target advertising, and to send marketing email. The table lists the tools in use as of the effective date. We may replace a tool with another that serves the same purpose; the categories and your opt-out choices stay the same.
| Purpose | Tool | What it does | Opt out |
|---|---|---|---|
| Store operation | WooCommerce, Stripe fraud cookie, A/B testing cookie | Keeps your cart and session, remembers which page variation you saw, helps detect fraudulent payments | Required for checkout; blocking these may break the store |
| Order attribution | WooCommerce order attribution cookies | Records the search engine, ad, or site that referred you so we know which marketing works | Block first-party cookies in your browser |
| Analytics | Google Analytics 4 | Reports pages viewed, products browsed, and purchases in aggregate | Google Analytics opt-out add-on |
| Advertising | Google Ads conversion and remarketing tags | Records when a visitor who clicked a Google ad makes a purchase, and lets Google show our ads to people who visited our site | Google Ads Settings or browser tracker blocking (Section 9) |
| Advertising | OpenAI (ChatGPT Ads) measurement pixel | Records when a visitor who clicked our ad in ChatGPT makes a purchase. May send a hashed (scrambled, not readable) version of the email address you enter at checkout so OpenAI can match the purchase to the ad click | Browser tracker blocking (Section 9) |
| Marketing email | Klaviyo on-site tracking | Recognizes returning subscribers, records products viewed and carts abandoned, and powers the newsletter sign-up form | Unsubscribe from our emails, or block third-party cookies |
| Affiliate tracking | YITH Affiliates referral cookie | Credits the affiliate whose link brought you to us if you buy within the cookie's lifetime | Block first-party cookies in your browser |
We do not use Meta (Facebook), TikTok, Pinterest, or Microsoft advertising pixels. Links to our social media profiles in the footer are plain links and do not load those companies' tracking scripts.
You can set your browser to refuse all cookies or to alert you when one is set. If you refuse cookies, parts of the store, including checkout, may not work. Some of the advertising tools above receive your data before you reach our cookie controls; Sections 9 and 10 explain how to opt out of them.
4. Chat Assistant, Project Planner, and Photo Uploads
Ruben Restore chat. Our website chat assistant, Ruben Restore, is an automated AI assistant, not a person. It runs on the AI Engine plugin for WordPress, which is installed on our own server; the plugin's developer, Meow Apps, does not receive or store your messages. Messages you type, along with any order number or email address you provide so it can look up your order, are sent from our server to OpenAI, which generates the responses. OpenAI processes this data under its privacy policy and API data usage terms, which state that data submitted through its API is not used to train its models. We may route some requests to other AI providers, such as Anthropic, under equivalent terms. When you ask about an order, the assistant retrieves details from our store records (such as order status, items, and shipping information) and may include them in its reply.
We store chat transcripts, together with the IP address of the device used, on our server for 12 months; a daily task deletes anything older. We review transcripts to answer questions the assistant could not, to improve its accuracy, and to detect abuse. Do not type payment card numbers, government identification numbers, health information, or other sensitive personal data into the chat. If you want a transcript deleted sooner, email us (Section 12) with the approximate date and topic of the conversation.
Project Planner. Answers you submit to our Project Planner are stored with your email address, if you provide one, so we can send your results and follow up on your project. If you consent, we also add you to our newsletter.
Photos. Photos you upload for a Professional Consultation or Custom Color order are stored with your order record and used to evaluate your project. Photos you submit with a product review are published on our website alongside your review, together with the name you provide. We may use consultation and review photos in our marketing materials and educational content as described in Section 13 of our Terms of Service. Contact us if you would like a photo removed.
5. Email and Marketing Communications
We send two kinds of email: transactional messages you cannot opt out of while you have an open order (order confirmations, shipping notices, receipts, consultation replies), and marketing messages you can stop at any time.
Marketing email is sent through Klaviyo and includes our newsletter, special offers, reminders about items left in your cart, and requests to review a product you bought. Review requests may also be sent through our review platform, Revopic. You can unsubscribe using the link at the bottom of any marketing email or by emailing us. Unsubscribing stops marketing email within 10 business days; it does not stop transactional email about an order you have placed.
Klaviyo also records when you open an email or click a link in it, and connects that to your browsing on our site (Section 3) so we can send relevant offers. Klaviyo's handling of your data is described in its privacy notice.
We do not send marketing text messages. If we add text messaging in the future, we will ask for your separate consent first.
6. Payments, Shipping, and Order Fulfillment
Payments. We never see or store your full payment card number. When you check out, your card details go directly to the payment processor you choose, each of which is PCI-DSS compliant and governed by its own privacy policy:
- Stripe (cards, Apple Pay, Google Pay)
- PayPal
- Klarna (buy now, pay later)
- Authorize.net
- Helcim (phone orders)
Processors return to us only the last four digits of your card, the payment result, and fraud-risk signals.
Shipping. To deliver your order we share your name, shipping address, phone number, email address, and package details with our shipping platform, ShipStation, and with the carrier that delivers it (UPS or USPS). Carriers may send you delivery notifications under their own privacy policies.
Order records. Our store runs on WooCommerce and is hosted by Kinsta in the United States. We generate PDF invoices and packing slips, track order status, and send shipment-tracking updates using plugins installed on our own server. Phone orders are entered into the same system by our staff.
7. How We Share Information
We share personal data only with the categories of service providers below, and only as needed for them to do the job we hired them for. Each is bound by contract or published terms to use your data solely to provide its service to us. The named companies are those we use as of the effective date; we may switch to a different provider in the same category and will update this list at least once a year.
| Category | What they receive | Current providers |
|---|---|---|
| Hosting and site infrastructure | Everything stored on the site, including orders and chat transcripts | Kinsta (hosting), WordPress and WooCommerce plugins running on our server |
| Payment processing | Name, billing address, order total, card details (sent directly by your browser) | Stripe, PayPal, Klarna, Authorize.net, Helcim |
| Shipping and fulfillment | Name, address, phone, email, package contents | ShipStation, UPS, USPS |
| AI chat responses | Chat messages, and order details when you ask about an order | OpenAI; Anthropic may also be used |
| Email marketing and transactional email | Email address, name, order and browsing history, email engagement | Klaviyo; Revopic for review requests |
| Analytics and site testing | Pages viewed, device and browser data, purchases (in aggregate) | Google Analytics; an A/B testing plugin on our server |
| Advertising measurement and remarketing | Visit and purchase events, cookie identifiers, hashed email at checkout | Google Ads, OpenAI (ChatGPT Ads) |
| Affiliate program | Referral cookie, order total for commission | YITH Affiliates plugin on our server, and the affiliate who referred you (order amount only, no personal details) |
| Forms and spam filtering | Form submissions, IP address | Gravity Forms (on our server), spam-filtering plugins |
| Social media management | Public engagement statistics only | Metricool |
| Professional advisers | Only what a specific matter requires | Accountants, attorneys, insurers |
We also disclose personal data when the law requires it or when we believe in good faith that disclosure is necessary to comply with a legal obligation, protect our rights or property, investigate fraud or abuse, protect the safety of any person, or defend against legal claims. If the business is sold or merged, customer data would transfer to the new owner under this policy.
Law enforcement requests. We publish any government demands for user data that we are permitted to disclose in a note at the end of this policy. As of October 30, 2026, we have received no National Security Letters or similar orders with gag provisions.
International transfers. We are located in the United States and our providers store data in the United States. If you visit from outside the U.S., your data is transferred to and processed in the U.S., where privacy laws may differ from those in your country. Our EEA- and UK-facing providers rely on standard contractual clauses or equivalent safeguards for those transfers.
8. How Long We Keep Information
We keep order, consultation, and correspondence records for as long as we are in business, because customers often return years later needing help with the same furniture or vehicle, and those records let us pick up where we left off. Everything else is kept only as long as its purpose requires. You can ask us to delete any of it at any time (Section 10), and we will, except for records tax law requires us to keep.
| Data | Retention | Why |
|---|---|---|
| Order and invoice records | Indefinitely, unless you ask us to delete them (Section 10) | Tax and accounting rules, guarantee claims, reorders, and helping you with the same project years later |
| Chat transcripts and associated IP address | 12 months, deleted automatically each day | Support follow-up, assistant accuracy, abuse detection |
| Project Planner answers | On the site: only the most recent 200 submissions are kept, so each is overwritten within a few months. A copy emailed to us is kept with your correspondence | Project follow-up and product improvement |
| Consultation and Custom Color photos | Written evaluations: indefinitely, with your order record. Photos: deleted within 18 months | Evaluating and supporting your project |
| Review text and photos | Until you ask for removal or the product is discontinued | Published content you chose to share |
| Email marketing profile | Until you unsubscribe, then suppressed (not deleted) so we do not email you again | Honoring your opt-out |
| Analytics data | Google Analytics: 14 months; our server logs: 30 days | Site measurement and security |
| Advertising pixel data | Governed by Google's and OpenAI's own retention schedules | Ad measurement |
| Contact-form and email correspondence | Indefinitely, unless you ask us to delete it | So we can pick up where we left off if you come back needing help |
| Affiliate referral cookie | 30 days | Crediting the referring affiliate |
If you ask us to delete your data (Section 10), we delete everything on this list except records we must keep for tax or legal reasons, and we tell you which those are.
9. Your Choices
- Marketing email: click Unsubscribe in any marketing email, or email us.
- Cookies: adjust your browser settings; see Section 3 for the effect on checkout.
- Google Analytics: install the opt-out browser add-on.
- Google Ads personalization: turn it off in Google Ads Settings.
- Targeted advertising generally: use a browser or extension that blocks third-party trackers (for example Firefox in strict mode, Brave, or uBlock Origin). These block the Google Ads, OpenAI, and Klaviyo scripts on our site without affecting checkout.
- Chat: you are never required to use the chat assistant; every page has a contact link and our phone number is in the footer.
- Reviews and photos: email us to edit or remove a review or photo you submitted.
10. Your Privacy Rights
We extend the same rights to every customer, wherever you live. Depending on your state or country, these rights may also be guaranteed by law, including the Colorado Privacy Act, the California Consumer Privacy Act, and the EU and UK General Data Protection Regulations.
You may ask us to:
- Confirm whether we hold personal data about you and give you access to it
- Correct inaccurate or incomplete data
- Delete your data, subject to the legal retention exceptions in Section 8
- Provide a portable copy in a common machine-readable format
- Opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects (we do not profile in that sense)
- Withdraw consent you previously gave, such as for the newsletter
- Restrict or object to processing based on our legitimate interests (EEA and UK)
How to make a request. Email info@rubnrestore.com with "Privacy Request" in the subject line, call 888-704-5571, or write to PO Box 1149, Paonia, CO 81428. Tell us what you want and the email address you used with us. We may ask you to confirm your identity, usually by replying from that address or confirming a recent order detail. An authorized agent may submit a request on your behalf with written permission from you.
Timing. We respond within 45 days. If a request is complex, we may take up to 45 more days and will tell you why. We will not charge you for a request unless it is clearly excessive or repetitive, and we will never treat you differently for exercising your rights.
Appeals. If we deny your request, you may appeal by replying to our response within 60 days. We will answer your appeal within 45 days. If your appeal is denied, Colorado residents may contact the Colorado Attorney General; residents of other states may contact their state attorney general; EEA and UK residents may complain to their national data protection authority.
Do we sell personal data? We do not sell personal data for money. Under some state laws, letting Google Ads and OpenAI set advertising cookies on our site counts as "sharing" for targeted advertising or as a "sale." You can opt out of that as described below.
Opt-out preference signals. Our site does not currently detect Global Privacy Control (GPC) or Do Not Track (DNT) browser signals. To keep the advertising tools in Section 3 from loading, use a browser or extension that blocks third-party trackers (Section 9), or email us with "Privacy Request" in the subject line and we will confirm what we hold about you and delete it on request. We will update this section if we add GPC support; see globalprivacycontrol.org.
11. Security, Children, and Links
Security. We protect your data with HTTPS encryption on every page, access controls that limit who on our team can see customer records, and reputable hosting with regular backups and malware scanning. Payment card data never touches our servers. No method of transmission or storage is completely secure, so we cannot promise absolute security, but we will notify you and the relevant authorities as the law requires if a breach affects your personal data.
Children. Our products are sold to adults, and our site is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.
Links to other sites. Our site links to other websites, including our social media profiles, YouTube videos, and our Amazon storefront. Those sites have their own privacy policies, and we are not responsible for their practices.
12. Changes to This Policy and How to Reach Us
We review this policy at least once a year and whenever we add a tool that collects personal data in a new way. When we update it, we post the new version on this page and change the effective date at the top. If a change materially expands how we use or share your data, we will also post a notice on our site for at least 30 days. Swapping one provider for another in the same category (Section 7) is not a material change. Continued use of the site after a change means you accept the updated policy.
Contact us
- Email: info@rubnrestore.com (use the subject line "Privacy Request" for rights requests)
- Phone: 888-704-5571
- Mail: Rub 'n Restore, Inc., PO Box 1149, Paonia, CO 81428
- Web: Contact form
Government data requests disclosed: none to date.