Privacy Policy

The data controller responsible for your personal information is MN Generation Inc., registered in Delaware, United States. For all privacy matters, including requests to exercise your rights, contact us at [email protected].

For EU residents, our representative under Article 27 GDPR can be reached at the same address. We do not currently appoint a Data Protection Officer because we do not meet the GDPR threshold for mandatory appointment, but our privacy team handles all enquiries within 30 days.

We collect the following categories of personal information:

We do not knowingly collect special-category data (health, biometric, genetic, racial, religious, sexual orientation, political opinions) and ask that you do not submit such information to us.

We process your personal information for the following purposes. For users in the EU/UK, the legal basis under GDPR Article 6 is shown in brackets.

• Fulfilling your orders — processing payment, shipping, returns, customer service (Art. 6(1)(b) — contract).
• Account management — authentication, password recovery, order history (Art. 6(1)(b) — contract).
• Fraud prevention & security — detecting unusual payment patterns, blocking abuse (Art. 6(1)(f) — legitimate interest in protecting our business and customers).
• Site analytics — understanding aggregate usage to improve UX and performance (Art. 6(1)(f) — legitimate interest; EU/UK visitors are given a cookie banner choice).
• Marketing emails & abandoned-cart reminders — sent only with your explicit opt-in (Art. 6(1)(a) — consent). You can withdraw consent at any time via the unsubscribe link.
• Legal compliance — tax records, accounting, responding to lawful requests (Art. 6(1)(c) — legal obligation).

We share personal information only with the following categories of recipients, and only to the extent necessary for the purpose:

We do not sell or rent your personal information to third parties, and we do not share it for cross-context behavioural advertising. Under the CCPA/CPRA, this means we do not “sell” or “share” your information as those terms are defined in California law.

We are headquartered in the United States and our primary servers and subprocessors (including Stripe) are located in the United States. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to the United States or any other country that has not received an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) (Decision 2021/914) and supplementary measures including encryption in transit and at rest, access logging, and contractual restrictions on subprocessor access.

A copy of the relevant SCCs is available on request from [email protected].

Subject to the laws applicable to you, you have the following rights in relation to your personal information:

• Access — request a copy of the personal information we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) — ask us to delete your data, subject to retention obligations above.
• Restriction of processing — ask us to pause certain processing while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format and/or have it transmitted to another controller.
• Object — object to processing based on legitimate interest, including marketing.
• Withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.
• CCPA/CPRA-specific (California) — right to know, right to delete, right to correct, right to opt out of sale or sharing (we do neither), right to limit use of sensitive personal information (we collect none), and right to non-discrimination for exercising any of these rights.
• Complain — lodge a complaint with your supervisory authority. EU residents: your local Data Protection Authority. UK: the Information Commissioner's Office (ico.org.uk). California: the California Privacy Protection Agency (cppa.ca.gov).

To exercise any of these rights, email [email protected] from the address associated with your account. We respond within 30 days (45 days under CCPA, extendable by 45 more for complex requests). We do not charge a fee unless the request is manifestly unfounded or excessive.

We protect your information using TLS 1.2+ in transit, AES-256 at rest, hashed and salted passwords (Argon2id), least-privilege access controls, automated dependency scanning and a Web Application Firewall in front of all customer-facing endpoints. Payment card data is never stored on our servers — Stripe handles tokenisation in their PCI-DSS Level 1 environment.

If we ever become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (GDPR Art. 33) and notify you directly without undue delay if the risk is high.

We use first-party cookies for cart persistence, login session, and self-hosted analytics (Umami). We do not use Google Analytics, Meta Pixel, TikTok Pixel or any third-party advertising trackers. See our full Cookie Policy for the complete list, the categories, and how to opt out.

Our services are not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe we have collected information from a child, contact us and we will delete it without delay.

We may update this Privacy Policy from time to time. Material changes will be notified to you by email (where you have provided one) and via a banner on the site for at least 30 days. The date at the top of this page always reflects the latest version.

For any privacy question or to exercise any of your rights, email [email protected]. For non-privacy matters (orders, returns, shipping), use [email protected] or the contact page.