Privacy Notice

Last updated: Oct 9, 2026

This notice explains what personal information PAPA YES collects, how we use and share it, and the rights and choices you have. It applies to our website at https://papa-yes.com and to your account, orders and other dealings with us.

PAPA YES is run by PAPA YES, , whose registered office is at . In this notice, "we", "us" and "our" mean PAPA YES.

The short version

We collect the information you give us when you join and shop, and some information automatically when you use our website.
We use it to run your account and orders, keep PAPA YES safe, help you when you contact us and, unless you opt out, measure and improve our advertising.
We don't sell personal information for money. We do share some information with Meta for advertising, which some state laws treat as "sharing" or "targeted advertising". You can opt out at any time on our Do Not Sell or Share My Personal Information page, and we honor Global Privacy Control signals.
We don't take card payments on our website, so we never see or store your card details.
Loan offers are optional. If you choose to apply for one, the details you enter are sent, with your consent, to a lead network that passes them to lenders. We are not a lender.
If you apply for store credit, we also collect your income, employment, bank and ID details (including your Social Security number). We keep the most sensitive numbers encrypted and only until your application is decided.
You can ask to see, correct or delete your information through our contact form.

Information we collect

Information you give us

Account details: your name, email address, phone number, address, date of birth and password. We store your password only in hashed (scrambled) form.
Monthly income: where we ask for it when you join.
Store credit applications: if you apply for pre-approved store credit, your address, phone numbers, income and pay dates, employer, bank account details, Social Security number, driver's license number and whether you're on active military duty. See Applying for store credit.
Messages: what you tell us when you use our contact form or write to us, including complaints and privacy requests.
Loan applications (optional): if you choose to apply for a loan offer, the details you enter. These can include your Social Security number, bank account and routing numbers, employment and income details, and driver's license number. See Optional loan offers below.

Information created when you use PAPA YES

Orders and store credit: what you order, cancellations and returns, and your store credit balance and history.
Referrals: your referral link, the friends who join through it and the rewards you earn.
Your choices and consents: for example, whether you've opted out of sharing for advertising or agreed to share information with a lending partner, with the date and the wording you agreed to.

Information we collect automatically

Device and usage information: your IP address, browser and device type, the pages you view and how you use our website.
Cookies and similar technologies: small files and tags that keep you signed in, remember your choices and referrals and, unless you opt out, help us measure our ads. Our Cookies & Tracking page lists them.
Campaign information: if you reach us through an ad or a link, the campaign tags in that link (such as "utm" tags) and whether you came from a Facebook or Google ad click.

Information from other people and organizations

Our payments partner: when you set up a weekly payment plan, our payments partner tells us how much store credit to add to your account, along with details such as your name, contact details and a plan reference. If your account was set up for you through our payments partner, they gave us the details needed to create it.
Lending partners and the lead network: the outcome of any loan application you make and, if you've agreed to it, whether a lending partner has an offer for you.
Friends: if you join through a friend's referral link, we record that they referred you.

How we use your information

To run your account and orders: creating and managing your account, adding store credit, and processing, delivering, cancelling and returning orders.
To check you can join: using your date of birth to confirm you're at least 18.
To keep in touch: sending order updates, account messages (such as email confirmations and password resets) and replies to your questions and complaints.
To keep PAPA YES safe: preventing fraud and misuse (such as duplicate accounts or referral abuse), protecting accounts and our website, and keeping a log of staff access.
To run our refer-a-friend program: recording referrals and adding rewards.
To improve PAPA YES: understanding how our website is used and which ads and links bring people to us, and fixing problems.
Monthly income: where we ask for it, to help us show you options and offers that may suit you.
For advertising: measuring how our ads perform and building advertising audiences with Meta, unless you opt out. See Advertising and Meta.
Loan offers, only if you ask: sending your details to a lending partner or the lead network with your consent, and keeping a record of the outcome and of your consent.
To meet our legal obligations: keeping records, responding to lawful requests, and establishing or defending legal claims.

Advertising and Meta

We may use the Meta Pixel on our website and Meta's Conversions API, which sends information from our server to Meta. We use them to measure how our ads on Meta's platforms, such as Facebook and Instagram, perform and to build advertising audiences.

When these are switched on, Meta may receive:

the pages you view and actions you take, such as joining, adding items to your cart and placing an order (including the products, order value and order reference);
your IP address and browser details;
Meta's cookie identifiers and the click ID from any Meta ad you clicked; and
if you're signed in, your email address, phone number, name, city, ZIP code, country and customer ID number. All of these are hashed (converted into a scrambled code) before they're sent, and Meta uses the hashed versions to match activity to Meta accounts.

How Meta uses this information is covered by Meta's Privacy Policy.

Under California law, this is "sharing" personal information for cross-context behavioral advertising. Under Texas law, it is "targeted advertising". You can opt out at any time:

on our Do Not Sell or Share My Personal Information page; or
by turning on Global Privacy Control (GPC) in your browser or with a browser extension. We treat a GPC signal as an opt-out for that browser.

When you opt out, we stop running the Meta Pixel and stop sending your information to Meta for advertising from that browser. If you're signed in when you opt out, we save your choice to your account and apply it whenever you sign in on another device.

Our loan offer and eligibility pages are never tracked for advertising.

Applying for store credit

When you apply for pre-approved store credit, we use the details you give us to verify your identity, set up your weekly payment plan with our payments partner and decide whether to activate your credit.

Who sees them: our payments partner, which sets up and collects your weekly payments, receives your details through a secure connection. Our staff see only the last four digits of your Social Security and bank account numbers.
How we protect them: your Social Security number, bank account and routing numbers and driver's license number are encrypted with a key kept separately from our database, and every time they're read is logged.
How long we keep them: we delete those numbers as soon as your application is activated or declined, and in any case within 30 days if it hasn't been decided. We keep the outcome, your other answers and a record of your consent for as long as your account is open and then as needed for legal purposes.
Version 2 of our application may also offer you a one-tap check for loan offers at the end. If you tap it, the details you've given are sent to the lead network as described in Optional loan offers.

Optional loan offers

PAPA YES does not make loans and is not a lender. Loan offers are optional, and you don't need one to shop with us.

When you join: we may ask whether you'd like us to share your name, email address and phone number with a lending partner so they can check whether you may be eligible for a loan offer. We only share them if you say yes.
If you apply for a loan offer: the details you enter are sent securely to a lead network, which passes them to lenders and lending partners so they can consider your application. These can include your Social Security number, bank account and routing numbers, employment and income details, and driver's license number. We only send them with your consent.
What we keep: we don't keep your Social Security number, bank account or routing number, or driver's license number after sending them. We keep the outcome of your application and a record of your consent. We may also keep your other answers so we can refill the form if your application needs correcting.
After that: the lead network's and each lender's own privacy policies apply to how they use your information, and lenders may contact you about your application.

We share personal information only as described in this notice:

Service providers that help us run PAPA YES and may use it only to provide their services to us, such as our website hosting provider and our email delivery provider (Mailgun).
Fulfilment and delivery partners, so your order can be prepared and delivered to you.
Our payments partner, which runs weekly payment plans and handles all real-money payments, so it can set up and manage your plan and so we can add the right store credit.
Meta, for advertising and measurement, unless you opt out.
Lending partners and the lead network, only if you agree, as described in Optional loan offers.
Professional advisers and authorities: our lawyers, accountants and insurers. We also share information with courts, regulators or law enforcement where the law requires it, or where it's needed to protect the rights, property or safety of our customers, us or others.
A new owner or operator: if PAPA YES or our business is reorganized, sold or transferred (for example, to a US company), your information may be transferred too, and it will continue to be handled in line with this notice.

Some of the product information on our website comes from Google Shopping data supplied through DataForSEO. This doesn't involve any of your personal information.

How long we keep information

We keep personal information only for as long as we need it for the purposes in this notice, including legal, tax and accounting requirements and dealing with disputes. In practice:

Account, order and store credit records: for as long as your account is open, and afterwards for as long as we need them for legal, tax, accounting and dispute purposes.
Messages and complaints: for as long as we need them to deal with your message and keep a record of how we handled it.
Device, usage and campaign information: for as long as we need it for security and to measure our advertising. Cookie lifetimes are listed on our Cookies & Tracking page.
Loan and store credit applications: we delete Social Security, bank account and routing, and driver's license numbers once your store credit application is decided (and within 30 days if it isn't), and we don't keep them from a loan application made through our loan form after sending them. We keep the outcome, your consent records and your other answers for as long as we need them to show what you agreed to and to deal with questions or disputes.
Privacy requests: records of your request and our response for at least 24 months, as the law requires.

How we protect your information

Our whole website uses https, so information passing between your browser and our website is encrypted.
Passwords are stored in hashed form, so they can't be read, even by our staff.
Staff access to our systems is logged.

No website or system can be completely secure. Please use a strong password that you don't use anywhere else. If you think someone else has used your account, tell us straight away through our contact form.

Where your information is processed

PAPA YES serves customers in the United States, but our team and some of our service providers are based in, or access information from, other countries, including the United Kingdom. Wherever your information is processed, we protect it as described in this notice.

Children

PAPA YES is only for people aged 18 or over. We don't knowingly collect personal information from anyone under 18. If you think a child has given us personal information, please tell us through our contact form and we'll delete it.

Your choices

Advertising: opt out on our Do Not Sell or Share My Personal Information page, or use Global Privacy Control.
Marketing emails: if we send you marketing emails, you can unsubscribe at any time using the link in each one. We'll still send you messages about your account and orders.
Cookies: our Cookies & Tracking page explains how to control them.
Do Not Track: some browsers send a "Do Not Track" signal. There's no agreed standard for how websites should respond to it, so we don't treat it as an opt-out. Please use Global Privacy Control instead, which we do honor.
Loan offers: sharing with lending partners is always optional. To withdraw a consent you've given us, use our contact form. This won't affect information already sent, so please contact the lender or lead network directly about information they already hold.

Your privacy rights

Wherever you live in the US, you can ask us to:

tell you what personal information we hold about you and give you a copy;
correct personal information that's inaccurate;
delete your personal information. We may need to keep some of it, for example to complete an order, meet legal obligations or prevent fraud, and we'll tell you if so; and
stop selling or sharing your personal information for advertising.

Some states give you additional rights, explained in Your US state privacy rights.

We won't discriminate against you for using your privacy rights. For example, we won't refuse you service, charge you a different price or give you a lower level of service because you made a request.

How to make a privacy request

Use our contact form and choose "Privacy request"; or
write to us at .

Verifying your identity: to protect your information, we'll check your identity before acting on a request to access, correct or delete it. Usually we'll ask you to sign in or to confirm details we already hold. We'll only use the information you give us for this to verify your request. You don't need to verify your identity to opt out of selling or sharing.

Using an authorized agent: you can ask someone else to make a request for you. We'll ask the agent for proof that you've given them signed permission, and we may ask you to confirm your identity directly with us, unless the agent has a valid power of attorney.

How long it takes: we'll respond within the time the law allows. For example, that's 45 days under California and Texas law. If we need more time, we'll tell you why within that period, and we may extend it once by up to 45 more days where the law allows. We act on requests to opt out of selling or sharing as soon as we can, and within 15 business days.

Appeals: if we decline your request, in whole or in part, we'll explain why. You can appeal by using our contact form, choosing "Privacy request" and saying you'd like to appeal. We'll respond within 60 days and explain our decision. If you're not happy with the outcome, you can contact your state Attorney General.

Your US state privacy rights

Some states give their residents specific privacy rights. Here's how they apply to PAPA YES.

California (CCPA/CPRA)

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to:

Know what personal information we've collected about you, where it came from, why we use it and who we disclose it to, and get a copy of it;
Delete personal information we've collected from you, subject to some legal exceptions;
Correct inaccurate personal information;
Opt out of the sale or sharing of your personal information, including sharing for cross-context behavioral advertising;
Limit the use of sensitive personal information. We only use sensitive personal information (such as your password or the details in an optional loan application) for purposes the law allows, such as providing the service you asked for, so there's nothing further to limit; and
Not be discriminated against for using these rights.

Sale and sharing in the last 12 months: we don't sell personal information for money. We share identifiers, commercial information and internet activity with Meta for cross-context behavioral advertising, unless you opt out. When you ask us to, we disclose information to lending partners and the lead network at your direction. We don't knowingly sell or share the personal information of anyone under 16.

The categories of personal information we collect, where they come from, why we use them and who we disclose them to are set out in this notice, including the Notice at collection below.

Shine the Light: California residents can ask us about personal information we've disclosed to third parties for their own direct marketing purposes in the previous calendar year. Use our contact form, choose "Privacy request" and mention "Shine the Light".

You can make a request as explained in How to make a privacy request. You can also contact the California Privacy Protection Agency or the California Attorney General.

Texas (TDPSA)

If you live in Texas, the Texas Data Privacy and Security Act gives you the right to:

confirm whether we process your personal data, and access it;
correct inaccuracies in it;
delete personal data you've provided or we've obtained about you;
get a copy of personal data you've given us, in a portable format where technically feasible; and
opt out of targeted advertising, the sale of personal data, and profiling that has legal or similarly significant effects.

We process personal data for targeted advertising with Meta, as described in Advertising and Meta. You can opt out on our Do Not Sell or Share My Personal Information page or with Global Privacy Control.

If we decline your request, you can appeal as described in How to make a privacy request. If you're unhappy with the outcome of your appeal, you can contact the Texas Attorney General.

Florida

Florida's main consumer privacy law, the Florida Digital Bill of Rights, applies mainly to very large businesses. Whether or not it applies to us, Florida residents can use all the rights described in Your privacy rights, including opting out of targeted advertising and sale. You can also contact the Florida Attorney General.

Other states

If you live in another state with a consumer privacy law, you may have similar rights. Contact us and we'll handle your request in line with the law that applies to you.

Notice at collection

This summary tells you what personal information we collect, why, whether it's sold or shared, and how long we keep it. "Sold" means disclosed for money or other valuable consideration. "Shared" means disclosed for cross-context behavioral advertising.

We collect this information from you, automatically from your device, from our payments partner, from lending partners and the lead network (outcomes only), and from referral links.

Identifiers

Examples: name, email address, phone number, postal address, account and customer ID, IP address, cookie IDs and ad click IDs.
Why we collect it: to run your account and orders, communicate with you, keep PAPA YES secure, run referrals and measure our advertising.
Sold: No.
Shared: Yes, with Meta for advertising, unless you opt out. Your email address, phone number, name, city, ZIP code and customer ID are hashed first.
How long we keep it: while your account is open, then for as long as needed for legal, tax, accounting and dispute purposes.

Customer records (California Civil Code section 1798.80)

Examples: name, address and phone number; monthly income where we ask for it; and, if you apply for store credit or a loan offer, bank account and routing numbers, employment details and driver's license number.
Why we collect it: to run your account, to set up and activate store credit you apply for, and, if you ask us to, to send your loan application.
Sold: No. Application details go to our payments partner to activate your credit, and to the lead network only at your direction, with your consent.
Shared: only your name, phone number, city and ZIP code, in hashed form, as described under Identifiers.
How long we keep it: as for Identifiers. Bank account and routing numbers and driver's license numbers are deleted once a store credit application is decided (within 30 days at most), and aren't kept from loan form applications after they're sent.

Age

Examples: date of birth.
Why we collect it: to confirm you're at least 18.
Sold: No.
Shared: No.
How long we keep it: while your account is open, then for as long as needed for legal purposes.

Commercial information

Examples: orders, cancellations and returns, store credit balance and history, and referral history.
Why we collect it: to run your account and orders, help you, prevent fraud and run referrals.
Sold: No.
Shared: Yes, with Meta unless you opt out: joining, add-to-cart and order events, including products and order value.
How long we keep it: as for Identifiers.

Internet or other electronic network activity

Examples: browser and device type, pages viewed, how you use our website, and campaign tags.
Why we collect it: to keep our website secure and working, improve it and measure our advertising.
Sold: No.
Shared: Yes, with Meta unless you opt out. Never from our loan offer and eligibility pages.
How long we keep it: for as long as needed for security and measurement. Our Cookies & Tracking page lists cookie lifetimes.

Professional or employment information

Examples: employment and income details, only if you apply for a loan offer.
Why we collect it: to send your loan application to the lead network at your request.
Sold: No. Disclosed only at your direction, with your consent.
Shared: No.
How long we keep it: for as long as needed to deal with your application and any questions or disputes about it.

Sensitive personal information

Examples: your account password; and, if you apply for store credit or a loan offer, your Social Security number, driver's license number and bank account number.
Why we collect it: to let you sign in securely, to verify your identity and set up your weekly payments when you apply for store credit, and to send your loan application at your request.
Sold: No. They go to our payments partner to activate your credit, and to the lead network only at your direction, with your consent.
Shared: No.
How long we keep it: passwords (hashed) while your account is open. Social Security, driver's license and bank account numbers are encrypted and deleted once your store credit application is decided (within 30 days at most), and aren't kept from loan form applications after they're sent.

Changes to this notice

We'll update this notice when our practices or the law change, and show the date of the latest version at the top. If we make significant changes, we'll let you know before they take effect, for example by email or with a notice on our website.

Contact us

If you have a question about this notice or your personal information, use our contact form and choose "Privacy request", or write to PAPA YES at .