PRIVACY POLICY

This policy explains what personal information THAT HITS LLC ("we," "us") collects when you use thatreallyhits.com (the "site"), what we do with it, who else sees it, and the choices you have. We try to keep it plain: we collect what the site needs to work, we don't sell it, and we don't run advertising trackers.

1. Who we are

THAT HITS LLC is a Nebraska limited liability company. Questions or requests about this policy: support@thatreallyhits.com.

2. What we collect

Information you give us

• Email address — when you join the newsletter / drop list or create an account. For the newsletter, your address is passed to our email service (Omnisend), where your subscription is kept; we don't keep our own copy of the subscriber list.
• Account details — when you create an Underground account or sign in through Shopify, we receive your name and email, and any social handles (Instagram / X) you choose to add. We also keep your display name, when you registered, and when you last signed in.
• Rewards activity — spins, prizes you win, the single-use discount codes issued to your email, and your progress in the Snack-o-meter.
• Rare Import Requests — the item name, origin, any name you type in, and your notes.
• Post reactions — if you "hype" an Intel post while signed in, we remember your email against that post so you can't hype it twice.
• Messages to us — whatever you send when you contact us (such as your name, email, order number, and message).
• Reviews — if you leave a product review, the review (and your name, email, and any photos you add) is collected and shown through Judge.me.

Orders and payments

Checkout, payment, and shipping details are collected and processed by Shopify, not by this site. We never see or store your full card number. We display your order history (order number, date, status, and total) by reading it from Shopify when you're signed in.

Collected automatically

• Basic site analytics — we run our own simple analytics: which pages are viewed, and counts of actions like newsletter sign-ups, spins, and product clicks, with timestamps. This is not tied to your name or email, and we don't use third-party analytics or advertising services.
• Security data — your IP address is used to limit repeated login attempts and abuse, and appears in our security logs, which we keep for about 14 days.
• Cookies and browser storage — see section 5.

3. How we use it

• To run the site: sign you in, show your orders, remember your cart, and run the wheel and Snack-o-meter.
• To send the drop newsletter to people who signed up for it. Every marketing email will include an unsubscribe link, and we'll stop within 10 days of a request.
• To respond to your messages and requests.
• To keep the site safe: prevent fraud, abuse, and repeated login attempts.
• To understand which pages and features get used, so we can improve them.
• To comply with the law.

We do not sell your personal information, and we do not share it for cross-site advertising.

4. Who else handles your information

We share information only with the services that help us run the site, and only as needed for them to do that:

• Shopify — checkout, payments, shipping, customer accounts, and order records. Shopify's own privacy policy applies to what it collects.
• Omnisend — our email service. When you join the newsletter, your email address is sent to Omnisend, which stores it, sends our newsletter and welcome email, and handles unsubscribes. Omnisend's own privacy policy applies to what it holds.
• Judge.me — collects, stores, and displays product reviews.
• Cloudflare Turnstile — a bot check used only on our staff login page (not shown to shoppers); it receives the visitor's IP address and basic browser signals to tell people from bots.
• YouTube — some pages embed YouTube videos using its privacy-enhanced mode; Google may set cookies once you press play.
• Our hosting provider — the company whose servers run the site and store its data.
• Legal and safety — we may disclose information if the law requires it, or to protect our rights, our customers, or the site from fraud or abuse.
• A sale of the business — if THAT HITS LLC is sold or merged, your information may transfer to the new owner, who must honor this policy.

Our Instagram link takes you to Instagram, which has its own privacy practices.

5. Cookies and browser storage

We use only what's needed to make the site work. We don't use advertising or cross-site tracking cookies.

• Sign-in cookie — keeps you signed in to your account (up to 30 days).
• Sign-in handshake cookies — short-lived cookies used while you sign in through Shopify, to keep that step secure.
• Access cookie — remembers that you've entered a passcode when the site is in a private/VIP mode.
• Cart and preferences — your cart, and display settings (such as the display-mode toggle), are saved in your browser's local storage so they're still there when you come back.

Shopify's checkout and the services in section 4 may set their own cookies. You can block or clear cookies in your browser settings, but the cart and sign-in won't work without them. Because we don't track you across other sites, there is nothing to opt out of with a "Do Not Track" or "Global Privacy Control" signal.

6. How long we keep it

We keep your information for as long as your account or newsletter subscription is active, or as needed to provide the service, resolve disputes, and meet legal obligations (such as tax and accounting records held by Shopify). Security logs are kept for about 14 days. If you ask us to delete your information, we will, except where we're required to keep it.

7. Your choices and rights

Whatever state you live in, you can email support@thatreallyhits.com to:

• ask what personal information we have about you, and get a copy;
• correct information that's wrong;
• delete your information (including your account and newsletter subscription);
• unsubscribe from marketing emails — or just use the unsubscribe link in any email.

We'll verify it's really you (for example, by replying to the email address on file) and respond within 45 days. You won't be treated differently for making a request. Some states give residents additional rights; we honor these requests from everyone, and you can appeal a decision by replying to our response.

8. Security

We use reasonable technical and organizational measures to protect your information, and payments are handled by Shopify rather than stored by us. No system is perfectly secure, so we can't guarantee absolute security.

9. Children

The site isn't directed to children under 13, and we don't knowingly collect their personal information. If you believe a child has given us information, email us and we'll delete it.

10. Where we operate

We operate from, and sell to customers in, the United States. Your information is processed and stored in the United States.

11. Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant — for example, we start collecting something new — we'll tell you on the site or by email before it takes effect.

12. Contact

THAT HITS LLC
support@thatreallyhits.com