Our Privacy Policy

Trailies LLC (“Trailies,” “we,” “us,” “our”), located at 8080 N Central Expressway, Suite 1700, 1034 Dallas, TX 75206, United States, provides this Privacy Policy for our websites, apps, and online services (the “Services”). For most processing we act as a “business” (U.S.) and “controller” (EU/UK/CH). For vendors processing personal information on our behalf, we bind them with data-processing terms consistent with applicable law. This policy includes jurisdiction-specific supplements for California, Colorado/Connecticut/Virginia/Texas and others, and EU/UK/Switzerland.

We collect personal information (i) directly from you; (ii) automatically via cookies, SDKs, and similar technologies; and (iii) from partners when their tags load on our Services (subject to consent where required by law).

• Core operations: ordering, fulfillment, support, fraud/security, legal compliance.
• Analytics & improvement: de-identified/aggregated where feasible.
• Marketing & cross-context behavioral advertising: retargeting, frequency capping, conversion measurement, lookalike modeling on platforms (e.g., Google, Meta). In EU/UK/CH, we rely on consent for ad personalization and non-essential cookies and implement Consent Mode v2.

Legal bases: contract, legal obligation, legitimate interests (e.g., security, limited first-party analytics), and consent (non-essential cookies/identifiers, ad personalization/remarketing, and any children’s processing that requires it). We keep auditable consent records and provide easy withdrawal via Cookie Settings.

We classify cookies as strictly necessary, functional, analytics, and advertising. In EU/UK/CH, non-essential cookies/IDs are off until you consent via a TCF-compatible, Google-certified CMP; Consent Mode v2 adapts tags. See Cookie Settings for a live list and to revoke consent.

Where applicable (e.g., California), cross-context behavioral advertising may be deemed a sale/share of personal information. You can opt out via Your Privacy Choices or by broadcasting a supported browser signal (e.g., Global Privacy Control). We treat valid signals as a “Do Not Sell or Share / targeted ads opt-out” for that browser/device and any associated profile.

We do not knowingly collect personal information from children under 13 without verifiable parental consent (VPC). Where we collect a child’s first name and age range, we collect it from the parent/guardian for personalization only and do not use a child’s data for targeted advertising. If we learn we collected child data without required consent, we delete it. Parents may review/delete their child’s data and refuse further use. In the EU/UK/CH, we obtain parental authorization where consent is required and the child is below the local digital age of consent (13–16).

We maintain a written information security program for child data and, where legally required, obtain separate parental opt-in for any third-party disclosures.

• Service providers / processors: payment, fulfillment/shipping, hosting, security/fraud, CRM/CDP/ESP/SMS, analytics (contracted under Art. 28 GDPR and CPRA service provider terms).
• Ad/analytics partners: e.g., Google and Meta business tools for measurement and personalization subject to your choices. We identify parties in our Partners page and do not transmit sensitive data; we avoid placing raw PII in URLs; we hash matching identifiers where applicable.
• Legal/compliance & business transfers as required by law or in connection with corporate transactions.

We may transfer personal information to the U.S. or other countries using one or more of: (i) EU-U.S. Data Privacy Framework (and UK extension / Swiss-U.S. DPF) once certified, or (ii) Standard Contractual Clauses plus supplementary measures. We will state our DPF certification here once active.

We maintain reasonable (U.S.) and appropriate (GDPR Art. 32) technical and organizational measures, including access controls, encryption in transit/at rest where appropriate, least-privilege access, logging/monitoring, incident response, vendor due diligence, and periodic reviews. We do not guarantee absolute security.

We retain personal information for the periods disclosed in the Notice at Collection or, where a fixed period is not possible, by applying documented criteria (purpose, legal obligations, limitation periods, and security needs).

We conduct profiling for marketing segmentation and analytics. We do not engage in solely automated decision-making that produces legal or similarly significant effects. EU users may object to direct marketing; if our ADM meaningfully expands, we will update this notice with the required logic and impact information.

If we offer a program involving price/service differences in exchange for personal information, we will provide a description of material terms, categories of data involved, opt-in/out methods, and a good-faith estimate of the value of the consumer’s data, as required by California law.

Email: We comply with CAN-SPAM (including physical address and an easy unsubscribe). SMS/Calls (U.S.): We obtain prior express written consent where required by the TCPA; you can revoke consent at any time, and we honor reasonable opt-out methods.

We will update this Policy when our practices materially change. We will post the updated version with a new effective date and provide additional notice and/or obtain consent where legally required (e.g., new non-essential cookies in EU/UK/CH).