Last Revised on January 15th 2025

Welcome to the Privacy Policy for Codex Labs (“Privacy Policy”) provided by Codex Labs Corporation Inc (“Codex,” “we” or “us”).

This Privacy Policy describes how we collect, use and disclose information about you (“Information”) related to your use of and access to the Codex website, content, applications, marketing offers, services, tools, and features, provided by us, including without limitation, the website www.codexlabscorp.com (collectively, the “Services”). Please read this Privacy Policy carefully.

For purposes of this Privacy Policy, “you” and “your” means you as the user of the Services.

1. TYPES OF INFORMATION WE COLLECT

When you use the Services, we may collect Information in the following categories:

• “Personal Information,” which means information that identifies you (whether directly or indirectly), such as your name, credit card number, billing or shipping address, email address, telephone number, and birthday or age; and
• “Non-Personal Information,” which means information that does not directly or indirectly identify, and cannot reasonably be used to identify, you, such as information about the products you purchase. If Non-Personal Information is directly or indirectly associated with Personal Information, this Non-Personal Information is then treated as Personal Information.

Information we may collect about you includes:

• Registration details you provide when you create an account, such as your name, email address, telephone number, birthdate, username and password.
• Information you provide related to your physical appearance to aid in the purchase of our products, including, but not limited to skin tone and type.
• Information you provide when you access or use the Services and each time you interact with the Services or otherwise with us, for example, when you update Information in your customer profile, and communicate with us by telephone or email. This includes your payment Information. We also store Information about the products you purchase through the Services, such as the product specifications, date of purchase, and details relating to any support issue.
• Information you provide in public forums through the Services, including using our review, comment, post or similar functionality.
• Usage, viewing and technical Information, including your IP address or device identifier when you use the Services. If you access your account from a mobile device, that mobile device may also provide us with details of your location. Most mobile devices allow you to disable this functionality.
• Information we receive about you from third parties. For example, if you access the Services through a third party platform or log-in, we may also collect your email address and other Information associated with that third party, and any Information you have made public in connection with that service or which the third party shares with partner services. See also Section 7 “THIRD PARTY WEBSITES AND LINKS” below.

2. HOW WE COLLECT YOUR INFORMATION

• We collect Information you provide to us when you: register with us; input Information into the Services; sign up to receive marketing communications from us; create user generated content; request products, services or information from us; participate in public forums or other activities through the Services; respond to customer surveys; or otherwise interact with us or the Services.
• We collect Information through unique identifiers (such as IP address, device ID, or system configuration information).
• We use "cookies" and other technologies to collect data that enable us to better understand and improve the usability, performance and effectiveness of our Services. Cookies are files sent to your browser and stored on your computer. We use cookies to gather general Information about your use of the Services, the files you have designated for backup, the configuration of your computer, and your computer’s interaction with the Services, and we store this information in log files. We use this information to understand traffic on and downloads from our Services, enabling us to improve the Services, provide the best online experience possible, and improve our customer service. We use the following types of cookies on our site:
• • Strictly necessary cookies - These cookies are essential in order to enable you to navigate and use our Services. Without these cookies, the Services you have asked for, like customer support, cannot be provided.
  • Performance cookies - These cookies collect Information about how you use the Services. These cookies don’t collect personal information and are only used to improve how the Services work.
  • Functionality cookies - These cookies allow the Services to remember choices you make (such as your preferences or items you placed in your shopping cart), to provide enhanced, more personal functionality or features.
  • Other Technologies - We may also use other Internet technologies, such as web beacons or pixel tags and other similar technologies, to deliver or communicate with cookies and analyze your use of the Services. We also may include web beacons in e-mail messages at we know when you have opened an email message received from Codex.

You may disable cookies by changing the settings on your browser, phone and/or device. Check your browser or device’s help or support menu for further information. Remember that if you disable cookies it is likely to affect how the Services work and you may not be able to access or use certain features of the Services. Unless you have adjusted your setting so that it will refuse cookies, our Services will place cookies when you log on to the Services.

• We use third parties’ analytic and tracking tools to better understand who is using the Services, how people are using the Services and how to improve the effectiveness of the Services and their content, and to help those parties serve more targeted advertising to you across the Internet or help us serve more targeted advertising to you. Those third party companies may use cookies, pixel tags or other technologies to collect and store Non-Personal Information such as time of visit, pages visited, time spent on each page of the Services, device identifiers, type of operating system used and other website(s) you may have visited. They might combine Information they collect from your interaction with the Services with Personal Information they collect from other sources. We do not have access to, nor control over, third parties' use of cookies or other tracking technologies.

Online Tracking

• Do Not Track (DNT) is a privacy preference that users can set in some web browsers, allowing users to opt out of tracking by websites and online services. The Services do not recognize DNT or enable such opt out.

3. USE OF YOUR INFORMATION BY CODEX

The ways in which we may use your Information include the following:

• To provide you with the Services and other products and services you request.
• To administer your Codex account.
• To communicate with you about your account or transactions with us and send you details or updates about features of the Services or changes to our policies.
• To process payments.
• To create anonymized and aggregated data sets that may be used for a variety of functions, including research, internal analysis, analytics, and other functions.
• To ensure consistency with local law and choices and controls that may be available to you.
• To personalize content, experiences, and advertising.
• To detect, investigate and prevent activities that may violate our policies or be illegal.
• To optimize or improve the content, products, services, and features of the Services.
• To personalize and improve the Services and user experiences, to increase the functionality and user friendliness of the Services, to deliver content or features that match user profiles or interests.
• To monitor and analyze the Services usage and trends and otherwise measure the effectiveness of the services.
• To send you offers and promotions for our other products and services.

4. SHARING YOUR INFORMATION WITH OTHER COMPANIES

We will not share your Personal Information outside Codex except in the following limited circumstances which you consent to:

• When you allow us to share your Personal Information with another company, such as directing us to share your Personal Information with third-party sites or platforms, such as social networking sites. If you use third-party sites or platforms made available through the Services (e.g., Facebook logon), those third parties will have access to your Personal Information to the extent that you have authorized their access. Please consult Section 7 below and the third party’s privacy policy for additional information.
• When you request our referral services to forward or share certain content with a friend, such as an email inviting a friend to use the Services or sharing certain content from the Services with a friend.
• When we contract or partner with a third party to provide services on our behalf, which we do for Services development and maintenance, site analytics, customer support, order fulfillment, and payment processing. We require all third parties to process your data in accordance with this Privacy Policy and as permitted by applicable data protection laws.
• In connection with the sale of a business (including merger, acquisition, or sale of all or a material portion of its assets, change in corporate control, or insolvency or bankruptcy proceedings).
• To enforce our Terms of Service or rules, to ensure the safety and security of our users and third parties, to protect our rights and property and the rights and property of our users and third parties, to comply with legal process, including judicial warrant, rule, order or subpoena or in other cases if we believe in good faith that disclosure is required by law or regulation.

In addition, we may share Non-Personal Information and anonymized and aggregated data sets with third parties, alone or in combination with the Non-Personal Information of other users.

5. PUBLIC VENUES AND SEMI-PUBLIC VENUES OF THE SERVICES.

If you use a message board, comment function, conversation pages, blogs, social community environments, profile pages, or other public or semi-public venue or forums of the Services, you will be identified on those venues by the username you submit.

6. YOUR CONTROLS AND CHOICES

We provide you the ability to exercise certain controls and choices regarding our collection, use and sharing of your Information. Your controls and choices may include:

• You may correct, update and delete your registration account.
• You may change your choices for newsletters and alerts.
• You may choose whether to receive from us offers and promotions for our products and services.
• You may request access to the Personal Information we hold about you and that we amend or delete it.

You may exercise your controls and choices, or request access to your Personal Information, by modifying your profile or by contacting us at support@codexlabscorp.com (estimated response time: 24-48 hours) or following instructions provided in communications sent to you. Please be aware that, if you do not allow us to collect Personal Information from you, we may not be able to deliver certain products and services to you, and some of our services may not be able to take account of your interests and preferences. If you have questions regarding the specific Personal Information about you that we process or retain, please contact us at support@codexlabscorp.com (estimated response time: 24-48 hours).

7. THIRD-PARTY WEBSITES AND LINKS

Our Services may contain links to other online platforms operated by third parties. We do not control such other online platforms and are not responsible for their content, their privacy policies, or their use of your Personal Information. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators except as disclosed on the Services.

Please keep in mind that Information you post on public or semi-public venues, including Information you share on third party social networking platforms (such as Facebook or Twitter) may also be viewable by other users of the Services and/or users of those third-party online platforms without limitation as to its use by us or by a third party. When you provide Information to a third-party online platform, the Information you provide may be separately collected by that third-party. The Information the third-party online platform collects is subject to the third-party online platform’s privacy practices. Privacy choices you make on the third-party online platform will not apply to our use of the Information we collect directly through our Services.

We expressly disclaim any and all liability for the actions of third parties, including but without limitation to actions relating to the use and/or disclosure of Personal Information by third parties.

Third Party Pixels and Cookies

When you visit our website, log in, register or open an email, cookies, ad beacons, and similar technologies may be used by our online data partners or vendors to associate these activities with information they or others have about you, including your email address. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting

https://www.smartrecognition.com/database-opt-out/

If you wish to opt-out of email marketing from a specific brand that we work with, such as a customer of ours, you can click on the “opt-out” or “unsubscribe” link in the footer (located at the bottom) of any marketing email you receive.

Name	Description	Category	Provider	Duration
cookieconsent_status	This cookie is associated with the app Consentmo GDPR Compliance and is used for storing the customer's consent.	Necessary	Consentmo	1 year
cookieconsent_preferences_disabled	This cookie is associated with the app Consentmo GDPR Compliance and is used for storing the customer's consent.	Necessary	Consentmo	1 day
_ab	Used to control when the admin bar is shown on the storefront.	Necessary	Shopify	1 year
_abv	Persist the collapsed state of the admin bar.	Necessary	Shopify	1 year
_checkout_queue_token	Used when there is a queue during the checkout process.	Necessary	Shopify	1 year
_identity_session	Merchant authentication: Main session cookie for Identity authentication. This is the underlying Rails session cookie. It contains the SID.	Necessary	Shopify	2 years
_master_udr	Permanent device identifier.	Necessary	Shopify	Session
_merchant_essential	Contains essential information for the correct functionality of merchant surfaces such as the admin area.	Necessary	Shopify	1 year
_pay_session	The Rails session cookie for Shopify Pay	Necessary	Shopify	Session
_shopify_country	Used for Plus shops where pricing currency/country is set from GeoIP by helping avoid GeoIP lookups after the first request.	Necessary	Shopify	30 minutes
_shopify_essential	Contains essential information for the correct functionality of a store such as session and checkout information and anti-tampering data.	Necessary	Shopify	1 year
_shopify_essential_	Contains an opaque token that is used to identify a device for all essential purposes.	Necessary	Shopify	1 year
_shopify_test	Used to check cookie capabilities on the client.	Necessary	Shopify	1 minute
_storefront_u	Used to facilitate updating customer account information.	Necessary	Shopify	1 minute
_tracking_consent	Used to store a user's preferences if a merchant has set up privacy rules in the visitor's region.	Necessary	Shopify	1 year
auth_state_*	Stores authentication state before redirecting customers to third party for authentication.	Necessary	Shopify	25 minutes
cart	Contains information related to the user's cart.	Necessary	Shopify	2 weeks
cart_currency	Used after a checkout is completed to initialize a new empty cart with the same currency as the one just used.	Necessary	Shopify	2 weeks
checkout	Used by checkout to identify the user.	Necessary	Shopify	21 days
checkout_token	Used by checkout to identify the user.	Necessary	Shopify	Session
customer_account_locale	Used to keep track of a customer account locale when a redirection occurs from checkout or the storefront to customer accounts.	Necessary	Shopify	1 year
discount_code	Stores a discount code (received from an online store visit with a URL parameter) in order to the next checkout.	Necessary	Shopify	Session
hide_shopify_pay_for_checkout	Set when a buyer dismisses the Shop Pay login modal during checkout, informing display to buyer.	Necessary	Shopify	Session
identity-state	Stores a hash of the oauth flow state between redirects.	Necessary	Shopify	1 day
identity_customer_account_number	Stores an identifier used to facilitate login across the customer's account and storefront domains.	Necessary	Shopify	12 weeks
in_checkout_profile_preview	Used to determine if a merchant is in a checkout profile preview session.	Necessary	Shopify	Session
keep_alive	Used when international domain redirection is enabled to determine if a request is the first one of a session.	Necessary	Shopify	Session
localization	Used to localize the cart to the correct country.	Necessary	Shopify	2 weeks
login_with_shop_finalize	Used to facilitate login with Shop.	Necessary	Shopify	5 minutes
master_device_id	Merchant authentication: Permanent device identifier, public version.	Necessary	Shopify	1 year
order	Used to allow access to the data of the order details page of the buyer.	Necessary	Shopify	3 weeks
profile_preview_token	Used for previewing checkout customizations.	Necessary	Shopify	5 minutes
shop_pay_accelerated	Indicates if a buyer is eligible for Shop Pay accelerated checkout.	Necessary	Shopify	1 year
shopify_pay	Used to log in a buyer into Shop Pay when they come back to checkout on the same store.	Necessary	Shopify	1 year
shopify_pay_redirect	Used to accelerate the checkout process when the buyer has a Shop Pay account.	Necessary	Shopify	1 year
skip_shop_pay	Disables Shop Pay as a payment method for a checkout.	Necessary	Shopify	1 year
storefront_digest	Stores a digest of the storefront password, allowing merchants to preview their storefront while it's password protected.	Necessary	Shopify	1 year
theme	Used to determine the theme of the storefront.	Necessary	Shopify	1 weeks
user	Used in connection with Shop login.	Necessary	Shopify	1 year
user_cross_site	Used in connection with Shop login.	Necessary	Shopify	1 year
_landing_page	Capture the landing page of visitor when they come from other sites.	Statistics	Shopify	2 weeks
_merchant_analytics	Contains analytics data for the merchant session.	Statistics	Shopify	1 year
_orig_referrer	Allows merchant to identify where people are visiting them from.	Statistics	Shopify	2 weeks
_shopify_analytics	Contains analytics data for buyer surfaces such as the storefront or checkout.	Statistics	Shopify	1 year
_shopify_ga	Contains Google Analytics parameters that enable cross-domain analytics measurement to work.	Statistics	Shopify	Session
_shopify_s	Used to identify a given browser session/shop combination. Duration is 30 minute rolling expiry of last use.	Statistics	Shopify	30 minutes
_shopify_y	Shopify analytics.	Statistics	Shopify	1 year
shop_analytics	Contains the required buyer information for analytics in Shop.	Statistics	Shopify	1 year
_ga	This cookie name is associated with Google Universal Analytics	Statistics	Google Analytics	2 years
_clck	This cookie is installed by Microsoft Clarity to store information of how visitors use a website and help in creating an analytics report of how the website is doing. The data collected including the number visitors, the source where they have come from, and the pages visited in an anonymous form.	Statistics	Microsoft	1 year
_ga_EHHNVJSDS4	ID used to identify users	Statistics	Google Analytics	2 years
_ga_YWYDLQKX98	ID used to identify users	Statistics	Google Analytics	2 years
_clsk	This cookie is installed by Microsoft Clarity to store information of how visitors use a website and help in creating an analytics report of how the website is doing. The data collected including the number visitors, the source where they have come from, and the pages visited in an anonymous form.	Statistics	Microsoft	Session
_shopify_marketing	Contains marketing data for buyer surfaces such as the storefront or checkout.	Marketing	Shopify	1 year
_fbp	Used by Facebook to deliver a series of advertisement products such as real time bidding from third party advertisers.	Marketing	Meta Platforms, Inc.	3 months
VISITOR_INFO1_LIVE	Tries to estimate the users' bandwidth on pages with integrated YouTube videos. Also used for marketing	Marketing	Youtube	179 days
VISITOR_PRIVACY_METADATA	Youtube visitor privacy metadata cookie	Marketing	Youtube	180 days
_gcl_au	Used by Google AdSense for experimenting with advertisement efficiency across websites using their services.	Marketing	Google	3 months
__kla_id	When Klaviyo’s JavaScript is enabled, the __kla_id cookie can track and identify site visitors through an auto-generated ID. This cookie can temporarily hold personally identifiable information. Once a visitor is identified, the cookie can pass their data into Klaviyo.	Marketing	Klaviyo	2 years
_tt_enable_cookie	Tracking cookie used by TikTok to identify a visitor	Marketing	TikTok	389 days
_ttp	Tracking cookie used by TikTok to identify a visitor	Marketing	TikTok	389 days
_pin_unauth	Registers a unique ID that identifies and recognizes the user. Is used for targeted advertising.	Marketing	Pinterest	1 day
shopify_override_user_locale	Used as a mechanism to set User locale in admin.	Preferences	Shopify	1 year
YSC	Registers a unique ID to keep statistics of what videos from YouTube the user has seen.	Preferences	Youtube	Session

8. CHILDREN’S PRIVACY

We do not seek or knowingly collect any Personal Information about children under 13 years of age. If we become aware that we have unknowingly collected Personal Information from a child under 13 years of age, we will make commercially reasonable efforts to delete such information from our database.

If you are the parent or guardian of a child under 13 years of age whose child has provided us with Personal Information, you may contact us to request it be deleted.

9. DATA SECURITY, INTEGRITY AND RETENTION

• Please note that Information you send to us electronically may not be secure when it is transmitted to us. We recommend that you do not use unsecure channels to communicate sensitive or confidential Information to us. From time to time, we review our security procedures to consider appropriate new technology and methods. Please be aware though that, despite our best efforts, no security measures are perfect or impenetrable. We will retain your Personal Information for the length of time needed to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required, or for the establishment, exercise or defense of legal claims, or for legitimate businesses purposes, or as provided by law.
• To provide secure credit card processing when ordering from us, orders placed through our Services are processed through a third-party payment processor which operates under its own privacy policy. If you choose to make purchases from us online using a credit card, the credit card Information is sent to the third-party payment processor using an industry-standard (or better) encryption method for protecting data as it travels over the Internet. To learn more about our policies with respect to third parties, please see Section 7. To learn more about our credit card processing vendors and their respective privacy and other policies that apply when you make a payment through their services, please review the terms of those third parties’ privacy policies.

10. UPDATING THIS PRIVACY POLICY

We may modify this Privacy Policy from time to time, in which case we will update the “Last Revised” date at the top of this Privacy Policy. If we make changes that are material, we will use reasonable efforts to attempt to provide notice to you and, where required by applicable law, we will obtain your consent. Notice may be sent by email to you at the last email address you provided to us, by posting notice of such changes on the Services, or by other means, consistent with applicable law. However, it is your sole responsibility to review the Privacy Policy from time to time to view any such changes. The updated Privacy Policy will be effective as of the time of posting, or such later date as may be specified in the updated Privacy Policy. IF YOU DO NOT ACCEPT AND AGREE TO THIS PRIVACY POLICY, INCLUDING ANY CHANGES, THEN YOU MUST NOT ACCESS OR USE THE SERVICES.

11. YOUR CALIFORNIA PRIVACY RIGHTS

This Privacy Policy describes how we may share your Information for marketing purposes. It applies to all users of the Services, including California residents.

If you are a user of this service and a California resident under the age of 18, you may request to have your posted content or Information removed from the publicly-viewable portion of this web site by submitting a formal email to support@codexbeauty.com (estimated response time: 24-48 hours) or by contacting us directly. Content or Information may not be removed from our systems or databases. In certain situations, content or Information cannot be removed.

As a California resident, you may contact us with any questions or to request a list of third parties to whom we may disclose Information for such third parties’ marketing purposes and the categories of Information we may disclose. See How to Contact Us below.

12. HOW TO CONTACT US

Any questions or concerns regarding the use or disclosure of Personal Information should be directed to Codex at support@codexlabscorp.com. Please allow 24-48 hours in response time.

You may contact us regarding the Services or this Privacy Policy by e-mail at support@codexlabscorp.com. Please allow 24-48 hours in response time.

12. USEFUL LINKS

APPI COMPLIANCE

CCPA COMPLIANCE

GDPR COMPLIANCE

PIPEDA COMPLIANCE