Privacy Policy

This Privacy Policy explains how Superfresh Group Inc., d.b.a. APO Skincare (“APO Skincare,” “APO,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you visit www.aposkincare.com, purchase APO products, contact us, or otherwise interact with us.

1. Scope

This policy applies to APO-controlled websites, communications, and customer-service interactions that link to it. It does not govern the independent privacy practices of Stripe, delivery carriers, or other third parties whose sites or services you choose to use.

2. Personal information we collect

Depending on how you interact with us, we may collect:

• Identity and contact information: name, email address, telephone number, billing address, shipping address, and other details you provide.
• Order and transaction information: products ordered, purchase amount, order status, returns, refunds, delivery details, payment status, and limited payment-related details made available by Stripe, such as card brand and last four digits. APO does not receive or store your full card number or card security code on APO-controlled servers.
• Communications: messages, customer-service requests, return requests, survey responses, and other information you send us.
• Reviews: the rating, review text, first name, location, photos, and optional details (such as age range, skin type, and whether you received a free product) you submit when you review a product, your email address, and, for reviews submitted from a post-purchase email, the order it relates to.
• Marketing preferences: whether you have asked to receive or stop receiving promotional communications.
• Device and usage information: Internet Protocol address, browser and device type, operating system, referring page, pages viewed, timestamps, and diagnostic or security data generated when you use the site.
• Cookie and similar-technology information: identifiers and preferences stored through cookies or similar technologies, as described below.
• Fraud-prevention information: information used by us or our service providers to identify suspicious orders, payment abuse, card testing, or other unauthorized activity.

Please do not send us sensitive personal information that is not needed to complete your order or request.

3. Sources of personal information

We collect personal information:

• directly from you when you order, contact us, request a return, or subscribe to marketing;
• automatically from your browser or device when you use the site; and
• from service providers that support payments, fraud prevention, hosting, communications, fulfillment, shipping, and site operations.

4. How we use personal information

We may use personal information to:

• provide the site and display products;
• process payments, fulfill orders, send confirmations and tracking, and provide returns or refunds;
• respond to inquiries and provide customer support;
• invite you, after a purchase, to review the product you bought, and publish reviews you submit on our site, including in search results, with your first name, location, rating, photos, the optional details you choose to share, and, for purchase-verified reviews, the size purchased (we never publish your email address or order details);
• verify information and prevent fraud, card testing, abuse, and security incidents;
• maintain, troubleshoot, analyze, and improve our site, products, and services;
• send marketing communications when permitted by law and honor opt-out requests;
• enforce our Terms, protect our rights and the safety of others, and resolve disputes;
• comply with tax, accounting, regulatory, and legal obligations; and
• carry out another purpose disclosed to you when the information is collected or with your consent.

5. How we disclose personal information

We may disclose personal information to:

• Payment and fraud-prevention providers, including Stripe, to authorize and process transactions and identify suspected fraud;
• Fulfillment and delivery providers to pack, ship, track, and deliver orders;
• Website and technology providers that provide hosting, security, analytics, email, communications, and technical support;
• Professional advisers such as lawyers, accountants, auditors, and insurers;
• Government authorities or other parties when required by law or reasonably necessary to protect rights, safety, property, or the integrity of our services; and
• Parties to a business transaction in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate safeguards.

Service providers may use personal information only for the services they provide to us or as otherwise permitted by law. We do not rent personal information. We do not sell personal information for money.

6. Payments, HTTPS, and PCI security

Payments are processed through Stripe-hosted checkout. Card details are submitted directly to Stripe over encrypted HTTPS connections. APO receives the information needed to confirm and fulfill a transaction but does not store full payment-card numbers or card security codes on APO-controlled servers.

Our payment integration is designed to meet the PCI DSS responsibilities applicable to our use of Stripe. We also use reasonable administrative, technical, and organizational safeguards designed to protect customer and payment-related information and to reduce card-testing and fraud risk. For more information about Stripe’s practices, review Stripe’s Privacy Policy and Stripe’s security information.

No website, transmission, or storage method is completely secure. You are responsible for protecting access to your email and devices and for notifying your payment provider promptly about suspected unauthorized activity.

7. Cookies and similar technologies

The site may use cookies and similar technologies that are necessary to operate checkout, remember preferences, maintain security, and diagnose performance. We may also use optional analytics technologies to understand aggregated site use and improve the customer experience.

You can adjust browser settings to block or delete cookies, but doing so may affect site or checkout functionality. If we introduce advertising cookies or other technologies that require additional notice or consent, we will update our disclosures and provide legally required choices.

8. Marketing communications

We may send promotional emails only when permitted by law. You can unsubscribe using the link in a promotional email or by emailing privacy@aposkincare.com. Even if you opt out of marketing, we may still send non-promotional messages about an order, return, security issue, or other service interaction.

9. Your privacy choices and rights

You may update your contact or marketing preferences by contacting us. Depending on where you live and subject to legal exceptions, you may have rights to:

• know or access the personal information we maintain about you;
• correct inaccurate personal information;
• delete personal information;
• receive a portable copy of certain personal information;
• opt out of certain targeted advertising, sale, or sharing practices if we engage in them; and
• appeal a refusal to act on a privacy request, where applicable.

To submit a request, email privacy@aposkincare.com or write to the address in the Contact section. Describe the request and the email address associated with your interaction. We may need to verify your identity and authority before responding. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and verification of the consumer’s identity.

We will not discriminate against you for exercising an applicable privacy right. Some information may be exempt from a request or retained as required by law, including records needed for taxes, fraud prevention, transaction completion, or legal claims.

10. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including order fulfillment, customer support, fraud prevention, legal compliance, accounting, dispute resolution, and enforcement of agreements. Retention periods vary by the type of information and our legal obligations. We delete or de-identify information when it is no longer reasonably needed, unless retention is required or permitted by law.

11. Data security

We use reasonable safeguards appropriate to the nature of the information, including access controls, service-provider controls, HTTPS encryption in transit, monitoring, and limiting payment-card data handled by APO. Despite these measures, no security program can eliminate all risk. If we become aware of a breach requiring notice, we will provide notice as required by applicable law.

12. Children’s privacy

The site is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact privacy@aposkincare.com so we can review and, where appropriate, delete it.

13. External links

Our site may link to third-party websites or services. Their privacy practices are governed by their own notices, not this policy. Review those notices before providing personal information.

14. Changes to this policy

We may update this Privacy Policy as our services, practices, or legal obligations change. We will post the revised policy with a new effective date and provide any additional notice required by law. Material changes apply prospectively unless otherwise permitted by law.

15. Contact us

Questions or privacy requests may be directed to:

Superfresh Group Inc., d.b.a. APO Skincare
Attn: Privacy
2218 Broadway, Suite 211
New York, NY 10024
Email: privacy@aposkincare.com
Phone: 212-518-6025