PRIVACY POLICY

Last Updated: September 23, 2026

1. Introduction

Noelle Bakes Real Good respects your privacy. This Privacy Policy explains how we collect, use, and share personal information, and the rights you may have under applicable privacy laws.

The website www.noellebakesrealgood.com and related digital properties (collectively, the “Website”) are owned and operated by Noelle Reyes, Esq. PLLC, doing business as “Noelle Bakes Real Good” (the “Company,” “we,” “us,” or “our”). This Privacy Policy (“Policy”) applies to all Website visitors (“you” or “users”), including those who access our content, newsletters, communications, information, materials, goods, products, services, digital products, and functionality offered by the Company (collectively, the “Services”).

This Policy applies to personal information we collect about: (i) individuals who visit or browse the Website; (ii) subscribers to our communications; (iii) customers, clients, and business contacts who order, purchase, book, or inquire about our products or Services; and (iv) individuals who submit comments, testimonials, case studies, or other user-submitted content. For personal information collected through the Website, our marketing, billing, and account administration, the Company acts as a controller (or “business,” as defined under applicable law). Where we process personal information for a business customer under a written agreement, we act as a processor or service provider, and that agreement governs. If a business customer gave us your information, please send privacy requests to that business customer; we will assist as our agreement and applicable law require. We may also act as an independent controller of personal information we process for our own legal compliance, security, and business operations.

By accessing or using our Services, you acknowledge and understand the practices described in this Policy, should be read together with our Terms of Use and Website Disclaimer, which are incorporated by reference. The disclosures in this Policy reflect our processing activities during the preceding 12 months, or another period required by applicable law. Section headers, links, and examples are provided for reference convenience, organizational, or illustrative purposes only and do not modify or expand the scope of this Policy.

“Personal information” or “personal data” means information that identifies, relates to, describes, or can reasonably be linked, directly or indirectly, to an identified or identifiable individual, as defined under applicable law. We use both terms to mean the same thing in this Policy. Information you choose to make publicly available through comments, posts, or other interactive features of the Services may be viewed, collected, and used, and we are not responsible for how others use it.

“Third party” means any person or entity other than the Company and you. This Policy does not apply to third-party websites, platforms, or services that may be accessible through our Website. We are not responsible for their content or practices and encourage you to review their policies separately.

2. Information We Collect

We may collect information about you in several ways, including information you provide directly, information collected automatically, and information received from third parties.

A. Information You Provide

When you subscribe, use interactive features, request or receive a digital product, or make a purchase, you may provide personal information such as:

Contact information, such as your name, email address, phone number, and the contents of messages or inquiries you submit through forms or other communications
Newsletter or subscription information, such as your email address, name, and preferences when you subscribe, including when you opt in while requesting or receiving a digital product
Account information, including email address and password when creating a profile
Payment and billing information, such as billing address and transaction details when you order or purchase our products, Services, and offerings
Social media information, if you interact with us through social platforms or link an account, including publicly available profile information
User-submitted content, including comments, testimonials, case studies, feedback, survey responses, or other information you submit
Audio or video content, if you participate in or create media associated with our Services
Communications, including email correspondence and messages you send to us

B. Information Collected Automatically

When you access or use our Website, certain information may be collected automatically through cookies, analytics tools, and other tracking technologies, including:

Internet Protocol (IP) address and approximate geographic location
Device information (e.g., type, browser, operating system, and identifiers)
Usage data (e.g., pages visited, time spent, clicks, scrolling, video plays, and downloads)
Referral source information
Search terms
Clickstream and log data reflecting page navigation, including when you download a digital product or open a digital product link we send you

C. Information From Third Parties

We may also receive information about you from third parties that help operate our Website or provide services on our behalf. Third-party service providers are contractually limited in how they may use personal information (see Section 4.A); other third parties act under their own privacy policies. Examples include:

Analytics and performance-monitoring providers, such as Google Analytics or PostHog, which report Website usage and visitor interactions
Advertising providers, such as Meta (through the Meta Pixel), which support marketing and measurement
Email service providers, such as Mailchimp or ConvertKit, which help manage newsletters and communications
Newsletter platforms, such as Beehiiv, which may provide subscriber information and engagement data related to content they distribute
Scheduling platforms, such as Calendly, which provide appointment information or contact details related to booking requests
Affiliate platforms or partners, such as ShopMy or Amazon Associates, which may provide aggregated referral, transaction, or commission information related to affiliate links
Customer support and communications platforms, such as Cloudflare, which we use to manage inquiries, communications, and delivery of requested digital products
Cloud storage and collaboration platforms, such as Notion, which we use to store documents, manage projects, and support internal operations
Financial service providers or payment platforms, such as Plaid or Shopify Payments, that facilitate secure connections between financial institutions and payment systems
Payment processors, such as Stripe, PayPal, and Square, which may facilitate payments and provide limited transaction-related information
Hosting providers, such as GoDaddy, Amazon Web Services, or Cloudflare, which support Website operation and infrastructure
Content delivery networks and caching services, which improve Website performance and availability
Security and fraud prevention services, such as Cloudflare or reCAPTCHA, to detect malicious activity, protect our Website, and maintain platform integrity

3. How We Use Your Information

Where permitted by law, we may use the information we collect for the following purposes:

To provide, operate, maintain, and improve our Services
To respond to inquiries and provide customer support
To send newsletters, updates, and marketing communications you have opted in to
To schedule appointments or book our Services
To process orders, payments, and purchases, deliver requested digital products through a download or an emailed access link, and send transactional communications
To analyze how you use our Services and optimize user experience
To conduct marketing analytics and personalize content through advertising, recommendations, and retargeting
To conduct research and measure the effectiveness of, and engagement with, our communications
To detect, prevent, and address fraud, security risks, or technical issues
To comply with legal obligations, and enforce our terms, policies, and other agreements
To display testimonials, case studies, or user-generated and submitted content
To generate aggregated or de-identified insights for research, analytics, and service improvement
For any other purpose you authorize at the time of collection

Personal information may be processed on the following legal bases:

Consent for a specific purpose, such as subscribing to our communications (including opting in when you download, request, or receive a link to a digital product), placing non-essential cookies, or engaging in targeted advertising and retargeting. You may withdraw your consent at any time.
Contract to provide our Services and fulfill our duties.
Legal obligation to comply with applicable laws, regulations, or legal processes.
Legitimate interests of ours or a third party, such as operating and improving our Services, conducting analytics that do not rely on non-essential cookies, maintaining security, preventing fraud or abuse, and responding to inquiries, provided such interests are not overridden by your rights.
Additional bases where required or permitted by applicable law.

Our processing activities primarily occur in the United States, although our service providers may store or process data in other jurisdictions. Where required, we use appropriate safeguards for these transfers, as described in Section 12.C.

A. Opt-In & Opt-Out of Email Marketing & Newsletters

When you subscribe to our emails or newsletters, including by opting in when you request or receive a digital product, you consent to receive periodic communications from us. You may opt out at any time by clicking the “Unsubscribe” link included at the bottom of our emails or by contacting us at bakedgood@noellereyes.com.

B. CAN-SPAM Compliance

In accordance with the Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM) and our marketing practices, commercial communications may:

Identify the sender by name and a physical business address
Include accurate header information and subject lines
Where required by law, identify the message as an advertisement or marketing communication
Provide a clear and prominent unsubscribe mechanism in each email
Honor opt-out requests within 10 business days

C. Transactional Communications

We send transactional or service-related emails, such as order confirmations, purchase receipts, account notifications, or emails containing links to digital products you have requested or purchased, as necessary to provide our Services. These emails are not considered marketing communications.

4. How We Share Your Information

We may share your personal information in the following contexts:

A. Service Providers & Partners

We may share information with service providers, vendors, contractors, and third parties that support our operations, such as:

Analytics providers and performance monitoring (e.g., Google Analytics, PostHog)
Advertising, marketing, and affiliate partners (e.g., Meta/Facebook, ShopMy, Amazon Associates), which are third parties that may use information for their own purposes under their own privacy policies
Newsletter distribution and subscriber management (e.g., Beehiiv)
Email service providers (e.g., Mailchimp, ConvertKit)
Scheduling and appointment-booking platforms (e.g., Calendly)
Hosting providers, content delivery networks, and technical infrastructure providers (e.g., GoDaddy, Amazon Web Services, Cloudflare)
Financial service providers and payment processors (e.g., Plaid, Stripe, PayPal, Shopify Payments, Square) that facilitate payment processing, financial verification, and transactions
Professional advisors, such as attorneys, accountants, and auditors
Customer support, communications, and cloud storage or collaboration platforms (e.g., Cloudflare, Notion)
Security and fraud-prevention services

Where service providers process personal information on our behalf, they are bound by applicable data protection laws and by contracts that limit their use of personal information to the services they provide to us.

B. Legal Requirements & Safety

We may disclose information where we believe in good faith that it is necessary to:

Comply with applicable laws, regulations, legal processes, or government requests
Enforce our terms, policies, and other agreements
Protect the rights, property, or safety of the Company, our users, or the public
Detect, prevent, or investigate fraud, security issues, or other potential wrongdoing

C. Business Transfers

If the Company is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. Where required, we will notify you of the transfer and any choices you have. The acquiring entity must handle personal information in accordance with applicable data protection laws.

D. Consent or Direction

We may share your information for other purposes where you have consented or directed us to do so.

E. De-Identified, Aggregated, or Anonymized Information

We may share anonymized information that cannot reasonably be used to identify you or individual users, for purposes such as analytics, research, industry reporting, marketing analysis, or improving our Services.

5. Cookies & Tracking Technologies

Our Website may use cookies, pixels, web beacons, and similar tracking technologies to analyze usage, improve your experience, and support our Services.

A. Definition & Types of Cookies

“Cookies” are small text files placed on your device when you visit a website. Cookies help websites function properly and allow site operators to understand how visitors use their services. Session cookies expire when you close your browser; persistent cookies remain on your device to recognize your browser and remember preferences on future visits.

We may use the following categories of cookies:

Essential, to operate the Website and enable core functionality such as security, authentication, and network management
Analytics and Performance, to analyze website traffic and usage patterns
Marketing or Advertising, to measure campaign effectiveness and deliver advertisements
Functional, to remember user preferences and browser settings for a more personalized experience

Specific cookies and similar technologies may include, by category:

Essential: Cloudflare bot-management and security cookies (e.g., __cf_bm, cf_clearance); session and authentication cookies; cookie consent state. Durations range from session to approximately 12 months.
Analytics and Performance: Google Analytics cookies (e.g., _ga, _ga_<id>, _gid, _gat); PostHog cookies (e.g., ph_<project_key>_posthog). Retention up to approximately 26 months, depending on provider configuration.
Marketing or Advertising: Meta Pixel cookies (e.g., _fbp, fr) used for conversion tracking and ad measurement. Durations approximately 90 days.
Functional: Google reCAPTCHA cookies (e.g., _GRECAPTCHA) for form abuse prevention; Beehiiv subscription cookies (where used); email-service-provider tracking pixels (e.g., Mailchimp, ConvertKit/Kit) for measuring email engagement. Durations vary by provider.

Specific cookies and durations may change as we update our Services or as third-party providers modify their products.

B. Consent to Cookies

A cookie banner displayed on our Website lets you review, accept, reject, or choose the categories of non-essential cookies we use (e.g., Analytics and Performance, Marketing or Advertising, and Functional). Essential cookies are always active because the Website cannot operate without them. Where required by law, we place non-essential cookies only after you consent. Disabling some cookies may affect certain features.

C. Tracking Technologies

We may also use tracking technologies such as pixels, web beacons, tags, and local storage to understand how users interact with our Website and Services. These technologies may work with cookies to recognize devices and interactions across visits in order to:

Monitor and analyze Website traffic, usage patterns, and user engagement;
Measure the effectiveness of our marketing and communications; and
Support advertising and improvements to our Services.

D. Do Not Track & Global Privacy Control Signals

Some browsers and privacy tools send signals such as “Do Not Track” (DNT) and Global Privacy Control (GPC) to communicate your privacy and tracking preferences. Where required by applicable law, we recognize and respond to universal opt-out mechanisms and opt-out preference signals, such as GPC, as valid requests to opt out of the sale or sharing of personal information and certain forms of targeted or cross-context behavioral advertising. You can learn more at https://globalprivacycontrol.org/ and https://optout.aboutads.info.

6. Third Party Services, Content, Links, & Integrations

We may use third-party platforms and service providers to operate our Services, distribute content, analyze performance, process payments, and support marketing and communications. Service providers that process personal information on our behalf are bound by contract and data protection laws to use it only for the services they provide to us, as described in Section 4.A, and may engage sub-processors while remaining responsible for appropriate safeguards. Other third parties may collect or process personal information under their own privacy policies, which we do not control. Examples include:

A. Website Hosting & Infrastructure

Infrastructure providers such as GoDaddy, Amazon Web Services, and Cloudflare host our Website and support our operations, security, and performance. These providers may collect technical data such as server logs, IP addresses, and browser, device, and access information. We also use Cloudflare to send, route, and manage customer communications, including responses to inquiries and emails containing links to digital products you request or purchase; in doing so, Cloudflare may process your name, email address, message contents, and delivery information. We also use Notion to store documents, manage projects, and support internal operations, and information you submit to us, such as inquiries or form submissions, may be stored in Notion and processed in accordance with Notion’s Privacy Policy (https://www.notion.so/privacy). For more information about how Cloudflare handles communications data, see Cloudflare’s Privacy Policy (https://www.cloudflare.com/privacypolicy/).

B. Analytics & Performance Monitoring

We may use Google Analytics, PostHog, and similar tools to understand how visitors interact with our Services and to monitor performance. Google Analytics may collect information such as your IP address, browser type, device information, pages visited, time spent on pages, and other usage data, to generate website traffic reports and improve the Website’s functionality. You may opt out of Google Analytics by installing the Google Analytics Opt-out Add-on or adjusting your browser privacy settings.

PostHog may collect similar usage information, including pages viewed, session replay, clicks and other on-page interactions, referring URLs, device and browser information, approximate location derived from IP address, and error and performance data, to help us analyze product usage and monitor the Website’s performance. Where enabled, PostHog may also create session recordings and heatmaps that reflect how you navigate and interact with pages; we configure these features to mask form inputs and other sensitive fields. You may limit PostHog analytics by declining analytics cookies through our cookie banner. For more information, see PostHog’s Privacy Policy (https://posthog.com/privacy) and Google’s Privacy Policy (https://www.google.com/policies/privacy/).

C. Advertising Pixels & Conversion Tracking

We may use tracking technologies such as the Meta Pixel (or Facebook Conversion Tracking) to measure marketing campaign performance, understand audience engagement, and deliver more relevant advertising. These technologies may collect information such as your IP address, browser type, device identifiers, and pages visited, and may share and process it in accordance with their own policies and practices. For more information, see Meta’s Privacy Policy (https://www.facebook.com/privacy/policy/). You may manage preferences through your account settings or industry opt-out tools, such as those provided by the Digital Advertising Alliance.

D. Affiliate Networks

Our Website may contain affiliate links associated with platforms such as ShopMy and Amazon Associates, which process information under their own policies and practices. If you click an affiliate link, the affiliate network or platform may use cookies or similar technologies to track referral activity and collect information about your browsing and purchases. We may receive a commission for purchases made through affiliate links, but we generally do not receive data about individual users.

E. Newsletter Platform

We may distribute content through platforms such as Beehiiv, including newsletters, resources, and marketing materials hosted at noellebakesrealgood.beehiiv.com. When you subscribe to our communications, information such as your email address, subscription status, and engagement data may be collected and processed through the Beehiiv platform. To the extent we receive subscriber information through Beehiiv, we manage that information in accordance with this Privacy Policy and applicable data protection laws. Beehiiv may independently determine the purposes and means of processing personal information to operate its platform, including distribution, hosting, analytics, interactions, and payment. Subscription payment processing by Beehiiv is subject to its policies. You may manage your subscription preferences or unsubscribe at any time through the “Unsubscribe” link included in Beehiiv emails or your account settings. For more information, see Beehiiv’s Terms of Use and Privacy Policy.

Community Features. If we offer community features through Beehiiv (the “Community”), your participation is governed by Beehiiv’s Community Terms of Use and Privacy Policy, and you contract directly with Beehiiv. Content you post, including your profile name and comments, may be visible to other members and is processed by Beehiiv under its own policies, which may differ from how subscriber email data is processed on our behalf. We may moderate or remove content or participants that violate our Terms of Use or Beehiiv’s Acceptable Use Policy. Member posts reflect the poster’s views, not the Company’s, and we do not endorse them. Please do not post sensitive personal information.

F. Email Marketing Providers

We may use email marketing providers such as Mailchimp and ConvertKit to manage subscriptions and communications. When you subscribe to our emails, the provider may collect and store information such as your email address, name, subscription preferences, and engagement data. These providers process this information to deliver newsletters, manage preferences, and analyze engagement. You may unsubscribe at any time by clicking the “Unsubscribe” link included in our marketing communications.

G. Scheduling & Appointment Booking

Subject to availability, we may use scheduling platforms and providers to book consultations, meetings, or other services. When you request a booking, these third parties may collect your name, email address, appointment details, scheduling preferences, and any other information you choose to provide. Technical information, such as IP address, browser type, and device information, may also be collected and processed in accordance with the provider’s own policies. If payment is required, processing may be handled through integrated payment providers and platforms, which may collect payment and billing information in accordance with their respective policies. For more information, see Calendly’s Privacy Policy (https://calendly.com/privacy).

H. Payment Processors & Financial Services

We may use payment processors and financial service providers to facilitate purchases of our offerings. Payment information goes directly to the provider, which collects the billing, card, and transaction data needed to process the payment under its own policies. We do not store full payment card numbers or banking credentials, and we are not responsible for the privacy or security practices of these third parties.

I. Embedded Content & Social Media Features

Our Website may include embedded content or interactive features such as videos, social media posts, or audio provided by third-party platforms and providers like Instagram, YouTube, Twitter/X, Vimeo, or Spotify. Embedded content may behave as if you had visited those platforms directly, collect your personal information, and use cookies or similar tracking technologies to monitor your use. Your interactions with these features are governed by the terms and privacy policies of the third parties that provide them.

J. Future Third Party Services

We may use additional tools or service providers to support future analytics, communications, marketing, infrastructure, or other aspects of our Services. These third parties may collect or process information in accordance with their own privacy policies. If future services materially affect how personal information is processed, we will update our Privacy Policy accordingly.

7. Data Retention

We retain personal information for as long as reasonably necessary to provide and operate our Services, to comply with legal obligations, resolve disputes, enforce our agreements, and for other legitimate business purposes. Retention periods depend on the type of information, its purpose, and legal requirements. Typical periods include:

Contact information: Until you request deletion or approximately 3 years after our last interaction with you
Email newsletter subscriber information: Until you unsubscribe, plus a reasonable period necessary to process the request
Customer inquiries and support communications: Approximately 3 years after the last interaction
Payment and transaction records: 10 years for accounting, tax, legal, and compliance purposes, unless a longer retention period is required by law
Analytics data: Up to 26 months, depending on the provider’s settings and configuration
Cookies and similar tracking technologies: From session duration to approximately 26 months
Testimonials and case studies: Until you request removal or we stop using the content, unless otherwise agreed
Server logs and technical logs: Up to 90 days for security and operational purposes

Following the applicable retention period, we may securely delete, anonymize, or aggregate the personal information.

8. Data Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. No method of electronic transmission or storage is completely secure or can be guaranteed, but our safeguards include:

Encryption of data in transit (HTTPS/TLS)
Secure authentication and access controls
Restricted access to personal information on a need-to-know basis
Firewalls and other network security protections
Regular security updates, monitoring, and vulnerability management
Organizational and employee privacy training, and maintaining confidentiality obligations
Periodic reviews of security practices and systems

If you create an account associated with our Website or Services, or otherwise access protected portions of our Website, you must keep your credentials confidential and are responsible for activity under your account.

9. Children’s Privacy

Our Services are not directed to children under 13, and we do not knowingly collect their personal information. If we learn that we have inadvertently collected personal information from a child under 13, we will take reasonable steps to investigate and delete it promptly. If you are a parent or guardian and believe that a child has provided personal information to us without appropriate consent, please contact us at bakedgood@noellereyes.com.

10. General User Privacy & Data Requests

Depending on where you live, you may have the following rights and options regarding your personal information.

A. User Privacy & Data Request Options

To Access and Know. You may request the categories, purposes, and recipients of personal information we collect, use, and share about you, and where required by law, a copy in a structured, commonly used, and machine-readable format.
To Correct and Delete. You may request correction of inaccurate or incomplete personal information we maintain. Subject to certain legal exceptions, you may also request deletion of personal information we have collected, and, where required by law, we will request our service providers and contractors to delete it as well.
To Limit or Opt Out. You may opt out of the sale or sharing of your personal information, targeted advertising (including cross-context behavioral advertising), and profiling or automated decision-making that produces legal or similarly significant effects. Where applicable, you may also request that we limit the use and disclosure of your sensitive personal information. You may also opt out of marketing communications by clicking the unsubscribe link included in our communications.

B. Submitting Data Requests

To make a request, you may contact us through our Website’s contact form or at: bakedgood@noellereyes.com with “Data Request” in the subject line. Please include:

Your full name and email address(es) associated with the service
If relevant: account username or subscription information
The specific request you are making

Before acting on a request to access, correct, or delete personal information, we may verify your identity, asking only for the information reasonably necessary to do so. Opt-out requests do not require verification. We will respond to verified requests within forty-five (45) days. If additional time is needed due to the complexity of the request, we will notify you and provide an updated timeline.

C. Appealing Request Denials

Where required by applicable law, we will explain any denial, and you may have a right to appeal. To appeal, reply to our denial or email bakedgood@noellereyes.com with “Privacy Appeal” in the subject line within the applicable timeframe. We will respond to your appeal in writing within the period required by applicable law (generally 45 to 60 days after receipt), and our response will include the reasons for our decision and, where required, contact information for your state attorney general or supervisory authority.

11. State-Specific Notices

A. California Consumer Rights

This section provides notice to California residents subject to the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and related regulations.

Subject to certain legal exceptions, California residents may have the following rights regarding their personal information:

Right to Know the categories and specific pieces of personal information we may collect, use, disclose, or share, including data disclosed for business purposes.
Right to Delete personal information we have collected.
Right to Correct inaccurate personal information that we maintain.
Right to Opt Out of the sale or sharing of personal information for cross-context behavioral advertising.
Right to Limit Use or Disclosure of sensitive personal information.
Right to Non-Discrimination to receive equal treatment in the price or quality of goods or services, even if you exercise your privacy rights.

B. Categories of Personal Information

1. Personal Information Collected

In the last 12 months, our Services may have collected the following categories and examples of information:

Identifiers: name, email address, mailing address, account name, IP address, device identifiers, and cookies
Customer Records (Cal. Civ. Code § 1798.80(e)): name, postal address, telephone number, and payment or billing information
Characteristics of Protected Classifications under California or Federal Law: demographic information, such as age or gender, only if you choose to provide it, for example in a survey, testimonial, or communication
Commercial Information: transaction history, products and services purchased, or content accessed
Internet or Other Electronic Network Activity Information: browsing history, interactions with content, clicks, and pages visited
Geolocation Data: approximate location based on IP address
Sensory, Audio, Electronic, Visual, or Similar Information: information you submit, such as videos, photos, voice recordings, or recorded media
Professional or Employment-Related Information: provided in testimonials, correspondence, or case studies
Education Information: disclosed in communications or content submissions
Inferences: preferences or interests derived from browsing behavior or interactions
Biometric Information: none collected
Sensitive Personal Information: account log-in credentials in combination with passwords; payment account information collected through our payment processors. We do not collect or use other categories of sensitive personal information. California “sensitive personal information” is distinct from “special categories of personal data” under the GDPR, which are addressed in Section 12; the two concepts overlap but are governed by different laws.

2. Sources of Personal Information

We may collect personal information from the following categories of sources: (i) directly from you, when you contact us, subscribe to communications, create an account, submit content, download, request, or receive a link to a digital product, or make a purchase; (ii) automatically from your device and interactions with our Services, through cookies, analytics tools, server logs, and similar technologies; and (iii) from third parties that support our Services, including analytics and performance-monitoring providers, advertising and marketing partners, content distribution platforms, email service providers, scheduling platforms, affiliate networks and referral partners, customer support platforms, cloud storage and collaboration platforms, financial service providers, payment processors, hosting providers, content delivery networks, and security and fraud-prevention services.

3. Disclosures of Personal Information to Third Parties

We may disclose personal information, for the business and commercial purposes described in Section 11.C, to: (i) service providers and processors that operate our Services on our behalf (including analytics and performance monitoring; advertising and marketing platforms; newsletter distribution; email service; scheduling and appointment booking; hosting, content delivery, and infrastructure; financial services and payment processing; customer support; cloud storage and collaboration; and security and fraud-prevention providers); (ii) advertising, marketing, and measurement partners; (iii) content distribution platforms; (iv) affiliate networks and referral partners; (v) professional advisors and auditors; (vi) government authorities, regulators, and parties to legal proceedings, where required or permitted by law; and (vii) actual or prospective parties (and their advisors) to a corporate transaction such as a merger, acquisition, financing, reorganization, or sale of assets.

C. Business & Commercial Purposes

The Company may collect and use personal information for the following purposes:

Providing, maintaining, and improving our Services
Performing Services requested by users, including fulfilling contracts or accessing content
Communicating with users and responding to inquiries
Marketing and advertising
Conducting analytics to understand usage patterns and improve user experience
Detecting, preventing, and addressing fraud, security threats, or technical issues
Complying with legal obligations and duties
Enforcing agreements and protecting the rights, property, and safety of the Company, users, and the public
Any other purposes disclosed when or before personal information is collected

D. Sale & Sharing of Personal Information

The Company does not sell your personal information in exchange for money, and we do not knowingly sell or share the personal information of consumers under 16 years of age. However, our use of cookies, pixels, affiliate links, and advertising tools may count as “sharing” or “selling” personal information for targeted or cross-context behavioral advertising under applicable privacy laws. Where supported, you may opt out by:

Disabling non-essential cookies through our Website’s cookie banner
Clicking the “Your Privacy Choices” or similar link in our Website footer
Using a Global Privacy Control (GPC) signal through your browser or device
Adjusting advertising preferences within your account settings

E. Exercising California Rights

To exercise any applicable privacy rights, you may submit a verifiable consumer request through our Website’s contact form or email us at bakedgood@noellereyes.com with “California Rights Request” in the subject line. Please include:

Your full name and email address(es) associated with the service
If relevant: account username or subscription information
The specific right you are exercising

We may verify your identity before processing a request to know, delete, or correct, and will request only the information reasonably necessary to do so. Requests to opt out of sale or sharing or to limit use of sensitive personal information do not require verification. You may use an authorized agent to submit requests on your behalf; we may ask for proof of the agent’s authority and verify your identity. We will respond to verified requests within 45 days and, if we need up to 45 more days, will tell you why and when to expect a response. We will not charge a fee to process your request. We will respond to requests to know no more than twice in a 12-month period, or as legally required; this limit does not apply to requests to opt out of the sale or sharing of personal information or to limit the use of sensitive personal information, which you may also submit through the methods described in Section 11.D.

F. California Civil Code Section 1798.83 “Shine the Light” Law

California residents may request information about our disclosures of personal information to third parties for their own direct marketing purposes. The Company does not knowingly disclose personal information to third parties for their own direct marketing purposes.

G. Other U.S. State Residents

Residents of other states with comprehensive consumer privacy laws may have similar rights, subject to legal exceptions, including the right to confirm whether we process your personal information and to access, correct, delete, and obtain a portable copy of it; to opt out of the sale of personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects; to provide consent before we process or sell sensitive personal information (referred to as “sensitive data” under these laws), where required; to obtain a list of the specific third parties to which we have disclosed or sold your personal information, where required; to question the result of profiling that produces legal or similarly significant effects, where required; and to appeal a denied request as described in Section 10.C. Some state laws also allow you to direct us not to sell “covered information,” meaning personally identifiable information collected online, such as name, contact details, or other identifiers. You may opt out as described in Sections 5.B and 11.D. Under these laws, the Company acts as a “controller” of your personal information, and our service providers act as “processors.” We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects, and we do not collect, use, or sell personal information to train large language models.

Where required by applicable law, we recognize and respond to universal opt-out mechanisms and opt-out preference signals, such as Global Privacy Control, as valid requests to opt out of the sale or sharing of personal information and targeted advertising, as described in Section 5.D. If we process personal information for targeted advertising, it may constitute a “sale,” “sharing,” or “targeted advertising” under these laws, but we do not exchange covered information for monetary consideration for resale or licensing to others.

To exercise these rights, contact us through our Website’s contact form or at bakedgood@noellereyes.com with the request type in the subject line, and relevant state law if applicable. Where legally permitted, you may designate an authorized agent to submit requests, including opt-out requests, on your behalf. We will respond within the timeframe required by applicable law.

12. Notice to European Users

This section applies to users in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland, and provides notice of rights and disclosures under the General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (FADP), and other applicable data protection laws. Our Services are directed to users in the United States, and we do not target or market to residents of these jurisdictions; this section applies only to the extent those laws apply to us. Where the GDPR applies, the age of digital consent is 16 unless your country sets a lower age (not below 13); below that age, consent must come from a parent or guardian. We do not intentionally collect special categories of personal data such as health data or data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data; biometric data used for unique identification; or sexual orientation. If you choose to share such data with us, for example in a message or submitted content, we will process it only where an exception under Article 9 of the GDPR applies, such as your explicit consent.

A. Legal Bases

Where applicable, we may process personal data on the following legal bases:

Consent for a specific purpose, such as subscribing to communications (including opting in when you download, request, or receive a link to a digital product) or accepting non-essential cookies, including targeted advertising and retargeting. You may withdraw consent at any time. Analytics that use non-essential cookies are based on your consent; other measurement of our Services is based on our legitimate interests in understanding and improving them.
Contract to provide our Services and fulfill our duties.
Legal obligation to comply with applicable laws or processes, such as tax, accounting, or regulatory requirements.
Legitimate interests of ours or a third party’s, provided such interests are not overridden by your rights and interests. This may include operating and improving our Services, conducting analytics, maintaining security, preventing fraud or abuse, and responding to inquiries.
Other lawful bases where required or permitted by applicable law.

B. GDPR Rights

If you are located in one of the GDPR jurisdictions, you may have the following rights, subject to applicable legal limits and exceptions:

Right to access and know the personal data we hold about you.
Right to correction or rectification of inaccurate or incomplete personal data.
Right to erasure and deletion of your personal data (“right to be forgotten”), subject to legal exceptions where retention is required to comply with legal obligations, complete transactions you have requested, resolve disputes, enforce agreements, or for other legitimate business purposes.
Right to restrict and limit how we process your personal data in certain circumstances.
Right to data portability and to request a copy of your personal data in a structured, commonly used, and machine-readable format and, where technically feasible, request transmission to another controller.
Right to object to certain processing, including direct marketing, targeted advertising, related profiling, and processing based on our legitimate interests if it relates to your particular situation. We may continue processing only if we have compelling legitimate grounds or a legal obligation to continue.
Right not to be subject to automated decision-making that produces legal or similarly significant effects (the Company does not engage in such automated decision-making).
Right to lodge a complaint with your local data protection authority.

C. International Data Transfer

We operate primarily in the United States, and your information may be transferred to, stored, and processed in jurisdictions where our service providers or their sub-processors operate. Where required, we rely on appropriate safeguards for international data transfers, such as the Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, and equivalent safeguards recognized under Swiss law, or other lawful transfer mechanisms.

D. Exercising GDPR Rights

To exercise GDPR rights, you may contact us at: bakedgood@noellereyes.com with “GDPR Rights Request” in the subject line. Please include:

Your full name and email address(es) associated with the service
If relevant: account username or subscription information
The specific right you are exercising

We may verify your identity before processing your request and will request only the information reasonably necessary to do so. We will respond to verified requests within thirty (30) days, or within the timeframe required by applicable law, and may extend that period by up to two additional months if necessary. Where requests are manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or decline to act on the request. If you believe your rights have been violated, you may lodge a complaint with your local data protection authority.

Disputes relating to this Privacy Policy are governed by the governing law and dispute resolution provisions of our Website Terms of Use, except where applicable data protection law gives you the right to bring a claim in the courts of, or under the law of, your country of residence. Nothing in this Privacy Policy limits your right to lodge a complaint with your local data protection authority, supervisory authority, or commissioner, or to seek a judicial remedy.

13. Data Breach Notification

If a data breach involves unauthorized access to or acquisition of personal information, we will take reasonable steps to investigate and respond, and will notify affected individuals and regulators as required by applicable data breach notification laws and within the timeframes those laws require, including, where the GDPR applies, notice to the supervisory authority within 72 hours where feasible. Our response may include:

Investigating the breach and assessing the information involved and the risks
Notifying affected individuals and regulators through reasonable means and providing information about the breach and steps individuals may take
Taking measures to mitigate harm and prevent similar incidents
Cooperating with law enforcement where appropriate

In some cases, notification may be delayed as legally permitted, or as requested by law enforcement.

14. Privacy Policy Updates

We may update this Policy to reflect changes in our practices, technology, legal requirements, or operations. We review this Policy at least annually and keep a record of prior versions and material changes, available on request. Please check back periodically. If we make material changes to how we collect or process personal information, we may:

Post the updated Privacy Policy with a revised “Last Updated” date;
Provide notice through our Website or by email if the changes affect your rights; or
Obtain your consent, where required.

To the extent permitted by applicable law, your continued use of the Services after any update constitutes your acceptance of the revised Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding our Privacy Policy or practices, please contact:

Noelle Reyes, Owner
Email: bakedgood@noellereyes.com
Phone: (646) 598-9864
Address: 99 Wall St. #4714, New York, NY 10005