Privacy Policy

Craig Frames, LLC (d/b/a Frame USA, Craig Frames) | Effective Date: August 13, 2026

Craig Frames, LLC, a Delaware limited liability company ("Craig Frames," "we," "us," or "our"), respects your privacy. This Privacy Policy describes the categories of personal information we collect, how we use and share it, and the rights and choices you have with respect to your information. This Privacy Policy applies to personal information we collect through our websites, including frameusa.com and craigframes.com (each a "Site" and collectively the "Sites"), and through related telephone, email, and offline channels (collectively, the "Services").

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is incorporated into our Terms and Conditions.

1. Information We Collect

1.1 Information You Provide. We collect personal information you provide when you create an account, place an Order, contact Customer Service, submit User Content, sign up for marketing communications, apply for wholesale credit, enroll in a loyalty or referral program (when offered), or otherwise interact with us. This may include:

• Identifiers — name, email address, postal/shipping address, telephone number, and account credentials.
• Commercial information — Order history, products purchased, payment method information (collected and processed by our payment processors), and customer service inquiries.
• Wholesale credit information — for Wholesale Customers applying for credit, business information, trade references, financial information sufficient to assess creditworthiness, and tax identification numbers.
• Loyalty and referral information — for Customers who enroll in a loyalty, rewards, or referral program (when offered), program-specific identifiers, balance/points history, redemption history, and referrer/referee relationship data.
• User Content — images, designs, text, and other content you upload for custom printing or otherwise submit.
• Marketing preferences — opt-in to email or SMS marketing and related preferences.

1.2 Information Collected Automatically. When you use the Services, we and our service providers automatically collect:

• Device and browser information — IP address, device identifiers, browser type and version, operating system, language preferences, referring URLs, and timestamps.
• Usage information — pages viewed, links clicked, products viewed, search queries, time spent on pages, and similar interaction data.
• Location information — general geographic location inferred from IP address.
• Cookies and similar technologies — see Section 5.

1.3 Information from Third Parties. We may receive information about you from third parties, including:

• Service providers and platforms (such as Shopify, our customer relationship management platform, marketing platforms, analytics providers, and fraud prevention services).
• Advertising and analytics partners whose tracking technologies operate on the Sites, including Google (Google Ads, Google Analytics 4), Meta (Facebook/Instagram), Microsoft Advertising (Bing), Pinterest, and HubSpot, session-recording/heatmap providers such as Hotjar and Microsoft Clarity, and review-collection providers such as Judge.me, each of which may share information about your interaction with our advertisements and the Services. The specific technologies active on each Site are identified in Section 5.5.
• Trade references and credit bureaus (for Wholesale Customers applying for credit).
• Social media platforms, if you choose to interact with our content or sign in through a social account.

2. Categories of Personal Information We Have Collected (Past 12 Months)

For purposes of the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA") and similar state laws, we may have collected the following categories of personal information about consumers in the preceding twelve (12) months:

• Identifiers (Cal. Civ. Code § 1798.140(o)(1)(A)).
• Customer records information (Cal. Civ. Code § 1798.80(e)).
• Commercial information.
• Internet or other electronic network activity information.
• Geolocation data (general).
• Visual information (in the form of User Content submitted for printing).
• Professional or employment-related information (for Wholesale Customers).
• Inferences drawn from the above categories.

We do not knowingly collect sensitive personal information as defined under CCPA/CPRA for the purpose of inferring characteristics about you. We do not knowingly collect biometric information, precise geolocation, or government identification numbers (other than tax identification numbers from Wholesale Customers).

3. How We Use Information

We use personal information for the following business purposes:

• Processing and fulfilling Orders, including order management, shipping, returns, and customer service.
• Processing payments and detecting and preventing fraud.
• Operating, maintaining, securing, and improving the Services.
• Personalizing your experience, including product recommendations.
• Communicating with you about Orders, account activity, security alerts, and Services updates.
• Marketing and advertising, including email, SMS, and online advertising, subject to your consent where required.
• Operating loyalty, rewards, or referral programs (when offered) and providing the benefits associated with them.
• Analytics and measurement of the performance of the Services and our marketing.
• Assessing creditworthiness for Wholesale Customers.
• Complying with legal obligations, responding to subpoenas or other lawful requests, and enforcing our rights.
• Other purposes for which we provide specific notice at the time of collection.

4. How We Share Information

4.1 Service Providers. We share personal information with service providers that perform services on our behalf and are contractually limited to using the information for those purposes. Categories of service providers include:

• E-commerce platform and storefront hosting (Shopify).
• Payment processing (including Shopify Payments, PayPal, and similar providers).
• Customer relationship management and customer service tools (HubSpot).
• Marketing platforms for email and SMS campaigns (such as our email/SMS service provider).
• Loyalty, rewards, and referral program platforms (when offered).
• Analytics and measurement (such as Google Analytics 4 and similar tools).
• Advertising platforms for measurement and audience-building: Google Ads (both Sites); and, on frameusa.com only, Microsoft Advertising (Bing), Meta (Facebook/Instagram), and Pinterest.
• Shipping carriers and logistics providers.
• Tax compliance providers.
• Review and reputation management providers.
• Fraud prevention and security providers.
• Professional advisors (accountants, lawyers, auditors).

4.2 Sale or Sharing of Personal Information. Under CCPA/CPRA and similar state laws, certain disclosures of personal information for cross-context behavioral advertising are considered a "sale" or "sharing" of personal information, even when no money changes hands. We may share identifiers and internet activity information with advertising partners through cookies and pixels for cross-context behavioral advertising. You have the right to opt out of such sharing, as set forth in Section 7.

4.3 Business Transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of company assets, or transition of service to another provider, your personal information may be transferred as part of that transaction, subject to standard confidentiality undertakings.

4.4 Legal and Safety. We may disclose personal information when we believe in good faith that disclosure is necessary to (a) comply with applicable law or legal process (including subpoenas and court orders), (b) protect the rights, property, or safety of Craig Frames, our customers, or others, (c) detect, prevent, or address fraud, security, or technical issues, or (d) enforce our Terms or other agreements.

4.5 With Your Consent. We may share your personal information with your consent or at your direction.

5. Cookies and Tracking Technologies

5.1 Cookies. We and our service providers use cookies, pixels, software development kits, web beacons, and similar technologies to operate the Services, analyze usage, personalize content, and deliver advertising. Some are strictly necessary for the Services to function; others enable analytics, personalization, or advertising and require your consent in some jurisdictions.

5.2 Categories. We use the following categories of cookies and similar technologies: strictly necessary, performance/analytics, functional, and advertising/targeting.

5.3 Your Choices. You may manage cookies through your browser settings. For advertising and analytics cookies, we operate on a notice-and-opt-out basis: you may opt out through the controls described in Section 7, via industry tools such as the Digital Advertising Alliance opt-out (https://optout.aboutads.info/) and the Network Advertising Initiative opt-out (https://optout.networkadvertising.org/), and by honoring Global Privacy Control signals as described in Section 7.4. Where applicable law requires consent before a specific category of non-essential cookie or similar technology is activated, we display a consent mechanism (for example, a cookie banner) that lets you accept or decline that category before it activates; where no such requirement applies, that category operates on the opt-out basis described in this Section.

5.4 Do Not Track. We do not currently respond to browser Do Not Track signals other than as required by CCPA/CPRA and similar state laws (see Section 7).

5.5 Technologies Currently Active on Our Sites. As of the Effective Date, the following tracking, analytics, and advertising technologies operate on each Site:

• frameusa.com — Google Ads, Google Analytics 4, Microsoft Advertising (Bing), Meta Pixel (Facebook/Instagram), Pinterest Tag, HubSpot, Hotjar (session-replay and heatmap analytics), Microsoft Clarity (session-replay and heatmap analytics), and Judge.me (product review collection and display).
• craigframes.com — Google Ads, Google Analytics 4, HubSpot, and Microsoft Clarity (session-replay and heatmap analytics).
This list reflects the technologies deployed as of the Effective Date and is reviewed each time a new tracking technology is added to or removed from either Site.

5.6 Session-Replay and Heatmap Technology. Where used (currently Hotjar on frameusa.com, and Microsoft Clarity on both frameusa.com and craigframes.com), session-replay and heatmap tools record aggregated user interactions (for example, mouse movement, clicks, scrolling, and page navigation) to help us understand and improve usability. These tools are configured to mask or exclude form fields and other elements likely to contain payment card information, passwords, or other sensitive personal information, consistent with the provider's masking capabilities. We obtain your consent before activating session-replay and heatmap technology in jurisdictions where applicable law requires consent for that category of technology; where consent is not legally required, session-replay and heatmap technology operates on the opt-out basis described in Section 5.3.

6. SMS Marketing

Craig Frames may, from time to time, offer SMS marketing through the Services. The following terms apply if and when SMS marketing is offered:
6.1 Consent Required. If you opt in to SMS marketing through the Services, you provide express written consent to receive marketing text messages from Craig Frames at the mobile number you provide. Consent is not a condition of any purchase.

6.2 Frequency; Rates. Message frequency varies. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

6.3 HELP and STOP. Reply HELP for help. Reply STOP to opt out. You may also opt out at any time by contacting us at the address in Section 14. Opting out of SMS marketing does not affect other communications related to your account or Orders.

6.4 Eligibility. SMS marketing is available only in the United States and only to subscribers age 18 or older.

6.5 Privacy. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support of services we provide to you (e.g., text-message platform vendors) is permitted. All other use will follow this Privacy Policy.

7. Your Rights and Choices

7.1 Marketing Choices. You may opt out of marketing emails by clicking the unsubscribe link in any marketing email or contacting us. You may opt out of marketing SMS messages by replying STOP. Even if you opt out of marketing communications, we may still send you transactional and service messages about your Orders, account, or security.

7.2 State Privacy Rights. Depending on your state of residence, you may have rights under one or more of the following state privacy laws (all of which provide a substantially similar package of rights, with state-specific variations):

• California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA).
• Virginia Consumer Data Protection Act (VCDPA).
• Colorado Privacy Act (CPA).
• Connecticut Data Privacy Act (CTDPA).
• Utah Consumer Privacy Act (UCPA).
• Texas Data Privacy and Security Act (TDPSA).
• Oregon Consumer Privacy Act (OCPA).
• Montana Consumer Data Privacy Act (MCDPA).
• Tennessee Information Protection Act (TIPA).
• Iowa Consumer Data Protection Act (ICDPA).
• Indiana Consumer Data Protection Act (INCDPA).
• Delaware Personal Data Privacy Act (DPDPA).
• New Jersey Data Privacy Act (NJDPA).
• New Hampshire Privacy Act.
• Nebraska Data Privacy Act (NDPA).
• Minnesota Consumer Data Privacy Act (MCDPA).
• Maryland Online Data Privacy Act (MODPA).
• Kentucky Consumer Data Protection Act (KCDPA).
• Rhode Island Data Transparency and Privacy Protection Act.
• Arkansas Consumer Data Privacy Act (ACDPA).

This list reflects state comprehensive privacy laws in effect as of the Effective Date of this Policy and will be updated as additional states enact comparable laws or as existing laws are amended; if a state where you reside enacts a comparable law not yet listed here, we will extend to you the rights such law provides.

Subject to applicable exemptions, you may have the following rights:

• Right to know — the categories and specific pieces of personal information we have collected, sources, purposes, and categories of third parties to whom we have disclosed it.
• Right to access / receive a copy — a portable copy of your personal information.
• Right to delete — request deletion of personal information we have collected from you, subject to exceptions under applicable law.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising.
• Right to opt out of profiling / targeted advertising — in states where applicable.
• Right to limit use of sensitive personal information — where applicable.
• Right to non-discrimination — we will not deny goods or services, charge different prices, or provide a different level of service because you exercise a privacy right, except as permitted by law.
• Right to appeal — in states that provide it, the right to appeal a denial of a request.

7.3 How to Exercise Your Rights. To exercise any of the rights above, please submit a request through one of the following methods:

• Email: info@craigframes.com
• Mail: Craig Frames, LLC, Attn: Privacy, 140 Industrial Parkway, Ithaca, Michigan 48847
• Toll-free: 1-800-577-5920
We will respond within the time required by applicable law (generally 45 days, extendable by up to 45 additional days where reasonably necessary). We will verify your identity before responding. An authorized agent may submit a request on your behalf with proof of authority.

7.4 Global Privacy Control (GPC). We honor browser-based universal opt-out preference signals, including the Global Privacy Control, where required by applicable law. When we detect a GPC signal from your browser, we will treat it as an opt-out of the "sale" and "sharing" of personal information for the browser and, where reasonably possible, the associated account.

7.5 California Shine the Light. California residents may request information about disclosures of personal information to third parties for those third parties' direct marketing purposes (Cal. Civ. Code § 1798.83). To make such a request, contact us at the addresses above.

7.6 Notice of Financial Incentive (Loyalty and Referral Programs). From time to time, Craig Frames may offer loyalty, rewards, or referral programs that provide financial incentives (such as discounts, points, free Products, or referral rewards) in exchange for the collection, use, or retention of personal information. Where offered, these programs constitute a "financial incentive" under CCPA/CPRA, and the following disclosures apply:

• Material Terms. Material terms of the program (eligibility, points or rewards structure, redemption rules, expiration, and termination) will be disclosed at the time of enrollment and on a program-specific page.
• Categories of Personal Information Collected. Identifiers (such as name, email, mobile number), commercial information (such as purchase history), and program-specific identifiers (such as points balances and referral relationships).
• How to Opt In. You opt in to a program by signing up through the program-specific enrollment page or interface.
• How to Withdraw. You may withdraw from the program at any time by contacting us at info@craigframes.com or by following the withdrawal instructions in the program-specific terms. Withdrawal terminates eligibility for future rewards and may result in forfeiture of unredeemed rewards as set forth in the program-specific terms.
• Good-Faith Estimate of Value. Craig Frames offers loyalty and referral incentives because they encourage repeat purchasing and customer acquisition. The value to Craig Frames of a participating customer's personal information is reasonably related to the cost of the incentive offered. Craig Frames calculates this value based on the expected difference in lifetime purchase activity between program participants and non-participants, the cost of the rewards provided, and customary attribution methodologies for referral marketing.
• Non-Discrimination. Differences in price, level, or quality of Products available to program participants and non-participants are reasonably related to the value to Craig Frames of the personal information used in the program and are not unlawful discrimination under CCPA/CPRA.

8. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child under 13 has provided personal information to us, please contact us at info@craigframes.com.
If a Customer submits User Content that includes images of minors, the Customer is responsible for ensuring that the use complies with applicable law and that the Customer has all necessary authorizations.

9. Data Retention

We retain personal information for as long as necessary to provide the Services and fulfill the purposes described in this Privacy Policy, including to comply with our legal, accounting, tax, and reporting obligations, and to enforce our agreements. Retention periods vary by category. As a general matter, Order and transaction records are retained for at least seven (7) years (consistent with tax and accounting requirements), marketing preferences are retained until you opt out, and account data is retained while the account is active and for a reasonable period thereafter. We may anonymize or aggregate personal information for analytical purposes, in which case the resulting information is no longer personal information.

10. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, alteration, and disclosure. However, no method of transmission over the Internet or storage system is fully secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and applicable regulators as required by law.

11. International Users and Transfers

The Services are operated from the United States and intended for U.S. users. If you access the Services from outside the United States, you understand that your personal information may be transferred to, stored, and processed in the United States and other jurisdictions where data protection laws may differ from those in your jurisdiction.

Canadian users: We process Canadian personal information in accordance with applicable Canadian privacy law, including PIPEDA. Quebec residents may have additional rights under Quebec Law 25; please contact us using the methods in Section 7.3 to exercise those rights.

12. Third-Party Services and Links

The Services may contain links to third-party websites, applications, or services that are not operated by Craig Frames. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy practices of any third party before providing personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised Privacy Policy with a new "Effective Date." If we make material changes, we will provide additional notice as required by applicable law, which may include email notice or prominent notice on the Services. Your continued use of the Services after the Effective Date constitutes acceptance of the revised Privacy Policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices:
• Email: info@craigframes.com
• Mail: Craig Frames, LLC, Attn: Privacy, 140 Industrial Parkway, Ithaca, Michigan 48847
• Telephone: 1-800-577-5920 (Frame USA) or 1-877-875-6641 (Craig Frames)