Privacy Policy

1. Information We Collect

1.1 Information You Provide When Creating an Account

When you register for an account, we collect:

• First name and last name
• Title or job title (optional)
• Company name
• Industry
• Phone number
• Email address
• Password (stored encrypted — never in plain text)
• How you heard about HighLite (optional)

For Organization accounts, we also collect:

• Company website
• Organization settings including spending limits and buyer permissions

1.2 Information You Provide When Shopping and Checking Out

When you place an order, we collect:

• Shipping address (street address, apt/suite/unit, city, state, ZIP code)
• Card brand, last 4 digits, and expiry date — your full card number and CVC are never seen or stored by HighLite; they go directly from your browser to Stripe
• Order details including products ordered, quantities, unit prices, and order totals
• Shipping method selected
• Tax amount calculated based on your shipping address
• A Stripe Payment Intent ID (a transaction reference number, not payment data)

1.3 Information You Provide When Using Account Features

Subscribe & Save: Product, quantity, frequency, and next order date for recurring orders.

Messages: Subject, category, and body text of messages sent through the Message Center.

Return requests: Order ID and reason for return.

Tax exemption: If you upload a tax exemption certificate, we store the file securely.

Addresses: Shipping addresses saved to your account.

Payment methods: Card brand, last 4 digits, and expiry date saved via Stripe.

1.4 Information You Provide Through Our Forms

Contact form: Name, company, industry, email, phone, and message.

Bulk Order Quote form: Name, company, industry, email, phone, product list, quantities, and message.

1.5 Information Generated Automatically by Your Activity

Spending reports: Monthly order totals and order counts are calculated automatically from your order history.

Order history: A complete record of all orders placed through your account.

1.6 Cookies and Browser Storage

We use minimal cookies and browser storage:

Cookies:

• Sidebar state — remembers whether the admin sidebar is open or closed (admin users only, 7-day duration)
• Stripe fraud prevention cookies — set automatically by Stripe when the payment form loads, used by Stripe for fraud prevention. These are Stripe's cookies, not HighLite's.

Browser localStorage:

• Supabase authentication session tokens — keeps you signed in
• Saved/favorite items — stores product details of items you have saved
• Cookie acknowledgment (California customers only) — records that you acknowledged cookie use at checkout

We do not use any analytics, tracking, or advertising cookies. We do not use Google Analytics, Meta Pixel, or any similar tracking service.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Process and fulfill your orders
• Calculate and collect applicable sales tax
• Send transactional emails — order confirmations, shipping notifications, quote responses, return updates, and password resets
• Respond to messages, contact form submissions, and bulk order quote requests
• Verify your phone number when you update it
• Apply industry-specific pricing discounts automatically
• Generate spending reports for your account
• Prevent fraud and ensure the security of the Site
• Comply with legal obligations including tax collection and reporting

We do not send marketing or promotional emails.

3. How We Share Your Information

We do not sell, trade, or rent your personal information to any third party. We share your information only with the following service providers who help us operate the Site:

Stripe

We use Stripe to process payments. When you check out, your name, email address, shipping address, order amounts, tax status, and card details are sent to Stripe. Card numbers go directly from your browser to Stripe — they never pass through HighLite's servers. Stripe is a PCI-DSS Level 1 certified payment processor. Stripe's Privacy Policy is available at stripe.com/privacy.

Resend

We use Resend to send transactional emails. Your name, email address, order details, and shipping address are shared with Resend solely for the purpose of delivering emails you expect to receive — such as order confirmations and shipping notifications. Resend does not use this information for any other purpose.

US Census Bureau Geocoder

When you enter a shipping address at checkout, we send your address to the US Census Bureau's free geocoding service to validate and suggest a standardized address format. No API key is used and no personal account information is sent — only the address itself.

Google Fonts

Our Site uses Google Fonts to display text. When your browser loads a page, it makes a standard request to Google's servers which may include your IP address and browser type. No account or personal information is shared.

Supabase

Supabase provides our database, file storage, and authentication infrastructure. All customer data is stored on Supabase's servers. Supabase's Privacy Policy is available at supabase.com/privacy.

Shipping Carriers

We share your name and shipping address with UPS and FedEx to fulfill and deliver your orders.

Legal Requirements

We may disclose your information if required by law or in response to valid legal requests such as a court order or government inquiry.

4. Data We Do Not Collect

To be clear about what we do not collect:

• We do not collect your IP address
• We do not track pages you visit or time spent on pages
• We do not collect device information beyond what Google Fonts receives as a standard browser request
• We do not use any analytics or behavioral tracking tools
• We do not collect full credit card numbers or CVCs — ever
• We do not share your data with advertisers

5. Data Security

We take reasonable measures to protect your personal information including:

• Encrypted data transmission (HTTPS/SSL) on all pages
• Passwords stored using industry-standard encryption — never in plain text
• Payment data handled exclusively by Stripe — HighLite never sees or stores full card numbers
• Row-level security on all database tables — customers can only access their own data
• Access controls limiting which staff can view customer information
• Server-side price validation — order amounts cannot be manipulated from the browser

No method of transmission over the Internet is 100% secure. While we take security seriously, we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services, fulfill orders, comply with legal obligations, and resolve disputes.

If you wish to close your account or request deletion of your data, please contact us at info@highlite.online. Note that we may be required to retain certain records such as order history and tax records for legal and accounting purposes.

7. Your Rights

You have the following rights regarding your personal information:

• Access: Request a copy of the information we hold about you
• Correction: Update inaccurate information through your account dashboard or by contacting us
• Deletion: Request deletion of your account and personal data, subject to legal retention requirements
• Portability: Request your data in a structured format

California residents have additional rights under the California Consumer Privacy Act (CCPA) including the right to know what personal information is collected, the right to delete personal information, and the right to non-discrimination for exercising your rights. To exercise any CCPA rights, contact us at info@highlite.online.

To exercise any of these rights, please contact us at info@highlite.online.

8. Children's Privacy

The Site is intended for business use by adults. We do not knowingly collect personal information from anyone under the age of 13. If we become aware that we have collected information from a child under 13, we will delete it promptly.

9. Third-Party Links

The Site may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Your continued use of the Site after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or how we handle your information, please contact us:

HighLite inc.
130 Lee Ave. #367
Brooklyn, NY 11211
info@highlite.online