Privacy policy

FirstStep is operated by Kanova LLC. FirstStep operates this store and website, including all related information, content, features, tools, products, and services, in order to provide you, the customer, with a curated shopping experience (the "Services").

Our website and ecommerce services are powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services, or otherwise communicate with us.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described below.

Personal Information We Collect or Process

When we use the term "personal information," we mean information that identifies or can reasonably be linked to you or another person.

Personal information does not include information that has been collected anonymously or de-identified so that it cannot reasonably be linked to you.

Depending on how you interact with the Services, where you live, and as permitted or required by applicable law, we may collect or process:

  • Contact details, including your name, billing address, shipping address, phone number, and email address.
  • Financial and payment information, including payment method information, transaction details, payment confirmations, and related payment information. Payment information may be processed directly by Shopify or other payment processors rather than stored directly by Kanova LLC.
  • Account information, including usernames, passwords, preferences, and account settings where applicable.
  • Transaction information, including products you view, add to your cart, purchase, return, exchange, or cancel, as well as your past transactions.
  • Communications with us, including information you provide when contacting customer support or submitting a question, return request, or other inquiry.
  • Device and technical information, including your device type, browser, network connection, IP address, cookie identifiers, and similar technical identifiers.
  • Usage information, including how you interact with, navigate, and use the Services.
  • Marketing and attribution information, which may include advertising identifiers, referral information, campaign parameters, pages viewed, and interactions used to understand advertising and marketing performance.

Personal Information Sources

We may collect personal information:

  • directly from you;
  • automatically when you use the Services;
  • through cookies, pixels, local storage, and similar technologies;
  • from Shopify and other service providers acting on our behalf;
  • from advertising, analytics, and marketing providers; and
  • from partners or other third parties where permitted by law.

How We Use Your Personal Information

Depending on how you interact with us, we may use personal information for the following purposes.

Providing and Improving the Services

We may use your personal information to:

  • process payments and orders;
  • arrange fulfillment and shipping;
  • manage returns, refunds, and exchanges;
  • provide customer support;
  • remember preferences;
  • maintain accounts;
  • improve the website and customer experience;
  • understand how customers interact with our pages; and
  • maintain and improve the operation of the Services.

Marketing and Advertising

We may use personal information for marketing and promotional purposes, including:

  • sending marketing or promotional emails where permitted;
  • measuring advertising performance;
  • attributing visits or purchases to advertising campaigns;
  • showing advertisements on third-party platforms;
  • understanding which advertisements or campaigns lead customers to our website; and
  • creating or measuring audiences used for advertising.

You may opt out of promotional emails at any time by using the unsubscribe link included in those communications.

Security and Fraud Prevention

We may use personal information to provide a secure shopping experience, authenticate accounts where applicable, detect or investigate fraudulent or unlawful activity, protect our business and customers, and enforce our terms and policies.

Communicating With You

We use personal information to respond to questions, provide customer service, send order and shipping information, process returns and refunds, and maintain our relationship with you.

Legal and Compliance Purposes

We may process personal information where necessary to comply with applicable laws, respond to lawful government or legal requests, investigate or defend legal claims, or enforce our policies and agreements.

Cookies, Analytics, Advertising, and Marketing Technologies

FirstStep uses cookies, pixels, local storage, and similar technologies to operate the website, understand customer behavior, measure advertising performance, and provide marketing services.

Depending on your interaction with the Services, these providers may include:

  • Shopify, which provides ecommerce, storefront, checkout, payment, and related infrastructure;
  • Omnisend, which may process email addresses and related information used for email capture and marketing communications;
  • Meta Platforms, including the Meta Pixel, which may be used for advertising measurement, attribution, audience creation, and advertising purposes;
  • Microsoft Clarity, which may be used to understand website usage and interactions and improve site usability; and
  • Triple Whale, which may be used for marketing attribution, analytics, and measurement.

These providers may receive information such as device identifiers, IP address, browser information, pages viewed, referral information, campaign identifiers, website interactions, and transaction or conversion information, depending on the service being used.

Their handling of personal information is also governed by their own privacy policies and applicable agreements with us.

How We Disclose Personal Information

In certain circumstances, we may disclose personal information to third parties for legitimate business purposes.

These circumstances may include disclosure:

  • to Shopify and other vendors that provide ecommerce, payment processing, IT, cloud hosting, fulfillment, shipping, analytics, customer support, and similar services;
  • to Omnisend and other communications providers used to deliver customer or marketing emails;
  • to Meta and other advertising providers for advertising, attribution, measurement, and audience-related purposes;
  • to Microsoft Clarity, Triple Whale, and other analytics or attribution providers;
  • when you request or consent to a disclosure;
  • to fulfillment or shipping providers where necessary to deliver your order;
  • in connection with a merger, acquisition, financing, restructuring, sale, bankruptcy, or similar business transaction; and
  • where required by law or necessary to protect our rights, customers, business, or Services.

We do not sell personal information in exchange for money.

However, certain privacy laws may define the disclosure of information to advertising providers for targeted or cross-context behavioral advertising as a "sale" or "sharing" of personal information.

Where applicable, you may opt out of these uses here:

Data Sharing Opt-Out

Relationship With Shopify

The Services are hosted and supported by Shopify.

Shopify collects and processes personal information about access to and use of the Services in order to provide and improve Shopify's services and the functionality used by FirstStep.

Information submitted through the Services may therefore be transmitted to and processed by Shopify and other service providers, including providers located outside the country where you reside.

Shopify may also process information obtained from interactions with our store in connection with certain Shopify features and services.

For information regarding Shopify's own processing practices and privacy rights, you may review Shopify's applicable consumer privacy documentation.

Third-Party Websites and Links

The Services may contain links to websites or platforms operated by third parties.

If you follow a link to a third-party website or service, you should review that provider's privacy and security policies.

We are not responsible for the privacy, security, accuracy, or practices of websites that we do not operate or control.

Children's Data

The Services are not intended for children, and we do not knowingly collect personal information from children under the age at which they may legally provide such information in their jurisdiction.

If you are a parent or guardian and believe a child has provided us with personal information, you may contact us to request deletion.

As of the effective date of this Privacy Policy, we do not have actual knowledge that we sell or share personal information, as those terms are defined by applicable privacy laws, concerning individuals under 16 years of age.

Security and Retention of Your Information

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information.

However, no security measure or transmission method can be guaranteed to be completely secure.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

  • providing and maintaining the Services;
  • completing and documenting transactions;
  • providing customer service;
  • maintaining marketing preferences and consent records;
  • preventing fraud or abuse;
  • complying with tax, accounting, legal, and regulatory obligations;
  • resolving disputes; and
  • enforcing contracts and policies.

The specific retention period may vary depending on the type of information, why it was collected, our legal obligations, and whether the information is needed to establish, exercise, or defend legal claims.

Third-party providers such as Shopify, Omnisend, Meta, Microsoft Clarity, and Triple Whale may maintain information according to their own retention practices and agreements.

Your Rights and Choices

Depending on where you live, you may have rights concerning your personal information.

These may include:

  • Right to Access or Know — requesting information about personal information we maintain about you.
  • Right to Delete — requesting deletion of certain personal information.
  • Right to Correct — requesting correction of inaccurate personal information.
  • Right to Portability — requesting a copy of certain personal information in a portable format.
  • Right to Opt Out of Sale, Sharing, or Targeted Advertising — where applicable under local privacy law.
  • Right to Manage Marketing Communications — opting out of promotional emails using the unsubscribe option included in those emails.

You may exercise applicable advertising opt-out rights here:

Data Sharing Opt-Out

Where required by applicable law, we will also recognize qualifying Global Privacy Control signals.

We may need to verify your identity before fulfilling certain privacy requests.

You may also be permitted to designate an authorized agent to submit a request on your behalf, subject to applicable verification requirements.

We will not discriminate against you for exercising privacy rights provided by applicable law.

Complaints

If you have concerns or complaints about how we process personal information, please contact us using the information below.

Depending on where you live, you may also have the right to appeal a decision relating to a privacy request or submit a complaint to an applicable data protection authority.

International Transfers

Personal information may be transferred, stored, or processed outside the country in which you live.

Where applicable law requires safeguards for international transfers, we or our service providers may rely on recognized transfer mechanisms, including Standard Contractual Clauses or other legally recognized safeguards.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal obligations, or other operational requirements.

When we make changes, we will update the "Last updated" date and provide any additional notice required by applicable law.

Contact

FirstStep is operated by Kanova LLC.

For privacy questions, customer support, or requests to exercise applicable privacy rights:

Email: support@sleepflexpf.com
We respond within 1 business day.

Business address (legal correspondence only — not a return address):

Kanova LLC
30 N Gould St, Ste N
Sheridan, WY 82801
United States

Wyoming Entity ID: 2025-001740729

Please contact support@sleepflexpf.com before sending any product return.