Privacy policy

Last updated: September 7, 2026

World Matcha Inc.("Cuzen Matcha," "we," "us," or "our") operates this store and website at cuzenmatcha.com, including all related information, content, features, tools, products and services (the "Services"). The Services are powered by Shopify. This Privacy Policy describes how we collect, use, disclose, and otherwise process your personal information when you visit, use, or make a purchase or other transaction using the Services, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using or accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described herein. Depending on where you live, additional rights and disclosures apply to you — see the "Region-Specific Rights and Disclosures" section below.

1. Personal Information We Collect or Process

When we use the term "personal information," we are referring to information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, to you or another identifiable person. Personal information does not include information that has been anonymized or de-identified such that it cannot reasonably be linked to you.

We may collect or process the following categories of personal information, including inferences drawn from this information, depending on how you interact with the Services, where you live, and as permitted or required by applicable law:

  • Contact details — name, billing and shipping address, phone number, and email address.
  • Financial information — credit and debit card information, payment card details, financial account details, transaction details, form of payment, and payment confirmation. Full payment card numbers are processed by our payment processors and not stored by us.
  • Account information — username, password, security questions, preferences, and settings.
  • Transaction information — items you view, add to cart, add to your wishlist, or purchase, return, exchange or cancel, and your past transactions.
  • Communications with us — information you include in communications with us, such as when you contact customer support, submit a review, respond to a survey, or interact with us on social media.
  • Device and technical information — information about your device, browser, operating system, network connection, IP address, and other unique identifiers, including cookie and similar-technology identifiers.
  • Usage information — information regarding your interaction with the Services, including pages viewed, click data, referring URLs, time spent, and similar metrics.
  • Location information — general location derived from your IP address (such as country or region) for purposes like fraud prevention, applying the correct storefront, and tax determination.
  • Marketing and preferences — your subscription status, communication preferences, and engagement with our marketing.
  • Inferences — inferences drawn from any of the above to create a profile reflecting your preferences, interests, and behavior.

2. Sensitive Personal Information

Certain US state privacy laws (including the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA")) define a category called "sensitive personal information." We do not intentionally collect sensitive personal information about you in the ordinary course of providing the Services. We may incidentally process the following categories that may qualify as sensitive personal information under one or more applicable laws:

  • Account log-in credentials, in combination with a password or security question and answer that would permit access to an account.
  • Payment card information in combination with any required security or access code, password, or credentials allowing access to an account.

We use this information only for the purposes permitted under applicable law (such as providing the Services you have requested, securing accounts, detecting fraud, and complying with legal obligations), and we do not use or disclose it for purposes that would require us to offer a separate "Limit the Use of My Sensitive Personal Information" right under the CCPA/CPRA. We do not sell or share sensitive personal information for targeted advertising or for any other purpose requiring a separate opt-out under applicable US state laws.

We do not knowingly collect special categories of personal data as defined under the EU/UK GDPR (such as data revealing racial or ethnic origin, religious beliefs, health data, or biometric data used to identify a person). Please do not provide such data to us.

3. Sources of Personal Information

We collect personal information from the following sources:

  • Directly from you — when you create an account, place an order, visit or use the Services, communicate with us, sign up for marketing, or otherwise provide information to us.
  • Automatically through the Services — from your device and browser when you interact with the Services, including through cookies, pixels, SDKs, and similar technologies.
  • From our service providers — including Shopify (our store platform), payment processors, shipping carriers, fraud-prevention providers, analytics providers, email and marketing providers (e.g., Klaviyo), and customer-support providers.
  • From our marketing and advertising partners — including social media platforms and advertising networks that share information with us about your interactions with our advertising or with other merchants.
  • From other third parties — including public sources, affiliates, and persons who refer you or place an order on your behalf.

4. How We Use Your Personal Information

Depending on how you interact with us and which Services you use, we use personal information for the following purposes:

  • Providing, tailoring, and improving the Services — to perform our contract with you, process payments, fulfill orders, remember your preferences, manage your account, arrange shipping, handle returns and exchanges, enable reviews, and create a customized shopping experience (including product recommendations).
  • Marketing and advertising — to send promotional communications by email, SMS, or postal mail (where permitted), and to deliver personalized advertising on the Services and on third-party platforms, including based on items you previously viewed or purchased.
  • Security and fraud prevention — to authenticate accounts, secure transactions, detect and investigate fraudulent, illegal, unsafe, or malicious activity, and protect public safety and our Services.
  • Communicating with you — to provide customer support, respond to inquiries, and maintain our business relationship with you.
  • Analytics and product development — to understand how the Services are used, measure the effectiveness of our marketing, and develop new features and products.
  • Legal and compliance — to comply with applicable law, respond to valid legal processes (including subpoenas, search warrants, and similar requests from law enforcement or government agencies), participate in civil discovery or litigation, and enforce or investigate potential violations of our terms or policies.
  • Corporate transactions — to evaluate, negotiate, or complete a merger, acquisition, reorganization, sale of assets, financing, or bankruptcy.

5. Legal Bases for Processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area ("EEA"), the United Kingdom, or Switzerland, we process your personal information on the following legal bases:

  • Performance of a contract — to provide the Services you have requested, fulfill your orders, manage your account, and respond to your inquiries.
  • Legitimate interests — to operate, secure, analyze, and improve the Services; to prevent fraud and abuse; to conduct direct marketing of our own products to existing customers (where permitted); to communicate with you about our business; and to defend our legal rights. Where we rely on legitimate interests, we balance them against your interests, rights and freedoms.
  • Consent — for non-essential cookies and similar technologies, electronic marketing where required, and other processing for which consent is required by applicable law. You can withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
  • Compliance with legal obligations — to comply with applicable tax, accounting, consumer-protection, and other legal requirements.
  • Vital interests — in rare circumstances, to protect your vital interests or those of another person.

Where we need to collect certain personal information to perform a contract with you or to comply with a legal obligation (for example, your shipping address to deliver an order, or payment details to process a purchase), failure to provide that information may mean we are unable to provide the relevant Services to you. We will tell you at the point of collection where the provision of personal information is required.

6. How We Disclose Personal Information

We may disclose your personal information to third parties for the legitimate purposes described in this Privacy Policy. The categories of recipients include:

  • Shopify — our e-commerce platform provider. See Section 8 for details.
  • Service providers and processors — vendors that perform services on our behalf, including payment processors, fraud-prevention providers, fulfillment and shipping providers, IT and hosting providers, customer-support providers, analytics providers, email and marketing platforms (e.g., Klaviyo), and reviews and survey providers.
  • Advertising and marketing partners — including social media platforms and advertising networks that may use your information to deliver personalized advertising to you across the web. Our advertising partners use your information in accordance with their own privacy notices. Depending on where you live, you may have a right to opt out of these uses — see Section 13 ("Your Rights and Choices") and Section 14 ("Region-Specific Rights and Disclosures").
  • Professional advisers and auditors — including lawyers, accountants, and auditors.
  • Affiliates and corporate group members — including World Matcha Co., Ltd. in Japan.
  • Government authorities, regulators, and law-enforcement — where required by law or in response to valid legal process.
  • Acquirers and investors — in connection with an actual or contemplated merger, acquisition, financing, or sale of all or part of our business.
  • At your direction — for example, when you use social-media share or login features, or ask us to ship a gift to a third party.

Categories of Personal Information Disclosed for a Business Purpose (CCPA/CPRA)

In the preceding 12 months, we have disclosed the categories of personal information described in Section 1 (Contact details; Financial information; Account information; Transaction information; Communications with us; Device and technical information; Usage information; Location information; Marketing and preferences; and Inferences) to the categories of recipients described above for the business purposes set out in Section 4.

Categories of Personal Information "Sold" or "Shared" (CCPA/CPRA and Similar US State Laws)

Certain advertising and analytics activities described in this Privacy Policy — such as the use of cookies, pixels, and similar technologies that share device and usage information with advertising networks and social media platforms — may constitute a "sale" or "sharing for cross-context behavioral advertising" of personal information under the CCPA/CPRA and similar laws in other US states. In the preceding 12 months, the categories of personal information that may have been "sold" or "shared" in this sense are: Device and technical information; Usage information; Transaction information; Location information (general); and Inferences. The categories of third parties to which this information may have been disclosed are advertising networks, social media platforms, and analytics providers.

We do not knowingly "sell" or "share" the personal information of consumers under 16 years of age.

To opt out of "sale" or "sharing" of your personal information, please see Section 13 ("Your Rights and Choices") or visit our opt-out page at https://cuzenmatcha.com/pages/data-sharing-opt-out.

7. Cookies and Similar Technologies

We and our service providers use cookies, pixels, software development kits (SDKs), local storage, and similar technologies (collectively, "cookies") to operate the Services, remember your preferences, analyze use of the Services, and deliver advertising. The cookies we use include:

  • Strictly necessary cookies — required to operate the Services (e.g., shopping cart, log-in).
  • Functional cookies — to remember your preferences and choices.
  • Analytics cookies — to understand how the Services are used and improve them.
  • Advertising and marketing cookies — to deliver and measure personalized advertising on the Services and on third-party platforms.

Where required by law (including in the EEA, the United Kingdom, and Switzerland), we ask for your consent to non-essential cookies through a cookie banner when you first visit the Services. You may also block or delete cookies through your browser settings, although doing so may impact the functionality of the Services.

Where applicable, we treat browser-based opt-out signals such as Global Privacy Control (GPC) as a valid request to opt out of "sale," "sharing," and processing for targeted advertising for the device and browser used to send the signal. To learn more about GPC, visit https://globalprivacycontrol.org.

8. Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services for you.

In addition, to help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our Store, along with other merchants and with Shopify. To provide these enhanced features, Shopify may make use of personal information collected about your interactions with our store, along with other merchants, and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over use of your personal information for these purposes.

To learn more about how Shopify uses your personal information and any rights you may have, you can visit the Shopify Consumer Privacy Policy. Depending on where you live, you may exercise certain rights with respect to your personal information through the Shopify Privacy Portal.


9. Third-Party Websites and Links

The Services may contain links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on them. Information you provide on public or semi-public venues, including third-party social-networking platforms, may also be viewable by other users without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content or operators of those sites, except as disclosed on the Services.

10. Children's Data

The Services are not intended for, or directed to, anyone under the age of 16, and we do not knowingly collect personal information from children under the age of 13 (or any higher minimum age that applies under the law of your jurisdiction). If you are a parent or guardian and believe a child has provided us with personal information, please contact us using the details in Section 17 and we will take appropriate steps to delete the information.

As of the "Last updated" date of this Privacy Policy, we do not have actual knowledge that we "sell" or "share" (as those terms are defined in applicable US state laws) personal information of consumers under 16 years of age.

11. Security and Retention of Your Information

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, alteration, and destruction. However, please remember that no transmission of data over the Internet or any wireless network can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot ensure or warrant the security of any information that you transmit to us or from us, and you do so at your own risk.

We retain personal information we receive as described in this Privacy Policy for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected, provide our Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements and comply with applicable laws. When we are no longer required to retain your personal information as described above, we will destroy, erase, or de-identify it in accordance with our data retention policies and applicable law. Legal requirements, however, may require us to retain some or all of the personal information we hold for a period of time that is longer than that for which we might otherwise hold it.

12. International Transfers of Personal Information

We are headquartered in the United States, and our service providers, affiliates, and partners may be located in countries other than where you reside. When you use the Services, your personal information may be transferred to, stored, and processed in the United States, Japan, and other countries where applicable data-protection laws may differ from those in your country.

Categories of countries to which we transfer personal information include: United States, Japan, and other countries where our service providers are located.

Where we transfer personal information out of the EEA, the United Kingdom, or Switzerland to a country that has not received an adequacy decision from the relevant authority, we implement appropriate safeguards, including:

  • The European Commission's Standard Contractual Clauses ("SCCs");
  • The UK Addendum to the SCCs or the UK International Data Transfer Agreement, as appropriate; and
  • For transfers from Switzerland, the SCCs as recognized by the Swiss Federal Data Protection and Information Commissioner ("FDPIC").

Where required, we conduct transfer impact assessments to evaluate whether additional safeguards are needed. You may request a copy of the relevant safeguards (with commercially confidential information redacted) by contacting us using the details in Section 17.

For users in Japan, please note that we transfer personal information to the United States and to other countries where our service providers are located. Information about the data-protection regimes of these countries is available on request.

International Visitors

Our Services are primarily hosted in the United States and may also be hosted in locations abroad. If you use the Services from regions of the world with laws governing data processing, you accept that you are transferring your information to the United States and other hosting locations for storage and processing. By providing information to Cuzen Matcha, you agree to such transfer, storage, and processing.

13. Your Rights and Choices

Depending on where you live and subject to applicable exceptions and limitations, you may have some or all of the rights described below in relation to your personal information. These rights are not absolute and we may decline a request where permitted by law. Region-specific rights are described in Section 14.

  • Access / Know — request confirmation of whether we process your personal information and access to a copy of it.
  • Correct — request that we correct inaccurate or incomplete personal information.
  • Delete — request that we delete personal information we hold about you.
  • Portability — request a copy of your personal information in a structured, commonly used, and machine-readable format, and to have it transferred to another controller where technically feasible.
  • Opt out of "sale" or "sharing" / Targeted advertising — opt out of the "sale" or "sharing" of your personal information, or of its use for targeted advertising. You can exercise this right by visiting https://cuzenmatcha.com/pages/data-sharing-opt-out or by enabling Global Privacy Control in your browser.
  • Withdraw consent — where we rely on consent, withdraw it at any time without affecting prior lawful processing.
  • Object to or restrict processing — where applicable, object to or request that we restrict certain processing of your personal information (for example, where we rely on legitimate interests).
  • Non-discrimination — we will not discriminate against you for exercising any of these rights.
  • Authorized agent — you may designate an authorized agent to submit requests on your behalf. We will require proof that you have authorized the agent and may verify your identity directly.
  • Marketing communications — opt out of promotional emails using the unsubscribe link in any email, and opt out of promotional SMS by following the instructions in the message. If you opt out, we may still send transactional or service-related messages.

To exercise any of these rights, contact us using the details in Section 17, or use the request mechanisms identified on the Services. We may need to verify your identity before processing your request, as permitted or required by applicable law. We will respond within the timeframes required by applicable law.

14. Region-Specific Rights and Disclosures

14.1 European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, the UK, or Switzerland, you have the rights described in Section 13, including the right to access, rectify, erase, restrict, object to, and port your personal information, and the right to withdraw consent. You also have the right to lodge a complaint with a data-protection supervisory authority.

You may contact hi@cuzenmatcha.com directly in relation to questions about our processing of your personal information.

A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/board/members_en. In the UK, the supervisory authority is the Information Commissioner’s Office (ICO), https://ico.org.uk. In Switzerland, the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).

14.2 California (United States)

If you are a California resident, the CCPA/CPRA gives you the rights to know, access, correct, delete, and opt out of the "sale" or "sharing" of your personal information, as well as the right to limit the use of sensitive personal information (where applicable). You also have the right not to be discriminated against for exercising these rights.

The categories of personal information we have collected, the sources of that information, the purposes for collection, the categories of recipients, and the categories of personal information disclosed or "sold"/"shared" in the preceding 12 months are described in Sections 1, 3, 4, and 6 above.

To submit a request, email hi@cuzenmatcha.com.

"Shine the Light" (California Civil Code §1798.83): California residents may request information about the categories of personal information we have shared with third parties for those third parties' direct marketing purposes in the preceding calendar year. To make such a request, contact us using the details in Section 17.

Notice of Financial Incentive: We offer programs that provide benefits to participants in exchange for personal information, such as our rewards program, student discount, and discounts offered for joining our email or SMS marketing lists. When you participate, we collect personal information such as your name and contact details, and we may use your transaction and engagement data as described in this Privacy Policy. The value of your personal information to us is reasonably related to the value of the benefit provided.Participation is voluntary, and you may join or withdraw at any time — to withdraw, follow the instructions in the relevant program terms or contact us using the details in Section 17.

14.3 Other US States (Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and others)

If you are a resident of a US state with a comprehensive consumer privacy law, you have the rights described in Section 13 to the extent provided by your state's law, which may include the rights to confirm processing of and access your personal information, correct inaccuracies, delete personal information, obtain a portable copy, opt out of "sale" or "sharing" / processing for targeted advertising, and opt out of certain profiling that produces legal or similarly significant effects. Some states also provide the right to appeal a denial of a request — to appeal, contact us using the details in Section 17 with a clear statement that you are appealing. If you are an Oregon resident, you may also request a list of the specific third parties to which we have disclosed your personal information (or, at our option, any personal information).

We honor Global Privacy Control (GPC) and similar browser-based opt-out signals as valid opt-out requests from residents of states whose laws so require.

14.4 Japan

If you are located in Japan, we handle your personal information in accordance with the Act on the Protection of Personal Information ("APPI"). Our purposes of use are described in Section 4. You have the right to request disclosure, correction, addition, deletion, cessation of use, and cessation of provision to third parties, as well as disclosure of records of provision to third parties.

Cross-border transfers: We transfer personal information to the United States and may transfer it to other countries where our service providers are located. Where we provide personal data to a third party (including our group companies) located in a foreign country, we do so in accordance with Article 28 of the APPI. Where we rely on your consent, we provide you with information about the destination country’s data-protection regime at the time we obtain your consent. Where we instead rely on contractual and other measures ensuring that the recipient continuously implements standards equivalent to those required of business operators under the APPI, information about those measures and the destination countries’ data-protection regimes is available on request using the contact details in Section 17.

Contact for Japan-related inquiries: japan@cuzenmatcha.com

If you are a resident of a country that is not the United States, you may have the right to take any complaints or concerns you have about our compliance with this privacy policy to the appropriate supervisory authority which has jurisdiction over privacy rights in your country.

15. Automated Decision-Making and Profiling

We use automated tools to deliver personalized product recommendations, marketing, and advertising based on your interactions with the Services. We do not use solely automated decision-making (without human involvement) that produces legal or similarly significant effects on you (for example, automatic denial of an order). If we do so in the future, we will provide notice and, where required, obtain consent or offer an opt-out, and we will tell you about the logic involved and the significance and intended consequences of the processing.

16. Complaints

If you have a complaint about how we process your personal information, please contact us first using the details in Section 17 so we can try to resolve it. Depending on where you live, you may have the right to appeal our decision and/or to lodge a complaint with a data-protection authority. The relevant authorities are identified in Section 14.

17. Contact Information

If you have questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please contact us:

Email: hi@cuzenmatcha.com

Postal address: 55 E 3rd Ave, San Mateo, CA 94401

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Services, update the "Last updated" date at the top, and provide additional notice (such as by email or a prominent notice on the Services) as required by applicable law. We encourage you to review this Privacy Policy periodically to stay informed about how we process your personal information