Privacy policy

Effective date / Last updated: July 11, 2026

TWNTY-TWO®️ ("we", "us", or "our") operates twnty-two.com, our customer support portal at help.twnty-two.nyc, related services on twnty-two.nyc domains, and any TWNTY-TWO®️ mobile application we may offer (the "App"), including all related information, content, features, tools, products, and services, in order to provide you with a curated shopping experience (collectively, the "Services"). Our e-commerce platform is powered by Shopify; our customer support systems are powered by additional service providers described below.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase through the Services — including through any mobile app we offer — or otherwise communicate with us. Communications from TWNTY-TWO®️ may be sent from @twnty-two.com or @twnty-two.nyc addresses; both domains are operated by TWNTY-TWO®️. For purposes of this Privacy Policy, "you" and "your" means you as the user of the Services, whether you are a customer, website visitor, or another individual whose information we have collected pursuant to this Privacy Policy.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand how your information is collected, used, and disclosed.

1. Personal Information We Collect

"Personal information" refers to information that identifies or can reasonably be linked to you. We may collect or process the following categories depending on how you interact with the Services.

Information you provide directly

  • Contact details — name, address, billing/shipping address, phone number, and email address.
  • Financial information — payment card information and transaction details processed by Shopify's payment providers (such as Shopify Payments, Shop Pay, Apple Pay, Google Pay, and other supported payment methods). We do not store full payment card numbers on our own systems.
  • Account information — username, password, security questions, preferences, and settings.
  • Order information — items viewed, carted, purchased, or cancelled; order numbers; and fulfillment details.
  • Communications and support information — information you include when contacting our support team by email, through our support portal, or in support chat, including ticket contents and chat messages.
  • Claim submissions — photos, videos, and descriptions you upload when submitting a claim (for example, for a defective item, wrong item, or wrong quantity).
  • Marketing preferences — your email and SMS marketing sign-up status and preferences.

Some features of the Services may require you to provide certain information. You may elect not to provide it, but doing so may prevent you from using or accessing those features.

Information collected automatically

  • Device information — device type, operating system, browser, IP address, and unique identifiers, including mobile device identifiers if you use the App.
  • Usage data — how and when you interact with the Services, including pages or screens viewed and product browsing behavior.
  • Crash and diagnostics data — error logs and performance data collected by the App (if you use it) to identify and fix technical issues.
  • Push notification opt-in — if you use the App and grant permission, we collect a push notification token to send order updates and marketing messages via the platform's push notification service (such as Apple Push Notification service). You can withdraw this permission at any time in your device settings.
  • Cookie and tracking data — on our website, we use cookies and similar technologies as described in Section 6 below.

Information from third parties

  • Shopify — our e-commerce platform collects and processes data related to your orders and account.
  • Payment processors — collect payment information to process transactions on our behalf.
  • Analytics and advertising partners — may provide data about your interactions with our Services and advertisements.
  • Social platforms — if you interact with us through social media integrations (such as Instagram), we may receive information from those platforms in accordance with their policies and your settings.

Any information we obtain from third parties will be treated in accordance with this Privacy Policy.

2. How We Use Your Personal Information

  • Provide and fulfill the Services. Process payments, fulfill orders (including pre-orders), manage your account, arrange shipping, process claims for defective or incorrect items, and send order-related notifications.
  • Order and account verification. Verify your identity before discussing order details or making account changes — for example, by sending a one-time 6-digit verification code to the email address on your order — and support fraud prevention.
  • Customer support. Respond to inquiries through email, our support portal, and support chat; review support conversations for quality; and maintain our relationship with you.
  • Marketing and communications. Send marketing communications by email, SMS/text message, or (if you use the App) push notification about products, drops, and promotions, in accordance with your preferences and applicable law.
  • Security and fraud prevention. Authenticate accounts, detect fraudulent or malicious activity, manage payment disputes and chargebacks, and protect the safety of the Services.
  • Legal compliance. Comply with applicable law, respond to legal process, and enforce our Terms of Service and other policies.
  • Service improvement. Analyze usage patterns, support interactions, and diagnostics data to improve performance, products, and user experience.

If you are an EEA or UK resident, we process your personal information on the legal bases of performance of our contract with you (Art. 6(1)(b) GDPR), our legitimate interests in operating, securing, and marketing our business (Art. 6(1)(f) GDPR), your consent where required (Art. 6(1)(a) GDPR), and compliance with legal obligations (Art. 6(1)(c) GDPR).

3. AI-Powered Support Chat

Our customer support chat is powered in part by artificial intelligence. When you use support chat on our website or support portal:

  • Your chat messages and related order context may be processed by a third-party AI service provider (currently Anthropic, via the Claude API) to generate responses.
  • Support conversations are stored in our support systems and may be reviewed by our staff to resolve your request, ensure quality, and improve our support.
  • Please do not submit sensitive personal information in support chat — such as full payment card numbers, government identification numbers, passwords, or health information. If we need to verify your identity, we will use methods such as an emailed 6-digit verification code rather than asking for sensitive data in chat.

We do not permit our AI service providers to use your support conversations to train their publicly available models except as permitted under our agreements with them and applicable law.

4. How We Disclose Personal Information

We may disclose your personal information in the following circumstances:

  • Service providers who process data on our behalf, including:
    • Shopify — e-commerce platform, checkout, and payment processing;
    • Supabase — storage of support ticket and chat data;
    • Amazon Web Services (AWS) — hosting and storage of files you upload, such as claim photos and videos;
    • Google (Google Workspace / Gmail) — support email processing;
    • Anthropic — AI processing of support chat conversations (see Section 3);
    • Cloudflare — content delivery, security, and performance;
    • Klaviyo — email marketing;
    • SMS/text messaging providers — delivery of text messages you have opted in to receive;
    • as well as payment processors, fulfillment and shipping partners, IT management, analytics, and customer support providers.
  • At your direction — for example, when you use social media integrations (such as Instagram) or shipping services.
  • Business and marketing partners — including Shopify and advertising partners, to provide services and advertise to you. These partners use your information in accordance with their own privacy notices.
  • Corporate affiliates — within our corporate group in connection with our business operations.
  • Legal and business transactions — in connection with a merger, acquisition, or bankruptcy; to comply with legal obligations (including responding to subpoenas, search warrants, and similar requests); to enforce our terms; or to protect our rights and the rights of our users and others.

We do not use or disclose sensitive personal information without your consent or for the purpose of inferring characteristics about you.

5. Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services. Information you submit may be transmitted to Shopify and to third parties in countries other than where you reside. Shopify may also use data from your interactions with our store — together with data from other merchants — to provide enhanced features, and may match your account with other Shopify services you choose to use (such as Shop Pay).

Our store participates in Shopify network services (including Shopify Network Intelligence), through which Shopify securely uses data from our store together with data across the Shopify network to improve its products and services, ad targeting, and personalization for our store, as described in Shopify's Additional Services Terms. Other merchants cannot see our customer data. You may opt out of targeted-advertising uses of your data as described in Sections 7 and 8 of this Privacy Policy.

To learn more about how Shopify uses your personal information and to exercise your rights, visit the Shopify Consumer Privacy Policy or the Shopify Privacy Portal.

6. Cookies and Tracking Technologies

Our website uses cookies, pixels, and similar technologies to power the Services, remember your preferences, run analytics, and support advertising. For details on Shopify-specific cookies, see https://www.shopify.com/legal/cookies. We may also permit third parties and service providers to use cookies on our site to better tailor services, products, and advertising on our site and other websites.

Cookie Consent Banner. When you visit our website, a cookie consent banner allows you to accept or decline non-essential cookies and manage your cookie preferences. Depending on your region, non-essential cookies (such as analytics and advertising cookies) are only set after you provide consent. You can change your cookie preferences at any time through the cookie settings link on our website.

Most browsers accept cookies by default. You can also set your browser to remove or reject cookies, but doing so may negatively affect your experience and cause certain features of the Services to work incorrectly or become unavailable. Blocking cookies may not completely prevent how we share information with third parties such as our advertising partners.

Global Privacy Control and Do Not Track. Our website recognizes the Global Privacy Control (GPC) signal. If you notify us of your preference through GPC, we will treat the signal as a valid request to opt out of sharing / targeted advertising for the associated browser or device and, if we can associate the device with an account, we will apply the opt-out to the account as well. To learn more, visit https://globalprivacycontrol.org/. Other than Global Privacy Control, we do not respond to other "Do Not Track" signals that may be sent by your browser or device.

7. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights in relation to your personal information. These rights are not absolute, may apply only in certain circumstances, and, in certain cases, we may decline your request as permitted by law.

  • Right to Access / Know — request access to the personal information we hold about you, including details on how we use and share it.
  • Right to Delete — request that we delete personal information we hold about you. See Section 8 for California-specific instructions and Section 13 for App account deletion.
  • Right to Correct — request that we correct inaccurate personal information.
  • Right of Portability — receive a copy of your personal information and, in certain circumstances, request transfer to a third party.
  • Right to Opt Out of Sale/Sharing — depending on where you reside, you may opt out of the "sale" or "sharing" of your personal information for targeted advertising purposes. To exercise this right, use the "Do Not Sell or Share My Personal Information" link in our website menu, email help@twnty-two.com, or enable the Global Privacy Control signal in your browser.
  • Right to Restrict Processing (EEA/UK) — ask us to stop or restrict processing of your personal information.
  • Withdrawal of Consent — where we rely on consent to process your information, you may withdraw consent at any time.
  • Appeal — if we decline to process your request, you may have a right to appeal our decision by replying directly to our denial.
  • Managing Communication Preferences — opt out of marketing emails at any time using the unsubscribe link in our emails, and opt out of SMS by replying STOP (see Section 10). You may still receive non-promotional communications about your account or orders.
  • Push Notification Preferences — if you use the App, you can withdraw consent to receive push notifications at any time through your device's notification settings.

We will not discriminate against you for exercising any of these rights. To submit a request, contact us at help@twnty-two.com or through our support portal at help.twnty-two.nyc. We may need to verify your identity before processing your request — for example, via a 6-digit verification code sent to the email address associated with your account or order. You may designate an authorized agent to make requests on your behalf; we will require proof of authorization and may verify your identity directly before processing the request. We will respond to your request in a timely manner as required under applicable law.

We use Shopify's ad services, which may include tools such as Shopify Audiences, to help personalize the advertising you see on third-party websites. To opt out of personalized advertising with third-party services supported by Shopify, visit https://privacy.shopify.com/en.

8. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

Right to Know. You may request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, our purposes for collecting it, and the categories of third parties with whom we share it.

In the preceding 12 months, we have collected the categories of personal information described in Section 1 (identifiers and contact details; California Customer Records categories such as contact, account, and order information; commercial information such as purchase and support history; internet or network activity such as usage data; geolocation inferred from IP address; and audio/visual information you submit with claims). We have disclosed these categories to the service providers and partners described in Section 4.

"Sale" and "Sharing." Like most e-commerce brands, we use advertising and analytics tools that may constitute "selling" or "sharing" personal information as those terms are defined under California law. The categories involved are identifiers (such as name, email address, and phone number), commercial information (such as purchase records), and usage data, disclosed to business and marketing partners for advertising purposes. You may opt out as described below.

Right to Delete. You may request that we delete personal information we have collected about you, subject to certain legal exceptions. To submit a deletion request, email help@twnty-two.com or use our support portal at help.twnty-two.nyc, and include your full name, the email address associated with your account or orders, and a brief description of the data you wish deleted. We will confirm receipt and respond within the timelines required by California law; if we need additional time, we will notify you of the extension.

Right to Correct. You may request that we correct inaccurate personal information we hold about you.

Right to Opt Out of Sale or Sharing. To opt out, use the "Do Not Sell or Share My Personal Information" link in our website menu, email help@twnty-two.com, or enable the Global Privacy Control signal in your browser.

Right to Limit Use of Sensitive Personal Information. You may have the right to limit our use of sensitive personal information — including financial data collected during checkout — to purposes necessary to provide the Services. To exercise this right, contact us at help@twnty-two.com.

No Sale of Data of Minors. We do not have actual knowledge that we sell or share personal information of individuals under 16 years of age.

Authorized Agents. You may designate an authorized agent to submit a request on your behalf. We will require proof of authorization and may verify your identity directly before processing the request.

We will not discriminate against you for exercising any of these rights.

9. European Privacy Rights (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal information as a "data controller" under the EU General Data Protection Regulation (GDPR) and equivalent laws, and you have specific rights regarding your personal information.

Legal Bases for Processing. We process your personal information on the following legal bases: performance of a contract (for example, processing your order, arranging shipping, and providing customer support); our legitimate interests (for example, improving the Services, preventing fraud and abuse, and securing our systems); your consent (for example, marketing emails and SMS, which you may withdraw at any time); and compliance with legal obligations (for example, tax and accounting requirements).

Your Rights. Subject to the conditions and exceptions in applicable law, you have the right to:

  • Access — request a copy of the personal information we hold about you;
  • Rectification — request that we correct inaccurate or incomplete personal information;
  • Erasure — request that we delete your personal information ("right to be forgotten");
  • Restriction — request that we limit how we process your personal information;
  • Data Portability — receive the personal information you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
  • Objection — object to processing based on our legitimate interests, and to any processing for direct marketing purposes;
  • Withdraw Consent — withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal. For cookies, you can withdraw or change your consent at any time through the cookie settings on our website; for marketing, use the unsubscribe link in any email or reply STOP to any text.

How to Exercise These Rights. Email help@twnty-two.com or use our support portal at help.twnty-two.nyc, and include your full name, the email address associated with your account or orders, and the right you wish to exercise. We may need to verify your identity before acting on your request. We will respond within one month of receiving your request; if your request is complex, we may extend this period by up to two further months and will inform you of the extension and its reasons.

International Transfers. Your personal information is processed in the United States and other countries where our service providers operate. Where we transfer personal information out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK equivalent) with our service providers, as described in the International Data Transfers section below.

Complaints. If you have concerns about how we process your personal information, please contact us first and we will do our best to resolve them. You also have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available from the European Data Protection Board at https://edpb.europa.eu/about-edpb/about-edpb/members_en; UK residents may contact the Information Commissioner's Office (ICO) at https://ico.org.uk.

10. SMS/Text and Email Marketing

If you opt in to our SMS/text marketing program (sometimes referred to as our "text blast" list), we use the information you provide to send you text notifications (including order updates and abandoned checkout reminders), marketing offers such as drop announcements, and transactional messages. Consent to receive marketing texts is not a condition of purchase. Message frequency varies, and message and data rates may apply based on your wireless provider.

Opt-in data and consent for text messaging will not be shared with any third parties except our messaging service providers, for the purpose of enabling and operating our text messaging program. Our website uses cookies to track items in your cart, including abandoned checkouts; this information may be used to determine when to send cart reminder messages via SMS.

To opt out of SMS communications at any time, reply STOP to any message from us (we also honor END, UNSUBSCRIBE, CANCEL, QUIT, and clear opt-out phrases), or contact us at help@twnty-two.com. For help, text HELP or contact us at help@twnty-two.com.

Email Marketing. If you subscribe to our email list (for example, at checkout, through our website sign-up forms, or through our early-access and drop notification tools), we use the information you provide to send you marketing emails such as drop announcements, restock alerts, promotional offers, and newsletters. Consent to marketing emails is not a condition of purchase. Our email campaigns are operated through our email marketing service provider (currently Klaviyo), which processes your email address and related engagement data on our behalf.

You may unsubscribe from marketing emails at any time using the unsubscribe link included in every marketing email, or by contacting us at help@twnty-two.com. Unsubscribing from marketing emails does not stop transactional and operational emails related to your account or orders — such as order confirmations, shipping and tracking notifications, verification codes, and customer support responses.

11. Children's Privacy

The Services are not directed at children, and we do not knowingly collect personal information from children under the age of 13 (or the age of majority in their jurisdiction), consistent with the Children's Online Privacy Protection Act (COPPA). If you are the parent or guardian of a child who has provided us with personal information, please contact us at help@twnty-two.com to request deletion.

As of the effective date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age.

12. Security and Data Retention

We implement reasonable technical and organizational measures to protect your personal information. However, no security measures are perfect or impenetrable, and we cannot guarantee the security of information transmitted to us. We recommend that you do not use insecure channels to communicate sensitive or confidential information to us.

We retain your personal information for as long as necessary to maintain your account, provide the Services (including honoring pre-orders and resolving claims), comply with legal obligations (such as tax and accounting requirements), resolve disputes (including payment disputes and chargebacks), and enforce our agreements. Support tickets, chat transcripts, and claim submissions are retained for as long as reasonably needed for these purposes and then deleted or anonymized.

13. Mobile App Privacy and Account Deletion

This section applies if and when you use a TWNTY-TWO®️ mobile app.

  • Push notifications are optional and opt-in. You can disable them at any time in your device's notification settings.
  • Device permissions such as camera or photo library access are requested only for specific features — for example, attaching photos or videos to a claim submission. You can grant or revoke these permissions at any time in your device settings.
  • App data (such as device identifiers, usage, and crash data) is collected as described in Section 1 and used as described in Section 2.
  • Account deletion. If the App allows you to create or sign in to an account, you may request deletion of your account and associated personal data at any time from within the App, by emailing help@twnty-two.com, or through our support portal at help.twnty-two.nyc. We will delete your personal information subject to the retention exceptions described in Section 12 (for example, records we must keep for tax, fraud-prevention, or legal purposes).

14. International Data Transfers

Your personal information may be transferred to, stored in, and processed in countries other than where you reside — including the United States, where we and most of our service providers are located. If we transfer personal information from the European Economic Area, United Kingdom, or Switzerland, we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses or equivalent instruments issued by the relevant competent authority, unless the transfer is to a country determined to provide an adequate level of protection.

15. Third-Party Websites and Links

The Services may contain links to third-party websites or platforms, including social media platforms such as Instagram. We are not responsible for the privacy practices or content of those sites. Information you share on public or semi-public venues, including third-party social platforms, may be viewable by other users of those platforms without limitation. We encourage you to review the privacy policies of any third-party sites you visit.

16. Complaints

If you have complaints about how we process your personal information, please contact us using the contact details below. If you are not satisfied with our response, depending on where you live, you may have the right to appeal our decision or lodge a complaint with your local data protection authority. For the EEA, a list of data protection supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, legal requirements, or operational needs. We will post the revised version on our website (and in the App, if applicable), update the "Last updated" date, and provide notice as required by applicable law. We encourage you to review this policy periodically.

18. Contact Us

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please email us at help@twnty-two.com or submit a request through our support portal at help.twnty-two.nyc.

For Shopify-related privacy requests, visit https://privacy.shopify.com/en.

For the purpose of applicable data protection laws and if not explicitly stated otherwise, TWNTY-TWO®️ is the data controller of your personal information.