Last updated: October 23, 2026
This Privacy Policy explains how Past Midnight LLC ("Past Midnight", "we", "us", "our") collects, uses, shares and protects personal information when you visit pastmidnight.com, buy from us, or otherwise interact with us (together, the "Services"). It also explains your privacy rights and how to use them.
Past Midnight LLC is the controller of your personal information.
Past Midnight LLC 8200 NE 2nd Ave, Suite 9 Miami, FL 33138, United States Email: inquiries@pastmidnight.com Phone: (305) 343-9545
EU representative (GDPR Art. 27): We have appointed Prighter EU Rep GmbH as our representative in the European Union under Article 27 of the GDPR. If you are located in the EU, you may contact our representative regarding any matter relating to the processing of your personal data, including exercising your data protection rights. Prighter EU Rep GmbH, Schellinggasse 3, 1010 Vienna, Austria.
UK representative (UK GDPR Art. 27): Please contact us at inquiries@pastmidnight.com for details.
Information you give us
Information collected automatically
Information from others
Virtual try-on. Our FITTINGBOX try-on feature uses your camera live in your browser to show frames on your face. No images or facial data are stored, sent to us, or used to identify you. See section 10.
If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, we rely on the legal bases below. Wherever you live, we only use your information for these purposes.
|
Purpose |
Information used |
|---|---|
|
Process and deliver orders, payments, returns and withdrawals |
Contact, order, payment details |
|
Customer service and order updates |
Contact and order details, messages |
|
Customer accounts |
Account details |
|
Marketing emails and SMS |
Name, email, phone, preferences, purchase history |
|
Advertising, retargeting and affiliate tracking via cookies and pixels |
Device and usage data |
|
Analytics and site improvement via non-essential cookies |
Device and usage data |
|
Fraud prevention, payment risk checks and site security |
Order, payment, device data |
|
Product reviews you choose to post |
Name, review content |
|
Back-in-stock alerts |
Email or phone |
|
Tax, accounting and legal compliance |
Order and payment records |
|
Defending legal claims and enforcing our Terms |
Relevant records |
Where we rely on legitimate interests, we have weighed those interests against your rights. You can object at any time (see section 7).
We share personal information with the types of service providers below, who process it on our behalf under contract, and with advertising partners as described. We do not sell your information for money.
|
Who |
What they do |
|---|---|
|
Shopify |
Hosts our store, checkout, payments and messaging; uses data for fraud prevention and, through its own network, to improve ads and personalization |
|
Global-e |
Merchant of record for orders shipped outside the US: payment, duties, taxes and local compliance |
|
Payment providers (such as PayPal, Afterpay, Apple Pay and Google Pay) |
Process payments |
|
Shipping carriers and our returns provider |
Deliver orders and handle returns, exchanges and EU withdrawal requests |
|
Email and SMS providers |
Send order updates and, with your consent, marketing messages |
|
Advertising and analytics partners (such as Google, Meta, TikTok and Pinterest) |
Measure how the site and our ads perform, and show you ads on other sites |
|
Affiliate and creator networks |
Track referrals from partners and creators and pay their commissions |
|
Website tools |
Run features such as product reviews, signup forms, back-in-stock alerts, session recordings, virtual try-on and invoices |
|
Professional advisers, authorities, and any buyer of our business |
Legal, accounting and compliance; as required by law; in a merger or sale |
We may also share information to comply with law, respond to lawful requests, or protect our rights, customers and business.
"Sale", "sharing" and targeted advertising. Letting advertising and affiliate partners collect data through cookies and pixels to show you ads elsewhere may count as a "sale", "sharing" or "targeted advertising" under some US state laws. In the past 12 months, we have done this with identifiers, device and usage data, and purchase information. You can opt out at any time through Your Privacy Choices. We do not knowingly sell or share information of anyone under 16.
We are based in the United States, and most of our service providers are in the US. If you are outside the US, your information will be transferred to and processed in the US and other countries where our providers operate, including Canada, Ireland and other EU countries, Israel, Singapore and Vietnam, which may not have the same data protection laws as yours.
When we transfer personal information from the EEA, UK or Switzerland, we rely on the European Commission's adequacy decisions (including the EU-US Data Privacy Framework, where a provider is certified), or the European Commission's Standard Contractual Clauses and the UK Addendum, together with additional safeguards such as encryption. You can request a copy of the relevant safeguards by emailing us.
|
Information |
How long |
|---|---|
|
Order, payment and invoice records |
[7] years after the order, for tax and accounting law |
|
Customer account |
Until you delete it, or [3] years after your last activity |
|
Marketing lists |
Until you unsubscribe or withdraw consent, then a suppression record so we don't contact you again |
|
Customer service and return messages |
[3] years after the matter is closed |
|
Cookie and analytics data |
As listed in our Cookie Policy (usually up to 13 months) |
|
Session recordings |
[12] months |
|
Fraud-check records |
[3] years |
When we no longer need information, we delete or anonymize it.
You have the right to:
We do not make decisions with legal or similarly significant effects based solely on automated processing. To use your rights, see section 9.
Depending on your state (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and others with consumer privacy laws), you have the right to:
We do not use sensitive personal information to infer characteristics about you, and we do not profile you in ways that produce legal or similarly significant effects.
Your Privacy Choices. To opt out of sale, sharing and targeted advertising, visit Your Privacy Choices.
Global Privacy Control. We honor the Global Privacy Control (GPC) signal where required by law. If your browser sends GPC, we treat it as a request to opt out of sale, sharing and targeted advertising for that browser, and, if we know who you are, for your account.
Authorized agents. You can have an authorized agent submit a request for you. We'll ask the agent for your signed permission and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.
Verification. For requests to know, delete or correct, we'll verify your identity by matching information you give us (such as your email and a recent order number) to our records. Opt-out requests do not need verification.
Appeals. If we deny your request, you can appeal by emailing inquiries@pastmidnight.com with the subject "Privacy Appeal" within 60 days of our decision. We'll respond in writing within 60 days (45 days in some states), explaining what we did and why. If you're unhappy with the outcome, you can contact your state Attorney General.
California "Shine the Light". California residents can ask once a year for information about any disclosure of personal information to third parties for their own direct marketing. We do not make these disclosures.
Email inquiries@pastmidnight.com with the subject "Privacy Request". To opt out of sale, sharing or targeted ads, use Your Privacy Choices. We'll respond within 30 days in the EEA/UK (extendable by 2 months for complex requests) and within 45 days in the US (extendable once by 45 days). We don't charge a fee unless a request is clearly unfounded or excessive.
The try-on feature uses your camera only while it's open, processing your image live in your browser to place frames on your face. FITTINGBOX tells us it does not store, transmit, retain or disclose your image, does not create facial geometry or any biometric template, and cannot identify you. Any screenshot you take stays on your own device. If FITTINGBOX ever came to hold such data by mistake, it would permanently destroy it within 30 days. You can use our site without the try-on feature.
We send marketing emails and texts only with your consent. If you sign up for SMS, you agree to receive recurring automated marketing texts at the number provided. Consent isn't a condition of purchase. Message frequency varies; message and data rates may apply. Reply STOP to cancel or HELP for help. Unsubscribe from emails using the link in any email.
We use reasonable technical and organizational measures, including encrypted (HTTPS) connections and PCI-compliant payment processing, to protect your information. No system is completely secure.
Our Services are not intended for children under 13 (under 16 in the EEA/UK), and we do not knowingly collect their information. If you believe a child has given us personal information, email inquiries@pastmidnight.com and we'll delete it.
Browsers' "Do Not Track" signals have no common standard, so we don't respond to them. We do honor Global Privacy Control (see section 8).
We may update this policy. We'll change the "Last updated" date above and, for significant changes, notify you by email or a notice on our site.
Questions or complaints: inquiries@pastmidnight.com or Past Midnight LLC, 8200 NE 2nd Ave, Suite 9, Miami, FL 33138, United States.