Privacy Policy

NuOhm is operated by PaperBagged LLC, an Arizona limited liability company (paperbagged.com), based in Bisbee, Arizona, United States. In this policy “we”, “us” and “our” mean PaperBagged LLC, the business responsible for the personal information described here.

Questions: [email protected].

What you give us

• Account details — name, email address, and a password we store only as a one-way hash. We never hold your password itself.
• Order and delivery details — shipping and billing address, a phone number if you give one, and what you bought.
• Communications — messages you send through the contact form or by email, and our replies.
• Reviews you post — rating, title, body and display name. These are shown publicly, so treat anything you write there as public.
• Marketing preferences — whether you asked for our emails, and any back-in-stock alerts you requested.

What we receive from others

• Payment results from Stripe: whether a charge succeeded, the card brand and last four digits, and the billing details you gave Stripe. We never receive or store your full card number, expiry date or security code — those go directly to Stripe.
• Fulfillment and delivery updates from our fulfillment partner and the carriers, including tracking numbers and delivery status.

What is collected automatically

• Session and cart data — cookies that keep you signed in and remember your cart between visits.
• Security data — IP address and request timing, used for rate limiting, fraud prevention and abuse investigation, and written to server logs.
• Bot protection — Cloudflare Turnstile runs on sign-in, registration, checkout and public forms, and receives your IP address and browser signals to tell people apart from scripts.

We do not intentionally collect sensitive personal information — government identifiers, precise geolocation, biometrics or health records. Please do not send us health information; if you mention a medical condition in a support message, we use it only to answer you.

We use personal information to:

• take payment for, fulfil, ship and support your order;
• run your account, saved addresses and order history;
• start, renew, pause and cancel subscriptions you chose, and tell you when a renewal is due or a payment failed;
• send transactional messages — order confirmations, shipping notices, refund notices, password resets. These are part of the service rather than marketing, so they have no unsubscribe link;
• send marketing email only if you asked for it, stopping as soon as you unsubscribe;
• publish reviews you submit, and invite a review after a delivered order;
• detect and prevent fraud, abuse and security incidents;
• keep the records required for tax, accounting and consumer protection;
• see which pages and products people use, so we can improve them.

We do not make decisions about you by automated means that produce legal or similarly significant effects, and we do not profile you for that purpose.

Only with providers that make your order possible, and only what each one needs:

• Stripe — payments, subscription billing and fraud checks.
• Our fulfillment partner and its carriers — your name, delivery address and order contents, so the parcel can be packed and delivered.
• Our email provider — your email address and message contents, to deliver order and account email.
• Cloudflare — bot protection, and hosting of our product images.
• Our web host — which necessarily handles traffic to the site.

We also disclose information where the law requires it — a subpoena, court order or other lawful request — to establish or defend legal claims, or to protect the rights and safety of our customers, the public or us. If the business is sold or merged, customer information may transfer as part of that transaction; this policy continues to apply until you are told otherwise.

We do not sell your personal information for money.

We currently run no advertising or third-party analytics trackers, so there is no “sharing for cross-context behavioural advertising” to opt out of. If that changes we will update this policy and ask for consent where it is required.

Strictly necessary cookies keep your cart, your signed-in session and our anti-forgery protection working. The store cannot function without them, so they are set without asking. You can block them in your browser, but checkout will not work.

We do not respond to browser “Do Not Track” headers, which have no agreed meaning. We do honour Global Privacy Control as an opt-out of sale or sharing where that applies.

Wherever you live, you can ask us to:

• Know what we hold about you, and get a copy;
• Correct anything inaccurate;
• Delete your information;
• Stop marketing — every marketing email has an unsubscribe link, or email us.

Much of this you can do yourself: your account holds your details, addresses, orders and subscriptions, and you can change them at any time.

To make a request, email [email protected] from the address on your account, or use our contact form. We verify who you are before acting — usually by confirming control of the account email — and respond within 45 days, extending once by a further 45 days if the request is complex and telling you if we do. Someone may make a request for you with written permission. We will never treat you worse for exercising these rights: same prices, same products, same service.

Some information we must keep even after a deletion request — completed order and payment records required for tax and accounting, and records needed to defend a legal claim or prevent fraud. We will say so and delete the rest.

California residents have the rights above, plus the right to:

• know the categories of personal information collected, their sources, the business purpose, and the categories of third parties they go to — all set out in this policy;
• opt out of the sale or sharing of personal information;
• limit the use of sensitive personal information — we do not collect it for any purpose that triggers this right;
• not be retaliated against for exercising any of them.

In the last 12 months we collected the categories under “Information we collect”: identifiers, customer records, commercial information (your purchases), internet activity relating to our own site, and inferences only in the sense of which products you bought. We disclosed those categories to the service providers listed under “Who we share it with”, for the purposes listed under “How we use it”. We did not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of.

Discounts for signing up. If we offer a discount for joining our email list, that is a financial incentive under California law. It is worth roughly the face value of the discount; we offer it because engaged customers order more often; joining is optional; and you can withdraw at any time by unsubscribing. The price you pay for products is the same either way.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have broadly the same rights to access, correct, delete and obtain a portable copy, and to opt out of targeted advertising and profiling. Use the same contact route above. Where your state gives a right to appeal a refusal, you may appeal by replying to our decision; we answer within 45 days and, if we still decline, tell you how to contact your state Attorney General.

• Order, payment and tax records — at least seven years, because tax and accounting rules require it.
• Account details — while your account is open, then until you ask us to delete them.
• Carts — cleared automatically once no longer useful.
• Marketing lists — until you unsubscribe, after which we keep a suppression record so we do not email you again by mistake.
• Security and server logs — a short rolling window for troubleshooting and abuse investigation.
• Database backups — kept on a rolling schedule and overwritten in turn. A deletion request is applied to the live store immediately; any residual copy in a backup ages out with that backup.

The site is served over HTTPS. Passwords are stored only as salted one-way hashes. Every staff account requires two-factor authentication. Card details never touch our servers — Stripe takes them directly. Administrative access is restricted, sensitive actions are rate limited, and backups are held outside the public web root.

No method of transmission or storage is completely secure and we cannot guarantee absolute security. If a breach affects your personal information we will notify you and the regulators as the law requires. Tell us at once if you think your account has been compromised.

This store is for adults. It is not directed to children, we do not knowingly collect personal information from anyone under 18, and our products are not intended for children. If you believe a child has given us personal information, email us and we will delete it. We do not sell or share the personal information of anyone under 16.

We are based in the United States, ship only within the United States, and process information there. Privacy laws in the US may differ from those where you live. If you visit from outside the US, you are choosing to send your information to the US and have it handled under this policy and US law.

We may update this policy as the store or the law changes. The “last updated” date at the top always reflects the current version. If a change materially affects how we use information you already gave us, we will tell you — by email or a notice on the site — before it takes effect.

PaperBagged LLC
Bisbee, Arizona, United States
[email protected] · paperbagged.com

You can also use our contact form.