Legal

Privacy Policy

Last updated: May 10, 2026 · Mimi Pillow, Inc.

The short version. We collect your phone number and email so we can tell you when Mimi is back in stock. We share this data only with the platforms that help us send those messages. We never sell it. You can opt out any time by replying STOP to any SMS or emailing us.

1. Who we are

This Privacy Policy applies to the website at www.mimipillow.com ("the Site") and is provided by Mimi Pillow, Inc. ("Mimi", "we", "us"), a Delaware corporation. We are the data controller for the personal information collected through the Site.

2. Information we collect

You provide directly

Phone number — when you join the SMS waitlist via our reservation form.
Email address — when you provide one as an alternative or in addition to your phone number.
SMS consent record — the fact that you checked the consent box and the timestamp of when you did so.

We collect automatically

Attribution data — UTM parameters and referring URL from the link you arrived through (e.g. Instagram bio, ad campaign).
Device data — browser user-agent string and IP address, used to identify the device for security and to debug issues.
Session data — temporary attribution stored in your browser's sessionStorage for the length of your visit.

3. How we use your information

To send you the SMS and email marketing messages you opted into (launch announcements, restock notifications, exclusive offers for waitlist subscribers).
To process and fulfill orders if and when you place one.
To understand which marketing channels are bringing visitors to the Site, in aggregate.
To detect and prevent fraud, abuse, and spam.
To comply with our legal obligations.

4. SMS marketing specifically

If you provided your phone number and checked the SMS consent box, you consented to receive recurring marketing messages from Mimi. Standard message and data rates may apply. Message frequency varies. Reply STOP to any message to opt out at any time. Reply HELP for help.

SMS service provider disclosure. We share your phone number, SMS consent status, consent timestamp, and IP address with our third-party SMS marketing platform (currently Postscript or a comparable platform such as Klaviyo or Twilio) solely for the purpose of sending you the marketing messages you have opted into. These providers process your data on our behalf under written data-processing agreements and are contractually prohibited from using your phone number for any other purpose. Your phone number is never sold or rented to third parties.

Carriers are not liable for delayed or undelivered messages.

5. Other service providers we share data with

We share information with the following categories of service providers, only to the extent necessary for them to perform their services:

Supabase — database hosting (stores your contact info and consent record).
Vercel — website hosting and CDN (processes incoming requests).
Postscript / Klaviyo / Twilio — SMS service providers (as described above).
Shopify — payment and order processing, when checkout becomes available.
Analytics providers (e.g. PostHog) — aggregate visitor analytics, when enabled.

We do not sell your personal information to third parties for their own advertising purposes.

6. Your rights

Everyone

You can request a copy of the personal information we hold about you.
You can request that we correct or delete your information.
You can opt out of SMS by replying STOP. You can opt out of email by replying or using any unsubscribe link.

California residents (CCPA / CPRA)

You have additional rights to know, delete, correct, and limit the use of your personal information, and to not be discriminated against for exercising those rights. We do not sell your personal information.

EU/UK residents (GDPR)

You have rights to access, rectify, erase, restrict, and port your personal data, and to object to processing. The lawful basis for our processing is your consent (for SMS marketing) and our legitimate interests (for analytics and security). You may withdraw consent at any time without affecting prior processing.

To exercise any right, email hello@mimipillow.com with the subject line "Privacy Request".

7. Data retention

We retain your contact information and consent record for as long as you remain on our marketing list, plus a reasonable period afterward to demonstrate compliance with applicable laws. If you opt out, we retain only the minimum data needed to honor your opt-out (a suppression list).

8. Cookies and similar technologies

We use first-party browser sessionStorage to remember the marketing channel you arrived from during a single visit. We do not use third-party advertising cookies. If we add analytics tools that use cookies, we will update this policy and provide controls.

9. Children

The Site is not directed to children under 16 and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

10. International transfers

Mimi Pillow, Inc. is based in the United States. By using the Site you consent to the transfer of your information to the United States and to processing by our service providers, which may be located in other jurisdictions. We rely on standard contractual clauses or comparable mechanisms where required.

11. Security

We use industry-standard technical and organizational measures to protect your personal information, including encryption in transit (HTTPS), database-level row security policies, and access controls. No method of transmission over the internet is fully secure; we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be communicated via email or SMS to people on our marketing list.

13. Contact

For privacy questions or to exercise any of your rights, email hello@mimipillow.com.

← Back to Mimi