Hotpot Queen Cookie Policy

Last updated: 2026-04-19 Version: 1.0

1. What This Cookie Policy Covers

Hotpot Queen (a DBA of Nifty Napkin Inc, a Washington corporation) (“Hotpot Queen,” “we,” “us,” or “our”) uses cookies and similar tracking technologies on our website at hotpotqueen.com. This Cookie Policy explains what those technologies are, how we use them, and the choices available to you.

This Cookie Policy supplements our Privacy Policy at https://hotpotqueen.com/policies/privacy-policy, which addresses how we collect, use, and disclose personal information more broadly. If there is a conflict between the two documents, the Privacy Policy governs with respect to personal information generally; this Cookie Policy governs the specifics of cookie and tracking-technology use. Capitalized terms used but not defined here have the meanings given in the Privacy Policy.

This Cookie Policy applies solely to hotpotqueen.com. It does not apply to third-party websites linked from our site.

2. What Are Cookies and Similar Technologies

Cookies are small text files that a website places on your browser or device when you visit. Cookies may be:

• Session cookies — temporary files that exist only for the duration of your browser session and are deleted when you close your browser.
• Persistent cookies — files that remain on your device for a fixed period (or until you delete them) and are re-read each time you return to the site.

Beyond cookies, we and our service providers may use additional technologies:

• Pixels and tags — small images or snippets of code embedded in a web page or email that report when the page or email is opened or when a link is clicked.
• Local storage and session storage — browser-based storage mechanisms that allow a site to retain data (such as cart contents) on your device outside of traditional cookies.
• Server-to-server tracking — event signals transmitted directly between our systems and a service provider’s systems without storing data on your device. For example, when you open a Klaviyo email or click a link in one, your activity may be recorded via a server-to-server signal tied to your email address or profile identifier.
• Device and browser signals — technical attributes of your device and browser (such as browser type, operating system version, installed fonts, and screen resolution) that, in combination, can identify a browser or device. We do not currently build fingerprints for individual tracking, but certain of our service providers may collect these signals for security, fraud prevention, or analytics purposes.

When we use the word “cookies” in this Cookie Policy, we mean all of the above technologies collectively, unless we specifically distinguish between them.

3. Categories of Cookies We Use

3.1 Strictly Necessary

Strictly necessary cookies are essential for the website to function. Without them, core features — such as adding items to your cart, completing checkout, logging in to your account, and protecting the site against unauthorized requests — cannot work. These cookies do not require your consent and cannot be disabled through our cookie controls.

Examples of strictly necessary cookies and functions:

• Shopify cart and session tokens (maintain your shopping session across pages)
• Shopify checkout tokens (required to complete a purchase)
• CSRF protection tokens (prevent cross-site request forgery)
• Cookie-consent state storage (records that you have interacted with our consent notice)
• Fraud detection session identifiers required for payment processing

We do not classify any non-essential technology as strictly necessary.

3.2 Performance and Analytics

Performance and analytics cookies help us understand how visitors use our site in aggregate — which pages are most visited, how long visitors stay, where they navigate from, and where they exit. This information is used to improve our website and customer experience. These cookies collect data in aggregate or pseudonymous form and are not used to identify you individually.

Examples:

• Shopify built-in analytics (page views, conversion funnels, traffic sources)
• Cloudflare analytics (edge-level traffic measurement and performance data)

You may disable performance and analytics cookies via our Cookie Preferences controls in the site footer.

3.3 Functionality

Functionality cookies remember choices you have made or actions you have taken in order to provide a more personalized experience. They are not essential to the website’s core operation but improve usability.

Examples:

• Shopify product recently-viewed (surfaces products you browsed earlier in your session)
• Language or regional preference storage
• Wishlist state or saved-for-later items

First-party email-engagement and cart-recovery signals. Our email and SMS service provider (Klaviyo) sets first-party pixels and event trackers that let us send you abandoned-cart follow-ups, email-open and click receipts for campaigns you have consented to receive, and other first-party operational communications. These are distinct from third-party advertising pixels.

You may disable functionality cookies via our Cookie Preferences controls. Doing so may reduce personalization features.

3.4 Advertising and Targeted Advertising

We do not currently deploy advertising or retargeting pixels on hotpotqueen.com. No cookies, pixels, or tags associated with advertising networks (such as Meta/Facebook, Google Ads, or TikTok) are active on our site as of the date of this Cookie Policy. (“Advertising and retargeting pixels” in this section means third-party advertising-network pixels such as Meta/Facebook, Google Ads, TikTok, Pinterest, or similar platforms whose purpose is to target advertising to you across websites other than hotpotqueen.com. First-party email-engagement and cart-recovery tracking by our own email service provider (Klaviyo) is treated as a functionality cookie under section 3.3, not as a third-party advertising pixel.)

If we activate advertising cookies in the future, we will update this Cookie Policy before activation and, where applicable, provide opt-out controls at or prior to that time. Advertising cookies, if deployed, may be considered a “sale” or “sharing” of personal information for cross-context behavioral advertising under the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) and equivalent state privacy laws. We will honor all applicable opt-out rights before activating any such technology.

4. Specific Technologies Currently In Use

The following service providers currently operate cookies or similar tracking technologies on hotpotqueen.com:

• Shopify — First-party cookies used for cart, session management, checkout flow, order processing, customer account authentication, and site analytics. Operator: Shopify Inc. Privacy policy: https://www.shopify.com/legal/privacy

• Klaviyo — Email and SMS campaign tracking, including server-to-server event tracking and, on certain pages, client-side pixels for email-open, link-click, and cart-abandonment events tied to Klaviyo marketing profiles. Operator: Klaviyo, Inc. Privacy policy: https://www.klaviyo.com/legal/privacy-policy

• Cloudflare — Edge network security, bot protection, and first-party analytics. Operator: Cloudflare, Inc. Privacy policy: https://www.cloudflare.com/privacypolicy/

Advertising/retargeting pixels: none currently active.

We will update this section when we add or remove technologies.

5. Legal Basis and CCPA / CPRA Treatment

For US and Canadian residents, we collect and use cookie data primarily under a legitimate business interest rationale — specifically, to operate and secure our website, process orders, and understand how visitors use our site in aggregate. Where US state law requires opt-in consent or opt-out mechanics for specific uses, we provide those mechanisms as described in this Cookie Policy and on our Privacy Choices page.

Consistent with our Privacy Policy, certain uses of cookies and similar technologies may be considered “sharing” of personal information for cross-context behavioral advertising under CCPA/CPRA (Cal. Civ. Code § 1798.100 et seq.) and equivalent state laws. Because no advertising or retargeting pixels are currently active on hotpotqueen.com, we do not currently engage in such sharing. If we activate advertising cookies in the future, we will update this Cookie Policy and honor all applicable opt-out rights at that time. Consistent with section 5 of our Privacy Policy, we do not currently share personal information for cross-context behavioral advertising.

Residents of California and other states with applicable privacy laws have the right to opt out of the sale or sharing of personal information. See Section 7 for opt-out mechanisms and our Privacy Choices page at https://hotpotqueen.com/pages/privacy-choices.

6. Global Privacy Control (GPC)

Hotpot Queen honors the Global Privacy Control (GPC) signal as an opt-out request under CCPA/CPRA and under equivalent state privacy laws that recognize GPC.

How GPC works. When you have GPC enabled in your browser or via a browser extension, your browser transmits a GPC signal to each website you visit. When our site detects a GPC signal from your browser, we treat it as an opt-out request for that browser and device — meaning we will not use cookies or similar technologies on that browser/device in ways that constitute a sale or sharing of personal information for cross-context behavioral advertising.

Account-level application. Where we can associate a GPC signal with a logged-in account, we will apply the opt-out preference to that account as well as to the transmitting browser and device.

Device scope. A GPC signal is scoped to the specific browser and device transmitting it. We do not automatically apply a GPC opt-out from one device or browser to other devices, browsers, or accounts associated with you. To opt out across all devices and your account, use our Privacy Choices page at https://hotpotqueen.com/pages/privacy-choices or contact us at privacy@hotpotqueen.com.

Persistence of the GPC opt-out. We honor your GPC preference on each subsequent visit from the same browser and device. Clearing cookies, updating your browser, or the expiration of a browsing session does not withdraw your GPC opt-out. To withdraw a GPC opt-out, you would need to disable GPC in your browser or extension settings; we will not interpret other actions as withdrawal.

7. How to Manage Your Cookie Preferences

You have several ways to control cookies and similar technologies:

Cookie Preferences (site footer). A Cookie Preferences link in the site footer opens our native cookie notice, where you can adjust your preferences by category (Performance and Analytics; Functionality). Strictly Necessary cookies cannot be disabled. Your preferences are stored in a consent cookie on your browser. Our cookie notice sets non-essential cookies to an OFF-by-default state; you must affirmatively enable a non-essential category (Performance / Analytics, Functionality) for those cookies to be set. Strictly-necessary cookies remain on by default because they are required for the site to function.

Browser controls. All major browsers — Chrome, Firefox, Safari, and Edge — allow you to block, delete, or restrict cookies through their settings menus. Restricting or deleting cookies may impair site functionality, including the ability to complete checkout.

Opt-out tools for advertising networks. Although we do not currently operate advertising cookies, the following industry opt-out tools are available for future reference or for opt-outs from other sites:

• NAI opt-out: https://optout.networkadvertising.org/
• DAA WebChoices: https://optout.aboutads.info/
• YourAdChoices (mobile): https://youradchoices.com/appchoices

Do Not Sell or Share My Personal Information. To opt out of any current or future sale or sharing of personal information, visit: https://hotpotqueen.com/pages/privacy-choices

Email tracking pixels. You may opt out of Klaviyo email-open and click-tracking by unsubscribing from our marketing emails via the unsubscribe link in any marketing message. Unsubscribing also suppresses the associated email-engagement pixels for your profile.

Contact. For cookie-related rights requests or questions, email privacy@hotpotqueen.com.

8. Do-Not-Track (DNT) Signals

Aside from Global Privacy Control (GPC) as described in section 6, our site does not currently respond to browser Do-Not-Track (DNT) signals; no universally-supported DNT standard exists. As the landscape evolves, this posture may change.

9. Data Retention of Cookie Data

Session cookies expire at the end of your browser session when you close your browser.

Persistent cookies are retained for the duration specified by the cookie issuer, for periods ranging from a few hours to two years, depending on the purpose and as specified by the cookie issuer.

Analytics data collected through Shopify’s built-in analytics and Cloudflare analytics is retained in accordance with each provider’s own data retention policies, as disclosed in their respective privacy policies linked in Section 4.

Klaviyo event data (such as email-open events or cart-abandonment signals) is tied to your Klaviyo marketing profile. Profile-level retention is as described in Section 6 of our Privacy Policy.

10. Children

We do not knowingly use cookies or similar technologies to collect personal information from children under 13 years of age, or under 16 years of age in jurisdictions where that higher threshold applies. If we become aware that we have inadvertently collected such information, we will take steps to delete it promptly. To report a concern, contact privacy@hotpotqueen.com.

11. International Considerations

Our store is operated from and intended for customers in the United States and Canada. Our primary compliance framework for cookie and tracking-technology use is US state privacy law, including CCPA/CPRA.

Visitors from the European Union, United Kingdom, or other regions with distinct cookie-consent requirements (such as the EU ePrivacy Directive or the UK PECR) may have different legal expectations. We honor opt-out signals as described in this Cookie Policy when such visitors interact with our site. We do not make affirmative representations of compliance with EU or UK cookie law beyond our commitment to honor opt-out signals as described in this policy.

12. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in our tracking-technology stack, applicable law, or our business practices. When we do, we will update the “Last updated” date at the top of this document.

Changes that introduce a new tracking category — in particular, the activation of advertising or retargeting cookies — will be disclosed via a prominent notice on our website before or at the time of activation, and will be reflected in an updated version of this Cookie Policy.

13. Contact

Questions about this Cookie Policy, our cookie practices, or your privacy rights may be directed to:

Nifty Napkin Inc (DBA Hotpot Queen)

522 W Riverside Ave Ste 8149, Spokane, WA 99201

privacy@hotpotqueen.com