PRIVACY POLICY

Last Update: November 5, 2026

Previous Version: [link]

Welcome

This Privacy Policy ("Policy") explains how we collect, use, store, protect, and share your personal information through our services. Monrovia Nursery Company is the data controller of the personal information collected through the services (as defined in our Terms of Service ("Terms")). Monrovia Nursery Company is referred to in this Policy as "Monrovia", "we", "our" or "us".

How we handle your information depends on which services you use, and how you use them. This Policy is grouped into these sections:

• about us and this Policy;
• information we collect & why we use it;
• our disclosures of information to others;
• how to control your privacy; and
• information about local privacy laws; and
• cookie policy.

We encourage you to read this Policy carefully. If you have questions, please contact us.

About us and this Policy

This Policy is designed to explain how we process your personal information and how you can exercise control over our processing. Capitalized terms that are used but not defined in this Policy are defined in our Terms. The Terms describe how the Services work in general, and establish a contract between you and us governing your use of the Services.

Contact us

If you have any questions or feedback about this Policy, contact us at [email protected] or write to us at: Monrovia Nursery Company, 13455 SE Lafayette Highway, Dayton, OR 97114.

Changes to this Policy

Because the Services change often, this Policy may change over time. Anytime we modify the Policy, we post a revised version on the Services, as noted at Last Update above. If we intend to materially change our collection or use of information, we will notify you before the material changes to this Policy take effect, so you have time to review them. If we have your contact information (such as your email), we'll try to notify you that way. We may also post a temporary notice on the Services, or notify you by other means to the extent required by law.

Check the Last Update periodically to ensure you're aware of the current Policy. By using or accessing the Services, you signify that you have read, understand and agree to be bound by this Policy and the Terms.

When this Policy applies

This Policy applies to you when you use the Services, effective as of the Last Update. However, some collection and use of information falls outside this Policy:

Outside services: The Services link to, embed, integrate or otherwise connect you with third-party websites, services or other events or activities that are not owned or controlled by Monrovia ("Outside Materials"). Outside Materials are not part of the Services. This Policy doesn't apply to any information you may exchange with providers of Outside Materials. Those third parties have their own policies and practices about data. We encourage you to familiarize yourself with their privacy notices and applicable contractual terms.

Monrovia may outsource or subcontract some of our technical support, tracking and reporting functions, database management functions, and other services to third parties. We may share information, in compliance with this Policy, from or about you with them so that they can perform their services. You understand and agree that Monrovia will not be held responsible for any third-party communications sent by entities that Monrovia does not own or control.

Our personnel: If you are a current or former employee or contractor of ours, this Policy does not apply to you. Reach out to your human-resources partner or supervisor with any inquiries about your personal information.

When we don't control your information: If we receive your information in our role as a service provider to another business, our agreement with that business governs our use of your information. We will refer any questions or concerns of yours to that business.

Information we collect & why we use it

We and our third-party service providers collect and process information when you interact with the Services. This includes:

• information you submit or provide directly,
• data collected automatically by various technologies (which we call "Usage Data"), and
• information we receive from other sources.

The following tables describe, comprehensively, how the services collect and use your information, and the purpose behind that processing.

Information You Submit

Usage Data

Information We Receive From Others

You further authorize the following specific uses of your personal data:

• Improve algorithms;
• Send notifications, including push notifications, to your mobile device;
• Aggregate certain information that does not include your personal information and disclose it for analysis, demographic profiling, and/or targeted advertising;
• Provide statistical information and include you in the same statistical information;
• Communicate promotions or other offers; and
• Combine your information with information from Monrovia services and/or other services.

You also acknowledge any personal information that Monrovia obtains from other third-party sources will be processed by Monrovia in accordance with this Policy and all applicable laws. For example, our use and transfer of information via Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Technologies we use

When you use and interact with the Services, software automatically collects Usage Data. For more insight on the types of cookies and technologies we use and how to manage their collection of your data, see our Cookie Policy.

Security

Monrovia has implemented industry standard technical, administrative and physical security measures designed to protect your information from unauthorized access, use or disclosure. This includes the Secure Sockets Layer (SSL) protocol, which encrypts information you input at 128-bit strength, denoted in most web browsers by a small padlock application on the bottom bar of the window and the address of the window changing from http:// to https://, to indicate a secure connection.

Still, no data transmission online is 100% secure, so we cannot guarantee or warrant the security of any information you provide, and you do so at your own risk. We cannot promise that your information will remain absolutely secure in all circumstances. We are not responsible for the circumvention of any privacy settings or security measures we may provide.

Our disclosures of information to others

This section describes how and why we exchange personal information with contractors and third parties. It also describes exchanges made for certain purposes, like advertising, legal reasons and consensual direct marketing. We may also disclose deidentified and/or anonymized data for these purposes.

We do not 'sell' or 'share' personal information

That means we don't provide or exchange your personal information with others to facilitate behavioral ads (i.e., ads targeted to you) or otherwise sell it. For clarity, we haven't shared or sold any personal information for that purpose in the past twelve (12) months.

Direct marketing

We only exchange information about you with third parties for direct marketing purposes if you opt in, and will only do so until you opt out by emailing us at [email protected]. We may share information about you with third party sponsors or partners who will use it for marketing purposes but only if you opt in to such sharing or do not opt out when prompted. We will never share information in this manner without giving you one of these two options.

Functional disclosures

We also contract with other businesses to provide certain services related to the functionality and features of the Services, including payment processing, email and hosting services, software development, shipping and fulfillment, data management, and administration of contests and other promotions. We refer to them as "contractors."

Contractors may collect information about you on our behalf, such as Personal Identifiers, Commercial Information, Internet Activity and Device Information, as necessary for them to perform their services. At other times, we disclose information about you to contractors.

Contractors are not permitted to use information about you for any purpose other than performing their services for us. In the past twelve (12) months, we have disclosed these types of information to the following types of contractors (for further information about our contractors, see our Cookie Policy):

• Analytics and advertising providers, such as Google Analytics, to tell us how the Services is doing, such as which parts interest visitors and how long they visit before leaving. Among other data, they may receive your IP address.
• Various hosting services and data processors to provide the infrastructure of the Services, such as Cloudflare, which ensures that traffic is from real people, not computers. Among other data, they may receive your IP address.
• Payment providers, namely [list payment processors], to process payments between you and us, such as for subscriptions or products. These providers receive information about your order in order to tie your payment process to your order. We don't receive all of the information you may provide to them as part of that process (for instance, we don't receive full payment-account numbers).
• Support providers, namely HappyFox, to provide assistance to you when you request it. They are able to retrieve information about you that is relevant and necessary to your requests, such as account information and order details.

For personalized ads

We share information with advertising partners to make the advertising presented to you more relevant to you. We also market the Services to you through ads facilitated by marketing vendors. For example, we use Google AdSense to serve ads on the Services and we may market the Services to you on third party services through Google. Google uses cookies or unique device identifiers, in combination with their own data, to show you ads based on your visits to our webpages and to other sites. You can opt out of the use of the Google cookie by visiting the related Google privacy policy.

We try to limit how our third-party advertising technology vendors use information they collect from you. Most providers require us to enter contracts that allow them to optimize their ad services and products. Essentially, they combine any information they may gather about you through our Services with information they receive from their other clients. This helps them target ads to you on behalf of their other clients, not just us. In the past twelve months, we have shared these categories of personal information with third parties to personalize advertising:

• Device Information (including Personal Identifiers)
• Commercial Information
• Internet Activity
• Geolocation

With your consent or at your request

We may periodically ask for your consent to share your contact information to third parties. Whenever we ask your consent for this reason, we will summarize the purpose and scope of the disclosure. For example, we may offer discounts to you if you consent to join our mailing list or participate in a promotion involving direct marketing communications.

In those cases, the Services will display a tickbox near an email-entry field explaining that by submitting your information, you agree to share your email with the content provider.

To be clear, we only exchange information about you with third parties for direct marketing purposes if you opt in, and will only do so until you opt out.

Purchase or sale of the websites or other assets

Monrovia may purchase other businesses or sell components of its business, including but not limited to, the website and/or its services. In the event Monrovia purchases another business or sells any component of its business, your personal data will continue to be used in consistence with the terms of this Privacy Policy.

For legal reasons

Finally, we may disclose personal information:

• In response to subpoenas, court orders, or other legal process; to establish or exercise our legal rights; to defend against legal claims; or as otherwise required by law. In such cases we reserve the right to raise or waive any legal objection or right available to us;
• When we believe it is appropriate to investigate, prevent, or take action regarding illegal or suspected illegal activities; to protect and defend the rights, property, or safety of our company, our users, or others; and in connection with the enforcement of our Terms and other agreements; or
• In connection with a corporate transaction, such as a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

How long we retain your information

We retain your information only as long as we need it for the purposes described under Information we collect & how we use it, except when longer retention is required by our compliance policies and efforts toward applicable legal, tax, accounting and regulatory requirements. How long we need information for those purposes varies by category, and even within categories. These retention determinations always consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from its unauthorized use or disclosure and whether we can achieve those purposes without using the personal information.

For example, we delete some Usage Data as soon as you exit the Services, whereas we may retain records of your orders for services and products for several years as required by law or contract, such as agreements with our payment processors or under our accounting standards.

Children's online privacy protection policy

The Services are not intended for or directed to users under the age of 18, and Monrovia does not knowingly or intentionally collect personal data from children under the age of 13 or other minors.

Where applicable, Monrovia takes reasonable measures to determine that users are adults of legal age and to inform minors not to submit such information to the websites and/or services or in response to advertisements.

If we learn that we have collected information from a person under age 13, we will delete that information as quickly as possible. If you are concerned that personal data may have been inadvertently provided to or collected by Monrovia, please contact us immediately so appropriate steps may be taken to remove such information from Monrovia's database.

If you are under 16: sorry, but please leave the Services. If you've already sent us information, please contact us first so we can delete it.

If you are a parent or guardian of a person under 16 years of age and you believe that person provided information to us: please contact us.

How to control your privacy

In General

As a user of the Services, you have rights and choices about your personal information. We want you to be in control of your information, so we want to remind you of the following options and tools available to you:

Account controls: You can update the personal information in your Account through the account settings made available on the services. Any updated information will be reflected in our records and throughout the services promptly.

Marketing opt-outs: you may opt-out of any marketing communications from us by following the unsubscribe instructions in the communication you receive. We may continue to send you communications regarding the Services, such as notices about administrative updates, transaction reports, and changes to the Services, this Policy or the Terms.

Push notifications: You can choose to receive mobile or browser push notifications from our services. The services will send you push notifications from time to time in accordance with any notification preferences you have set on your device or browser. If you later decide you no longer want to receive these notifications, you can use your device or browser's settings to turn them off.

Exercising rights: If any of the local privacy laws listed below apply to you, see Requesting information to exercise your rights. These rights are provided only to human account holders, and are not available to employers or other legal entities, except as required by law.

Disallowing Location Data Collection: When you access certain services on the Services, like some of our apps, through a mobile device, you may consent to share your precise (GPS level) geolocation with us so we can customize your experience and the content you receive. You may change your location sharing settings at the browser or device level at any time.

Personalized ads: In addition to any choices the services offer you, there are several ways to exercise choice regarding technologies that are similar to cookies, such as browser storage and plugins (for example, HTML5, IndexedDB, and WebSQL). For example, many popular browsers provide the ability to clear browser storage, typically in the settings or preferences area. See your browser's help function or support area to learn more. For more about targeted advertising, go to the DAA Webchoices Browser Check or the NAI Opt Out of Interest-Based Advertising page. You can download the AppChoices app to opt out in mobile apps.

Personal Data Transfer and Storage

Your personal data is stored and processed on computers and servers in the United States. Through your use of the Services, you consent to the processing and storage of your personal data and personally identifiable information. You understand that your personal data may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction.

If you are located outside the United States, you acknowledge that we transfer your personal data to the United States and process it here, and that we may store portions of your personal data in the United States. The transfer of this information to the United States is necessary for the performance of our contract for use of the Services.

If we transfer personal data subject to GDPR outside of Monrovia, we use standard contract clauses approved by the EU for this purpose, or another appropriate transfer mechanism. U.S. law is not equivalent to laws in other countries, such as GDPR in Europe or PIPEDA in Canada. Note that, as of the Last Update, the U.S. has not been deemed an 'adequate' jurisdiction under GDPR for the purposes of international data transfers.

Information about local privacy laws

The Services operate from the United States, but this Policy applies worldwide. Our practices generally do not differ based on your location, but your rights and choices depend in part on the law where you live.

If any of these local privacy laws apply to you, that section overrides any contrary descriptions elsewhere in the Policy as they relate to you. If you have questions about your rights under other data privacy laws, please contact us.

Requesting information

Submitting requests

To exercise any rights described in this Policy, please contact us or use our Do Not Sell My Info form. Your request must:

• provide sufficient information to identify you and the law that applies to you, such as your name, e-mail address, home or work address, or other information we maintain.
• not include social security numbers, driver's license numbers, third-party account numbers, credit or debit card numbers, or health information.

Verifying requests

We verify requests by attempting to match information in the request to information we maintain. We may require you to confirm your identity by authenticating via your account or other access method.

If your request is unclear or we are unable to authenticate your identity, we may ask for more information, in accordance with law that applies to you.

If you are an authorized agent submitting a request on a user's behalf (where permitted), we may require proof of the user's written authorization before processing the request.

If we cannot verify the identity of the data subject in the request, we may deny it, in full or in part.

Responses to requests

We will respond to your request as quickly as we can, taking into account the nature of your request and the volume of pending requests. The content of our response will vary with the nature of your request, but will always respond in accordance with any deadlines or requirements specified by the laws that applies to you.

At times, we may be unable to provide responsive personal information, such as when disclosure would create a substantial, articulable and unreasonable risk to the security of the information, user accounts, or the security of our systems or networks. We do not disclose account passwords or any other non-personal information that enables access to an account.

We reserve the right to retain an archive of any deleted information, to the extent permitted by law. We may also retain deidentified or aggregate data derived from personal information.

Appealing decisions

Residents of jurisdictions that provide for an appeal mechanism may appeal a decision we have made regarding their requests by contacting us.

Information for Users in Certain U.S. States

Exercising your rights: As described in the "How to control your privacy" section of the Policy, all users have control over their information and can limit what data we process. If you are a resident of California, Colorado, Connecticut, Utah, Virginia or another state with a similar data-privacy law, you may have additional rights that you (or, in certain states, an authorized agent acting on your behalf) can exercise by contacting us, including the right to:

• More information about the categories and specific pieces of personal information we have collected and disclosed for a business purpose in the last 12 months
• Access and/or receive a copy of certain personal information we hold about you
• Correct your personal information
• Delete certain personal information we hold about you
• Receive information about the financial incentives that we offer to you, if any
• Opt out of the processing of your personal information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects, if applicable

You also have the right to not be discriminated against for exercising your rights. You may also have the right to opt out of "sales" of your information and "sharing/processing of your information for targeted advertising."

Certain information may be exempt from the requests above under applicable law. For example, we need to retain certain information in order to provide our services to you. We also need to take reasonable steps to verify your identity before responding to a request.

If you have any questions about these rights, wish to exercise them, or request an appeal, see Requesting information or contact us.

Additional Information for Users in California

In addition to the rights described above, consumers residing in California are afforded the right to certain additional information with respect to their personal information under the California Consumer Privacy Act ("CCPA"). If you are a California resident, this section applies to you.

Our collection and use of personal information: We collect the following categories of personal information: identifiers (such as your username, the email address you used to sign up, and your phone number if you've chosen to provide it); commercial information (a record of what you've bought from Monrovia, if anything); financial data (payment information and your history of purchases from Monrovia); internet or other network information (how you interact with the services); location information (because your IP address may indicate your general location); inference data about you (for example, what content you may be interested in); and other information that identifies or can be reasonably associated with you.

For more information about what we collect and the sources of such collection, please see the "Information we collect & why we use it" section of the Privacy Policy. To the extent we collect or use sensitive personal information as defined by law (such as the CCPA), we do so in accordance with applicable legal requirements, and we do not use or disclose it other than for purposes for which there is not a right to limit under the CCPA.

Disclosure of personal information: We may disclose and share your personal information with service providers and third parties as described in the "Our disclosures of information to others" section of the Policy. We disclose the categories of personal information mentioned in that section for business or commercial purposes.

No sale or "share" of personal information: The CCPA sets forth certain obligations for businesses that sell or "share" personal information. We do not sell or share the personal information of our users as those terms are defined in the CCPA. We do disclose certain information as outlined in the "Our disclosures of information to others" section of the Policy and you can make choices with respect to your information as outlined in that policy.

We disclose personal information for the following categories of purposes, as defined by CCPA:

• Advertising and Marketing
• Error Management
• Internal Research
• Provide Products or Services
• Quality Assurance
• Security
• Short-Term Transient Use

We retain personal information as described in the "How long we retain your information" section of the Policy.

Upon receipt of a verifiable consumer request in accordance with the current California Attorney General's regulations, we will promptly take steps to appropriately comply with your request free of charge within 45 days. If we determine that it is reasonably necessary for us to extend this period by another 45 days, we will provide notice to you within the initial 45-day period with an explanation of why we need more time to complete your request. You may make a verifiable consumer request once every 12 months. We do not discriminate against any users who exercise any of their rights under the CCPA/CPRA; however, some prices or service offerings may vary if reasonably related to the value provided by the personal data. If you would like to send a verifiable consumer request to exercise any of your rights, you can do so by contacting us:

• Toll free: 888-752-6848
• Via our website: https://www.monrovia.com/contact-us/
• Via email: [email protected]

California's "Shine the Light" law gives residents of California the right under certain circumstances to request information from us regarding the manner in which we share certain categories of personal information (as defined in the Shine the Light law) with third parties, as defined under applicable law, for their direct marketing purposes. We only share your personal information with third-parties for their own direct marketing purposes with your consent and, if you have consented, only until you withdraw your consent. For more information, please submit a request in writing to:

ATTN: Monrovia Marketing
13455 SE Lafayette Hwy
Dayton, OR 97114

For further questions about these rights or to request an appeal, see Requesting information or contact us.

Cookie Policy

This Cookie Policy helps to explain the occasions when and why Cookies are used in connection with visits to the Services. By using or accessing our Services, you agree to Monrovia's use of Cookies as outlined below.

This Policy is effective as of the Last Update date above. As the technology used by the Services changes, we strive to update this Policy up to date. However, please note that because most Cookies are Outside Materials (as defined in our Terms), we cannot guarantee the currentness or accuracy of the descriptions of those third-party technologies below.

Any changes to the Cookie Policy become effective on the Last Update date indicated above. By using the Services after the Last Update, you will have accepted the current Cookie Policy.

What is a Cookie?

We use certain cookies, web beacons, pixel tags, and similar technologies (collectively "Cookies") to collect information about your browsing activities and to distinguish you from other users of our Services. Cookies are text-only pieces of information that a website transfers to an individual's hard drive or other website-browsing equipment. Cookies allow the Services to remember important information that will make your use of the Services more convenient.

A cookie will typically contain the name of the domain from which the cookie has come, the "lifetime" of the cookie, and a randomly generated unique number or other value. Session cookies are temporary cookies that remain in the cookie file of your browser until you leave the Services. Persistent Cookies remain in the cookie file of your browser for much longer (though how long will depend on the lifetime of the specific cookie).

Pixel tags and web beacons are tiny graphic images placed on web pages or in emails that allow us to determine whether you have performed a specific action. When you access these pages or open or click an email, the pixel tags and web beacons generate a notice of that action, allowing us to measure communication response rates and improve our Services. The tags can collect information such as the IP address of the device that accessed the tagged-page; the URL of the page on which the pixel tag appears; the time (and length of time) the page containing the pixel tag was viewed; the type of browser that retrieved the pixel tag; and the identification number of any cookie previously placed by that server on your computer.

Why we use Cookies

Cookies improve your experience when you use our Services and aid our improvement of the functionality of our Services. In many cases, the information we collect using Cookies and other tools is used in a non-identifiable way, without any reference to personal data.

We use traffic log cookies to identify which pages are being used. This helps us analyze data about web page traffic and improve our website by tailoring it to customer needs. We only use this information for statistical analysis purposes. Then, the data is removed from the system.

Overall, cookies help us provide you with a better website by showing us which pages you find useful and which you do not. In no way does a cookie give us access to your computer or any information about you, other than the data you choose to share with us. You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but if you prefer, you can usually modify your browser setting to decline cookies. This may prevent you from taking full advantage of a personalized website experience.

In addition to cookies that power basic traffic and account settings, we use several Google Analytics features based on Display Advertising, including Remarketing, Google Display Network Impression Reporting, the DoubleClick Campaign Manager integration, and Google Analytics Demographics and Interest Reporting.

We use Remarketing with Google Analytics to advertise online. Third party vendors, including Google, may show our ads on sites across the internet. We, as well as third party vendors including Google, use first party cookies (such as the Google Analytics cookie) and third-party cookies (such as the DoubleClick cookie) together to inform, optimize, and serve ads based on your past visits to our websites, as well as to report how our ad impressions, other uses of ad services, and interactions with these ad impressions and ad services are related to visits to our website. Similarly, we use Google Analytics Demographics and Interest Reporting (such as age, gender, location, and interests) to help improve the effectiveness of the information we display.

Know that, through all of this, we will never facilitate the merging of personally-identifiable information with non-personally identifiable information previously collected from Display Advertising features based on the DoubleClick cookie unless we have notified you and received your consent (i.e., affirmative opt-in) to that merger.

Types of Cookies

Below is a broad overview of the types of Cookies that we and third parties may use to collect Personal Information:

Where required by applicable law, we obtain your consent to use Cookies.

Cookies we use

The Cookies in use on the Services vary, depending on your settings, your location, your browser and the availability of the Cookie itself. As of the Last Update date, the Services generally deploys these cookies:

How to control Cookies

You have a variety of tools available to control the data collected by Cookies (some of which are described in the table above). For example, you can use controls in your internet browser to limit how the websites you visit are able to use cookies and to withdraw your consent by clearing or blocking cookies.

Cookie preferences

You can stop Monrovia from placing cookies (other than those required for the website to function) on your device by referencing the instructions herein or by opting out using the Cookie-preferences banner that appears at the bottom of the Services on your initial visit to the website and remains visible until you action it (by choosing your 'CUSTOM SETINGS' or hitting 'ACCEPT ALL').

Opt-out signals

The Services automatically honor any global opt-out preference signal sent from California IP addresses to the Services through browser or device-level settings, provided the signal complies with CCPA's requirements. At this time, we are evaluating how to configure the Services to automatically honor Global Privacy Control signals in a frictionless manner.

Other global settings

You can block Cookies by setting your internet browser to block some or all the Cookies. However, if you use your browser settings to block all Cookies (including essential Cookies) you may not be able to access all or parts of our Services. By using our Services you consent to our use of Cookies and our processing of information collected through such cookies, in accordance with this Cookie Policy and our Privacy Policy. You can withdraw your consent at any time by deleting placed cookies and disabling Cookies in your browser, or as explained below.

You can change your browser settings to block or notify you when you receive a Cookie, delete Cookies or browse our Services using your browser's anonymous usage setting. Please refer to your browser instructions or help screen to learn more about how to adjust or modify your browser settings.

If you do not agree to our use of Cookies or similar technologies which store information on your device, you should change your browser settings accordingly. You should understand that some features of our Services may not function properly if you do not accept Cookies or these technologies. Where required by applicable law, you will be asked to consent to certain Cookies and similar technologies before we use or install them on your computer or other device.

Supplemental language

Notice of Financial Incentive

From time to time, we may offer promotional pricing or discounts in exchange for enrolling in our SMS or email marketing messages. By confirming enrollment, you consent to receive our SMS or email messages until you opt-out, including any discount codes we offered you. The specific terms of any offer are disclosed at the time the offer is extended.

To opt-in to emails, a consumer must enter their email address into the form and submit it. To opt-in to SMS messages, a consumer must enter their phone number and reply Y to the auto-generated message. To opt out of future emails, unsubscribe from our marketing emails by using the unsubscribe link in the email footer at any time. To opt out of future SMS, reply "STOP" to any of our SMS.