MURAL & CO — PRIVACY POLICY

Last updated: June 4, 2026

1. Introduction

This website, www.muralandco.com (the "Site"), and the brand "Mural & Co" are operated by GROUPE VLA, a French simplified joint-stock company (Société par actions simplifiée, SAS), SIREN 981 824 634, with its registered office at 229 rue Saint-Honoré, 75001 Paris, France ("Mural & Co", "we", "us", or "our"). We sell exclusively to consumers in the United States.

This Privacy Policy explains what personal information we collect, how we use and disclose it, and the choices and rights you have. By using the Site or placing an order, you acknowledge this Policy.

2. Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information:

• Identifiers: name, email address, shipping and billing address, phone number, and account login details.
• Commercial information: products viewed and purchased, order history, and payment confirmations. We do not store full payment card numbers; payments are handled by our payment providers.
• Internet and device activity: pages visited, interactions, browser and device type, IP address, and cookie or pixel data.
• Approximate location: derived from your IP address.
• Inferences: preferences used to personalize content and marketing.

We do not knowingly collect sensitive personal information beyond what is needed to process your order [confirm], and we do not knowingly collect personal information from children (see Section 12).

3. How We Collect Personal Information

• Directly from you: when you place an order, create an account, subscribe to our emails or SMS, leave a review, or contact us.
• Automatically: through cookies, pixels, and similar technologies when you browse the Site.
• From third parties: our payment, shipping, analytics, advertising, and review providers.

4. How We Use Personal Information

• To process, fulfill, ship, and track your orders, and to provide customer service and after-sales support.
• To process payments, offer installment options where available, and prevent fraud and secure transactions.
• To create and manage your account.
• To send marketing communications by email or SMS (with your consent where required) and to display and manage product reviews.
• To analyze and improve the Site and our offers.
• To comply with our legal, accounting, and tax obligations.

5. How We Disclose Personal Information

We do not sell your personal information for money. We disclose personal information to:

• Service providers / processors who act on our behalf, including website hosting (Shopify), email and SMS marketing (e.g., Klaviyo and our SMS provider), payment providers (e.g., PayPal, Klarna, and card processors), shipping (UPS), our reviews platform, and IT and analytics providers. [Confirm and complete this list.]
• Advertising and analytics partners: we use cookies and pixels (e.g., Meta, Google) for analytics and targeted advertising. Under California law (CPRA), the use of these technologies for cross-context behavioral advertising may be considered "sharing" of personal information. You can opt out (see Section 8).
• Legal and safety reasons, and in connection with a business transfer (merger, acquisition, or sale of assets).

Hosting and payments (Shopify). The Site is hosted on Shopify Inc., which provides the e-commerce platform used to sell our products. Order and account data is stored on Shopify's secure infrastructure. If you pay through a direct payment gateway, your card data is encrypted in accordance with the Payment Card Industry Data Security Standard (PCI-DSS) and retained only as long as necessary to complete your transaction. For more detail, you may review Shopify's own Terms of Service and privacy practices.

6. SMS and Text Message Marketing

By providing your phone number at checkout, through a sign-up form, or by texting a keyword, you agree that we may send you transactional text messages (such as order updates and abandoned-cart reminders) and marketing text messages. Consent to receive marketing texts is not a condition of any purchase.

• Message frequency varies and will not exceed [number] messages per month.
• Message and data rates may apply.
• To stop receiving messages, reply STOP to any message. For help, reply HELP.
• We share your phone number with our SMS platform, [confirm provider name and location], solely to deliver these messages, and your number is passed to a messaging carrier for delivery.

Carriers are not liable for delayed or undelivered messages.

7. Cookies and Tracking Technologies

We use essential cookies (required to browse and order), analytics and personalization cookies, and advertising cookies. You can manage your preferences through our cookie settings tool [link] and through your browser. Disabling certain cookies may affect Site functionality, including the ability to place an order.

We honor Global Privacy Control (GPC) browser signals as a valid request to opt out of the sale or sharing of personal information, where required by law.

Examples of essential cookies used by our platform:

Cookie	Purpose	Duration
_session_id	Stores session information (referrer, landing page, etc.)	Session
_shopify_visit	Records visit counts for internal statistics	30 minutes from last visit
_shopify_uniq	Counts visits by a single customer	Until midnight (visitor's time) the next day
cart	Stores the contents of your cart	2 weeks
_secure_session_id	Secure session token	Session
storefront_digest	Determines access if the shop is password-protected	Indefinite

Analytics and advertising cookies (for example, from Google and Meta) are also used and can be managed through our cookie settings tool.

8. Your U.S. Privacy Rights

Depending on your state of residence (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others), you may have the right to:

• Know and access the personal information we collect about you.
• Delete your personal information.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information and of targeted advertising.
• Limit the use of sensitive personal information, where applicable.
• Non-discrimination for exercising your rights.
• Appeal a decision on your request, in states that provide this right.

To opt out of sale or sharing, use our "Do Not Sell or Share My Personal Information" link [link/method], or send a GPC signal as described above.

9. How to Exercise Your Rights

Submit a request by email to info@muralandco.com or through [webform link]. We may need to verify your identity before responding. An authorized agent may submit a request on your behalf with proof of authorization. We will respond within the time required by applicable law (generally within 45 days, with a possible extension).

10. Data Retention

We keep personal information only as long as necessary for the purposes described in this Policy and to meet our legal, accounting, and tax obligations, after which we delete or anonymize it. [Specify periods, e.g., order records: X years; marketing data: until you opt out.]

11. Data Security

We take reasonable precautions and follow industry best practices to protect your personal information from loss, misuse, unauthorized access, disclosure, alteration, or destruction. Card information is encrypted using SSL technology and stored in line with PCI-DSS requirements. No method of transmission or storage is completely secure.

12. Children's Privacy

The Site is intended for adults aged 18 and over. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Third-Party Links

The Site may contain links to third-party websites. Once you leave the Site, this Policy no longer applies. We are not responsible for the content or privacy practices of other sites and encourage you to review their policies.

14. International Operations

We are based in France. Your personal information may be processed in the United States, the European Union, or other countries where we or our service providers operate, with appropriate safeguards in place. Because we are established in the EU, certain processing may also be subject to EU data protection law.

15. Changes to This Policy

We may update this Policy from time to time. The "last updated" date above reflects the most recent version. Material changes will be communicated through the Site.

16. Contact

GROUPE VLA — Mural & Co 229 rue Saint-Honoré, 75001 Paris, France info@muralandco.com