Skip to Main Content

Privacy Policy

March 1, 2021

This Privacy Policy explains how 40 Boxes Inc. (“40 Boxes”) collects, uses, and shares your personal information (“Personal information” is information that identifies you or that can reasonably be linked to information that identifies you.). This policy applies when you visit any website ( or any, official social media sites, or other online properties where this policy is posted (collectively "Sites"). 40 Boxes recognizes that you care about how your information is used, and your privacy is important to us. This Privacy Policy explains the choices you can make about what information we share. Please read this Privacy Policy carefully.


We ask that you read this Privacy Policy prior to the first time you use the Sites and continue to access and read it from time to time during the period when you continue to use the Sites. 40 Boxes may modify this Privacy Policy at any time in its sole discretion and without advance notice to you. If we make material changes to this Privacy Policy that increase our rights to use personal information that we have previously collected about you, we will notify you either through an email to your registered email address or by prominent posting on the Sites and, where required by law, we will obtain consent from you either through email or the Sites.



We collect information to deliver the products and services you request and to help improve your shopping experience and to help improve our ability and our business partners’ ability to provide services to you. We collect information from you in a variety of ways when you interact with our websites, and mobile services.

We may collect the following categories of personal information. Not all categories may be collected about every individual or in every instance in which an individual uses the Sites:

  • Personal identifiers, such as name and physical address
  • Device and online identifiers and related information, such as telephone numbers and email addresses
  • Internet, application, and network activity, such as cookie IDs, IP address, and browser visits
  • Financial information, such as credit and debit card numbers and claims information
  • Purchase and/or search history information, such as products you have looked at, bought,  and returned 
  • Location information, such as geo-location information
  • Audio, visual, and other sensory information, such as audio and video recordings
  • Individual preferences and characteristics, such as inferences related to shopping patterns and behaviors


We collect information from you in a variety of ways.  It may be:

  • Provided directly by you or a member of your household
  • Collected from information stored on or provided by a device associated with you or your household
  • Collected from an external third-party source

Our goal is to limit the information we collect to the information that we determine is needed to support our business.

Information Provided Directly by You or a Member of Your Household: 40 Boxes collects personal information about you when you interact with our Sites, including when you create an account, join our mailing or text list, make a purchase, or engage in a call, email exchange or online chat with our customer service representatives. The information we may collect includes the categories listed above as well as any other information that  you choose to share with us.

If you make a purchase through our Sites, parties working with us such as a merchant of record and/or our third-party payment processor or other service providers may also collect billing information, such as your first and last name, email address, phone number, credit card or debit card number, and billing and shipping addresses. If you make a purchase over the phone, we will collect this personal information and share it with such parties or  for other purposes described in this Privacy Policy.

Information Collected from a Device Associated with You or Your Household: We Automatically Collect:  We may automatically collect personal information from devices that you use to interact with our Sites, as well as from your interaction with emails that we send to you. The personal information we automatically collect may include your IP address, browser type, device type, the webpage you visited before coming to our Site, pages you visited on our Sites, time spent on those pages, information you searched for on the Sites, when and for how long you visited the Sites, and similar information, which we collect through cookies, beacons, and other technologies. The information we automatically collect will be associated with any personal information that you have provided to us.

We may use this information to provide you location-based advertisements and social media posts. We may also use this personal information for analytics purposes or for other purposes described in this Privacy Policy.

Information Collected from External Third-Party Sources: We receive personal information about you from other sources to help us correct or supplement our records, improve the quality or personalization of our service to you, prevent or detect fraud, and for other business purposes or other purposes described in this Privacy Policy..


40 Boxes may use the personal information it collects about you for a number of purposes, including without limitation:

  • To fulfill your order or requests for services and provide customer service
  • To create and maintain your account
  • To conduct auditing and monitoring of transactions and engagement
  • To conduct marketing and personalization
  • To protect the security and integrity of our Sites including websites and mobile services as well as our business, and help prevent fraud
  • To update our operational and technical functionality
  • To conduct business analysis, such as analytics, projections, identifying areas for operational improvement
  • To conduct research and development
  • To fulfill our legal obligations

If you decide at any time that you no longer wish to receive marketing and promotional materials from us, please follow the unsubscribe instructions provided in any of the communications you receive from us. You may also contact us at to make your request to unsubscribe from further marketing emails from the respective sites.


All of the categories of personal information that we collect will be or have been shared with other companies, including those within our corporate family and/or promotional partners, for a business purpose. We may share your information with Simple 2 Partners, LLC and Tory Johnson Productions, Inc.  for their business purposes as well as any of the business purposes set forth in this Privacy Policy. . 40 Boxes also may share your personal information with service providers who perform services and functions on our behalf to support our interactions with you including, for example, providing our products and services, processing your purchases, administering surveys or contests, or communicating with you.

40 Boxes may share your personal information with other third parties, including law enforcement authorities, where we determine that doing so is appropriate to:

  • enforce our Terms of Service;
  • protect our property, services, and legal rights, and the rights of others;
  • provide maintenance services, database management, and similar site-related services;
  • prevent physical harm to persons or the property of others;
  • prevent fraud or other illegal activity against 40 Boxes and others;
  • support auditing, compliance, and corporate governance functions;
  • comply with subpoenas, court orders, or similar legal processes, including to law enforcement agencies, regulators and courts; or
  • comply with applicable law.

Finally, 40 Boxes may provide your personal information to third parties for these third parties' direct marketing of their products and other business purposes. You may opt out of our continuing to share your information for these purposes by contacting us at

Disney Privacy Policy

In the event that you have elected to Opt In for marketing purposes we may share your personal information with The Walt Disney Company (“Disney”) family of companies, which include American Broadcasting Companies, Inc. (“ABC”), for their business purposes as well as any of the business purposes set forth in this Privacy Policy. In such event, the use of such information (and any other information which you may separately provide) will be subject to their privacy policies in effect from time to time including as may be found at the following URL or at other location(s) or by such other means by which such companies make such information available:

this url

Aggregated, Non-Identifying Information: 40 Boxes may share aggregated or other information that is not individually identifiable (and is not personal information) with third parties including in connection with industry analysis, demographic analysis, targeted ad delivery or other purposes. This may include Disney, ABC or other promotional partners whether or not you have elected to Opt in to provide personal information to such entities for marketing purposes.


We may share your personal information with certain categories of third parties, including as described below.

Types of Third Parties to Which the Personal Information Was Disclosed for a Business Purpose

Categories of Personal Information Disclosed for a Business Purpose

Those we are legally required to share with

  • Audio, visual, and other sensory information
  • Device and online identifiers and related information
  • Financial information
  • Individual preferences and characteristics
  • Internet, application, and network activity
  • Location information
  • Personal identifiers
  • Purchase history information

Service providers that receive data in order to provide services to us (e.g. technology providers, cloud storage providers, etc.)

  • Device and Online Identifiers
  • Internet, application, and network activity
  • Personal identifiers
  • Purchase history information

Our suppliers or marketplace vendors

  • Device and Online Identifiers
  • Internet, application, and network activity
  • Personal identifiers
  • Purchase history information


When you visit our Sites, 40 Boxes may place pieces of code, commonly referred to as "cookies," or similar technology on your devices. 40 Boxes may begin collecting information about you or your activity on devices associated with you through cookies or similar technologies as soon as you visit our Sites. By using our Sites, you permit 40 Boxes to collect and use your personal information from activity on devices associated with you in accordance with this Privacy Policy.  40 Boxes may take such actions based on your acceptance of this Privacy Policy through your use of the Sites.  If you do not agree to permit us to take such actions, do not use the Sites.

40 Boxes may use cookies for a number of purposes: First, we may use persistent cookies to save your login information for future logins to our Sites and to collect and analyze information about your online activity to help us improve our services and to use in accordance with the terms of this Privacy Policy. Second, we may use session ID cookies to enable certain features of the Sites to better understand how you interact with the Sites, and to monitor aggregate use of our Sites by 40 Boxes users. Unlike persistent cookies, session cookies are deleted from your computer when you log off of the Sites and close your browser.  But in both cases, we may collect and store the information provided to us by the cookies.

We also may use "pixel tags," "web beacons," and other technologies on our Sites to collect usage, demographic, and geographic location data, which allow us to count users who have visited certain pages of the Sites, to deliver branded services, and to help determine the effectiveness of promotional or advertising campaigns.

Some internet browsers (e.g. Internet Explorer, Safari, Chrome) offer their own opt outs for interest-based advertising. The ad networks and ad service providers we participate with may not recognize these opt outs. Information about how to opt out of certain online interest-based advertising is discussed in the next section of this policy.


Third parties, including advertisers, may collect information, potentially including personal information, about your activities over time and across different websites when you use the Sites. Those third parties may use cookies, pixel tags, web beacons, mobile application advertising identifiers and other technologies. Those third parties may also provide 40 Boxes with information and reports about data collection, ad response measurement, analytical information, and assist with delivery of relevant marketing messages and advertisements.

Collection of your information by third parties is not governed by this Privacy Policy. Please consult the privacy policies of those third parties to determine how they collect and use your information. Many third-party advertisers and some web browsers and mobile devices allow you to opt out of third-party advertising. Information and resources regarding how to opt out of interest-based advertising are available from the Digital Advertising Alliance at


We may share aggregated or pseudonymous information (pseudonymous information includes things like: device identifier, type of device, IP addresses, cookies and other information associated with your browsing and app usage) with other companies, such as promotional partners, publishers, advertisers, measurement analytics providers, and others. We do not share information that directly identifies you (information such as name or email address) with these companies.

We also allow companies that show advertisements on our webpages or our apps to collect information from your browsers or devices via the use of cookies or other technologies. Other companies' use of cookies and other data collection technologies are subject to their own privacy policies, not this one. Like many companies, we may allow cookie matching with select partners. However, these parties are not authorized to directly access information from our cookies.


You can request that we review, modify, and delete your personal account information by contacting us. If you request that we delete your personal information, your account may become deactivated. If you would like us to modify or delete your account information, please contact us at with a request that we delete your personal information. We will use commercially reasonable efforts to honor your request. We may retain an archived copy of your records as required by law or for legitimate business purposes.


40 Boxes has implemented an information security program that includes administrative, technical and physical controls designed reasonably to safeguard your personal information.


We reserve the right to disclose, sell, or transfer all information related to the Sites, including personal information:

  • to a subsequent owner, co-owner or operator of one or more of the Sites; or
  • in connection with a corporate merger, consolidation, or restructuring; the sale of of stock and/or assets, in whole or in part, or other corporate change, including, without limitation, during the course of any due diligence process.


The Sites to which this Privacy Policy applies are subject to U.S. law, unless otherwise stated in this Privacy Policy. By using the Sites or providing us with your information, you are directly transferring your information to us in the United States. In addition, we may transfer the information that we collect through the Sites to other countries where we do business. These countries may not have the same data protection laws as the country in which you reside. When we transfer personal information we collect about you to other countries, we will protect that information as described in this Privacy Policy, even though a given country may not have the same privacy and data protection laws as the country in which you reside. You agree to and acknowledge our collection, transfer, and processing of your personal information in accordance with this Privacy Policy.


Our Sites are general audience sites not directed at children under the age of 18. If we obtain actual knowledge that any information we collect has been provided by a child under the age of 18, we will promptly delete that information. Children under the age of 18 are not permitted to use the Sites.


California Consumer Privacy Act (“CCPA”):

If you are a California resident, you can make certain requests regarding your personal information. We will fulfill each of these requests to the extent required by law.

  1. You can ask us what personal information we have about you, including a list of categories of your personal information that we have sold and a list of categories of your personal information that we have shared with another company for a business purpose.
  2. You can ask us to delete your personal information.
  3. You can ask that we stop selling your personal information.

More information on each of these requests is below.

  1. What personal information do you collect about me? If you make this request, we will return to you (to the extent required by law):
  2. The categories of personal information we have collected about you.
  3. The categories of sources from which we collect your personal information.
  4. The business or commercial purpose for collecting or selling your personal information.
  5. The categories of third parties with whom we share personal information.
  6. The specific pieces of personal information we have collected about you.
  7. A list of categories of personal information that we have sold, along with the category of any other company we sold it to. Any of the categories of personal information that we collect could be included in a sale to other companies, including those within our corporate family. If we have not sold your personal information, we will inform you of that fact.
  8. A list of categories of personal information that we have disclosed for a business purpose, along with the category of any other company we shared it with.
  9. You can ask us to provide you with this information up to two times in a rolling twelve-month period. When you make this request, the information provided may be limited to personal information we collected about you in the previous 12 months.
  10. Delete My Personal Information: You have the right to ask that we delete your personal information. Once we receive a request, we will delete the personal information (to the extent required by law) we hold about you as of the date of your request from our records and direct any service providers to do the same. In some cases, deletion may be accomplished through de-identification of the information. Choosing to delete your personal information may impact your ability to use our websites and online features, including closure of your online account, and limit your use of functions that require your personal information.
  11. Stop Selling My Personal Information: . If you are a California resident, you have a right to “opt-out” of the “ sale” of your “personal information.” To do so, please email
    Below is a chart showing the types of personal identifiers that we may have sold in the previous 12 months.

Categories of Third Parties to whom the Personal Information may be Sold

Categories of Personal Information Sold

Advertising companies (like ad servers, advertising agencies, technology vendors, providers of sponsored content, and others)

  • Device and Online Identifiers
  • Internet, application, and network activity
  • Personal identifiers
  • Purchase history information

Other entities

  • Audio, visual, and other sensory information
  • Device and online identifiers and related information
  • Financial information
  • Individual preferences and characteristics
  • Internet, application, and network activity
  • Location information
  • Personal identifiers
  • Purchase history information

We will not discriminate against you for exercising your rights. This generally means we will not deny you goods or services, charge different prices or rates, provide a different level of service or quality of goods, or suggest that you might receive a different price or level of quality for goods. Please know, if you ask us to delete or stop selling your data, it may impact your experience with us, and you may not be able to participate in certain programs or membership services which require usage of your personal information to function.

To exercise the California privacy rights for requesting or deleting your personal information, please click “Request for Personal Information” at the bottom of this page.

Verifying Your Identity for Requests to Access or Delete Personal Information

We take the privacy of your personal information seriously and want to ensure that we provide only you or your authorized agent with your personal information. The CCPA also requires that we verify the identity of each person who makes a request to know what personal information we have about you or to delete the personal information we have about you.

What personal information do I provide to verify my identity?

To verify your identity, we ask you to provide your:

First name*
Last name*
Middle initial
Email address*
Phone number

*required field

How do you verify my identity?

We may verify your identity in a few different ways. We may work with a third party identification service to help us verify your identity and prevent fraudulent requests. When you make your request, you will be asked to answer a few questions about yourself to help us validate your identity. If you have an online account, we may ask you to log into your account and complete a one-time passcode validation.

In some instances, we may ask you to provide other documentation to verify your identity. If this happens, we will reach out to you directly with this request.

What if you can’t verify my identity?

If we can’t verify your identity, we will not be able to process your request to know what personal information we have about you or to delete the personal information we have about you. If we are unable to verify your identity with a high degree of certainty, we will only be able to provide a report with category-level information and we may not be able to delete some of your information.

How to Submit a Request Using an Authorized Agent

An authorized agent is a person or business who has authorization to request to know what personal information we have about you, to delete the personal information we have about you, or to opt out of the sale of personal information on behalf of a California resident.  Authorized agents use the same links described above to submit requests. 

If you are submitting a request on behalf of another person, we require a valid power of attorney and a signed attestation form.  If you do not have a valid power of attorney, we require an authorization document and a copy of the consumer’s government-issued photo identification in addition to our attestation form. Our attestation form can be downloaded from the request form.

How do I send you my documentation?

If you submit a request on our website, you will be asked to upload this documentation when you submit your request.  If you submit your request over the phone, you will be asked to email your forms to Please note, you will have 10 business days to provide all required documentation.

Your California Privacy Rights – Shine the Light

If you are a California resident, California law permits you to request information regarding the disclosure of your personal information by 40 Boxes to third parties for the third parties' direct marketing purposes within the immediately preceding calendar year. 40 Boxes will provide you with a list of the categories of personal information disclosed and a list of the names and addresses of the third parties. To make such a request, please write us at:


In the European Union (“EU”), the processing of personal identifiable data is governed by the General Data Protection Regulation 2016/679 (“GDPR”). Under the GDPR, personal identifiable data (“PII”) is defined as: “Any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” We comply with obligations under GDPR by keeping PII up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data or data; by protecting PII from loss, misuse, unauthorized access and disclosure and by ensuring that appropriate technical measures are in place to protect PII. The legal bases for 40 Boxes processing activities include processing such information as necessary to comply with our contractual obligations, compliance with our legal obligations, protecting the safety of our employees, users and others, for our legitimate business interests, and pursuant to your consent. In addition, without limitation of the foregoing, 40 Boxes does not acknowledge the general applicability of the GDPR to its operations because it is not the intention of 40 Boxes to offer goods and services in the EU, to market or sell to persons within the EU, to ship to addresses within the EU or to collect information concerning users known by 40 Boxes to be within the EU.  


Please contact us if you have any questions or comments about our privacy practices or this Privacy Policy. You can reach us at


40 Boxes Inc. (hereinafter, “We,” “Us,” “Our”) is offering a mobile messaging program (the “Program”), which you agree to use and participate in subject to these Mobile Messaging Terms and Conditions and Privacy Policy (the “Agreement”). By opting in to or participating in any of the Program, you accept and agree to these terms and conditions, including, without limitation, your agreement to resolve any disputes with us through binding, individual-only arbitration, as detailed in the “Dispute Resolution” section below. This Agreement is limited to the Program and is not intended to modify other Terms and Conditions or Privacy Policy that may govern the relationship between you and Us in other contexts, and those other Terms and Conditions and Privacy Policies shall also govern the Program, unless this Agreement expressly conflicts with or modifies such other Terms and Conditions and Privacy Policies, in which case this Agreement shall control with respect to the matters which are modified or are in conflict.

User Opt In: The Program allows Users to receive SMS/MMS mobile messages by affirmatively opting into the Program, such as through online or application-based enrollment forms. Regardless of the opt-in method you utilized to join the Program, you agree that this Agreement applies to your participation in the Program. By participating in the Program, you agree to receive autodialed or prerecorded marketing mobile messages at the phone number associated with your opt-in, and you understand that consent is not required to make any purchase from Us. While you consent to receive messages sent using an autodialer, the foregoing shall not be interpreted to suggest or imply that any or all of Our mobile messages are sent using an automatic telephone dialing system (“ATDS” or “autodialer”). Message and data rates may apply.

User Opt Out: If you do not wish to continue participating in the Program or no longer agree to this Agreement, you agree to reply STOP, END, CANCEL, UNSUBSCRIBE, or QUIT to any mobile message from Us in order to opt out of the Program. You may receive an additional mobile message confirming your decision to opt out. You understand and agree that the foregoing options are the only available methods of opting out, and that such methods are reasonable. You also understand and agree that any other method of opting out, including, but not limited to, texting words other than those set forth above or verbally requesting one of our employees to remove you from our list, is not a reasonable means of opting out.

Duty to Notify and Indemnify: If at any time you stop or intend to stop using the mobile telephone number that has been used to subscribe to the Program, including canceling your service plan or selling or transferring the phone number to another party, you agree that you will complete the User Opt Out process set forth above prior to ending your use of the mobile telephone number. You understand and agree that your agreement to do so is a material part of these terms and conditions. You further agree that, if you discontinue the use of your mobile telephone number without notifying Us of such change, you agree that you will be responsible for all costs (including attorneys’ fees) and liabilities incurred by Us, or any party that assists in the delivery of the mobile messages, as a result of claims brought by individual(s) who are later assigned that mobile telephone number. This duty and agreement shall survive any cancellation or termination of your agreement to participate in any of our Programs.


Program Description: Without limiting the scope of the Program, users that opt into the Program can expect to receive messages concerning the marketing and sale of digital and physical products, services, and events.

Cost and Frequency: Message and data rates may apply. The Program involves recurring mobile messages, and additional mobile messages may be sent periodically based on your interaction with Us.  We will provide messages at a frequency determined by us, and if you believe those messages to be provided too frequently, your sole remedy is to complete the User Opt Out process.

Support Instructions: For support regarding the Program, text “HELP” to the number you received messages from or email us at Please note that the use of this email address is not an acceptable method of opting out of the program. Opt outs must be submitted in accordance with the procedures set forth above.

MMS Disclosure: The Program will send SMS TMs (terminating messages) if your mobile device does not support MMS messaging.

Our Disclaimer of Warranty: The Program is offered on an "as-is" basis and may not be available in all areas at all times and may not continue to work in the event of product, software, coverage or other changes made by your wireless carrier. We will not be liable for any delays or failures in the receipt of any mobile messages connected with this Program. Delivery of mobile messages is subject to effective transmission from your wireless service provider/network operator and is outside of Our control. 

Participant Requirements: To participate in the Program, you must have a wireless device of your own, capable of two-way messaging, satisfy the age restrictions described in this Agreement, be using a participating wireless carrier, and be a wireless service subscriber with text messaging service. Not all cellular phone providers carry the necessary service to participate. Check your phone capabilities for specific text messaging instructions.  Ineligible participants are prohibited from using the Program.

Age Restriction: You may not use of engage with the Platform if you are under thirteen (13) years of age. If you use or engage with the Platform and are between the ages of thirteen (13) and eighteen (18) years of age, you must have your parent’s or legal guardian’s permission to do so. By using or engaging with the Platform, you acknowledge and agree that you are not under the age of thirteen (13) years, are between the ages of thirteen (13) and eighteen (18) and have your parent’s or legal guardian’s permission to use or engage with the Platform, or are of adult age in your jurisdiction. By using or engaging with the Platform, you also acknowledge and agree that you are permitted by your jurisdiction’s Applicable Law to use and/or engage with the Platform.

Prohibited Content: You acknowledge and agree to not send any prohibited content over the Platform. Prohibited content includes:

  • Any fraudulent, libelous, defamatory, scandalous, threatening, harassing, or stalking activity;
  • Objectionable content, including profanity, obscenity, lasciviousness, violence, bigotry, hatred, and discrimination on the basis of race, sex, religion, nationality, disability, sexual orientation, or age;
  • Pirated computer programs, viruses, worms, Trojan horses, or other harmful code;
  • Any product, service, or promotion that is unlawful where such product, service, or promotion thereof is received;
  • Any content that implicates and/or references personal health information that is protected by the Health Insurance Portability and Accountability Act (“HIPAA”) or the Health Information Technology for Economic and Clinical Health Act (“HITEC” Act); and
  • Any other content that is prohibited by Applicable Law in the jurisdiction from which the message is sent.

Dispute Resolution: In the event that there is a dispute, claim, or controversy between you and Us, or between you and any other third-party service provider acting on Our behalf to transmit the mobile messages within the scope of the Program (including Stodge, LLC d/b/a Postscript), arising out of or relating to federal or state statutory claims, common law claims, this Agreement, or the breach, termination, enforcement, interpretation or validity thereof, including the determination of the scope or applicability of this agreement to arbitrate, such dispute, claim, or controversy will be, to the fullest extent permitted by law, determined in accordance with the dispute resolutions contained within Terms of Services applicable to the website.

Miscellaneous: You warrant and represent to Us that you have all necessary rights, power, and authority to agree to this Agreement and perform your obligations hereunder, and nothing contained in this Agreement or in the performance of such obligations will place you in breach of any other contract or obligation. The failure of either party to exercise in any respect any right provided for herein will not be deemed a waiver of any further rights hereunder. If any provision of this Agreement is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that this Agreement will otherwise remain in full force and effect and enforceable. Any new features, changes, updates or improvements of the Program shall be subject to this Agreement unless explicitly stated otherwise in writing. We reserve the right to change this Agreement from time to time. Any updates to this Agreement shall be communicated to you. You acknowledge your responsibility to review this Agreement from time to time and to be aware of any such changes. By continuing to participate in the Program after any such changes, you accept this Agreement, as modified.