CPAPNEA Medical ("we", "us") runs optipillows.com. This page says what information we collect when you visit the site or buy from us, why, how long we keep it, and what you can ask us to do with it. If anything is unclear, email support@optipillows.com.
Who we are
CPAPNEA Medical, 10443 N Cave Creek Rd, Phoenix, AZ 85020. Phone 602-944-0847. Email support@optipillows.com. We are responsible for the information described here (the "controller").
What we collect
- When you order: your name, email address, shipping and billing address, phone number if you give one, what you bought and the order total. Your card or PayPal details go straight to PayPal — we never see or store full card numbers.
- When you contact us: your name, email address and message, plus the internet address (IP) the message came from, which we keep so we can block abuse.
- When you visit: our servers log each request (page, time, IP address, browser type) for security and to fix problems. If you accept analytics cookies, Google Analytics also records which pages you view and roughly where you are (city level) — never your name.
We do not collect health information and we do not ask for it. Buying a mask needs no prescription and no medical details.
Why we are allowed to use it
- To fulfil your order and answer your messages — necessary to do what you asked us to do (a contract, in legal terms).
- To keep the site safe and working — our legitimate interest, balanced against yours.
- To count visits with analytics — only with your consent, which you can withdraw at any time from "Cookie settings" in the footer.
- To keep tax and accounting records — a legal obligation.
We do not sell your personal information, we do not share it for advertising, and we do not use it for targeted advertising or profiling.
Who helps us
A few companies process information on our behalf. Each is bound to use it only for the purpose listed.
- PayPal — takes your payment. PayPal's own privacy statement covers what it collects when you pay.
- Cloudflare Turnstile — checks that a form was sent by a person, not a bot, before we accept it.
- Google Analytics — counts page views and purchases, only after you accept cookies. We have turned off Google's advertising features and Google does not store your full IP address.
- YouTube — plays our instruction videos. We use YouTube's privacy-enhanced player, and nothing loads from YouTube until you press play.
- GoDaddy and its Sucuri firewall — host the website, deliver our email, and block attacks before they reach us. The firewall sees the same request logs our server does.
- d1git — the agency that built and maintains the site. Its staff can see the information above while doing maintenance, and its mail server relays our order emails.
- Shipping carriers (USPS and, for international orders, their partners) — receive your name and address to deliver the package.
We may also disclose information if the law requires it, or to protect the rights and safety of our customers or ourselves.
How long we keep it
- Orders: as long as we need them for tax, accounting, warranty and returns — typically seven years.
- Contact messages: 24 months, then deleted automatically.
- Analytics: Google keeps visit data for up to 14 months.
- Server logs: our hosting provider keeps them for security and troubleshooting; the store's own application log is kept for up to 12 months.
Cookies
Cookies are small text files a website stores in your browser. Here is every one we use, plus one item of similar browser storage:
- optipillows-session — keeps your cart and your place on the site while you browse. Lasts 2 hours. Essential.
- XSRF-TOKEN — protects our forms from being submitted by other websites. Lasts 2 hours. Essential.
- op_consent — remembers whether you accepted or declined analytics cookies. Lasts 12 months. Essential.
- _ga and _ga_… — Google Analytics, set only if you accept. They tell Google that later visits come from the same browser. Last 2 years. Not essential.
- theme (browser local storage, not a cookie) — remembers whether you chose the light or dark look. Stays until you clear your browser data. Essential to keep your choice.
On the checkout page, PayPal's payment form sets PayPal's own cookies to process and protect your payment; PayPal's privacy statement covers those. Once you press play on a video, YouTube may set its own cookies.
To change your analytics choice, use Cookie settings in the footer of any page. You can also delete cookies at any time in your browser; the site keeps working without the analytics ones. If your browser sends a Global Privacy Control signal, we treat it as "decline" unless you have already accepted.
Your rights
Wherever you live, you can ask us what information we hold about you, ask us to correct it, or ask us to delete it (we keep what the law makes us keep, such as tax records, and will tell you so). Email support@optipillows.com. We reply within 30 days, and may ask you to confirm you are who you say you are before we share anything.
If you are in the UK or the European Economic Area you also have the right to restrict or object to how we use your information, to receive a copy in a portable format, to withdraw consent at any time, and to complain to your data protection authority.
If you are in California you have the right to know what we collect and why, to delete it, to correct it, and to opt out of "sale" or "sharing" — which we do not do. We will never treat you differently for using your rights.
Where your information is processed
We are in the United States and process information here. If you order from outside the US, your details travel to the US so we can fulfil your order.
Children
The site is not directed at children under 16 and we do not knowingly collect information from them. If you believe a child has given us information, email us and we will delete it.
Changes
When this page changes we update the date below.
Last updated 17 September 2026.