Privacy Policy

Effective Date: May 22, 2026

Last Updated: May 22, 2026

1. Who We Are

Stand Firm is a media, community, and apparel brand for men pursuing sobriety.

Stand Firm is currently operated as a sole proprietorship by John Chelf, doing business under the registered Florida fictitious name "Stand Firm," based in St. Petersburg, Florida, United States.

[LLC MIGRATION PLACEHOLDER] — Stand Firm intends to convert to a limited liability company upon reaching certain milestones. When that conversion is complete, this section will be updated to read: "Stand Firm is operated by [LLC NAME WHEN MIGRATED], a Florida limited liability company," and references throughout this policy to the sole proprietorship and to John Chelf in his individual capacity will be replaced accordingly.

For the purposes of this Privacy Policy, "Stand Firm," "we," "us," and "our" refer to the business described above. "You" and "your" refer to any person who visits our websites, subscribes to our communications, purchases our products, or otherwise interacts with us.

Data controller: John Chelf, operating as Stand Firm.
Contact for privacy matters: john@wearestandfirm.com
Postal address: Available on request — email john@wearestandfirm.com

2. Scope of This Policy

This Privacy Policy applies to personal data we collect through:

• Our primary website, wearestandfirm.com;
• Our newsletter at newsletter.wearestandfirm.com;
• Email signup forms hosted or powered by our third-party providers;
• Our future online store and checkout (when commerce launches); and
• Direct communications between you and us (for example, email).

This policy does not apply to third-party websites or services that we link to but do not control. See Section 7.

3. Personal Data We Collect

We collect only the data we need to run a media, community, and apparel brand. Depending on how you interact with us, this may include:

We do not intentionally collect special categories of data (such as health information). We recognize that subscribing to a sobriety-focused brand may, by inference, suggest something personal about you. We treat your subscription and engagement data with that sensitivity in mind and do not sell it. See Section 12.

4. How We Collect Your Data

We collect personal data in the following ways:

• Directly from you — when you enter your email or name into a signup form, subscribe to the newsletter, place an order, or contact us.
• Automatically — when you open our emails, click links, or visit our website, our service providers may collect technical and usage data through cookies, pixels, and similar technologies.
• From our service providers — our email and (future) commerce platforms provide us with engagement and order data generated through your use of their services on our behalf.

5. Why We Collect Your Data and Our Legal Bases

Where the GDPR or similar laws apply to you, we rely on the following legal bases for processing your personal data:

Where we rely on legitimate interests, we balance those interests against your rights and freedoms, and you may object as described in Section 10.

6. How We Use Your Data

Newsletter subscription. When you submit your email address anywhere on our site — including the band reservation form, the Journal signup, or (when available) at checkout — you are also subscribing to our email newsletter, Still Standing, and we may add your email to our newsletter platform to send it to you. You can unsubscribe at any time using the link at the bottom of any email.

We use your personal data to:

• Deliver our newsletter and other communications you have asked to receive;
• Personalize and improve the content we send and publish;
• Process, fulfill, and support your orders when our store launches;
• Communicate with you, including responding to questions and requests;
• Measure engagement (such as opens and clicks) and understand how our content performs;
• Operate, secure, and improve our websites and services; and
• Comply with our legal, tax, and accounting obligations.

We do not use your data to make decisions that produce legal or similarly significant effects about you through solely automated means.

7. Who We Share Your Data With

We do not sell your personal data. We share it only with the categories of recipients below, and only as needed.

Service providers (processors) who handle data on our behalf:

• Klaviyo, Inc. — email signup forms and email marketing for the website; stores contact and engagement data.
• beehiiv, Inc. — newsletter delivery and analytics; stores contact and engagement data.
• Google LLC (Google Workspace) — business email and productivity; may process communications you send us.
• Cloudflare, Inc. — website hosting, content delivery, and security; may process technical data such as IP addresses.
• Shopify Inc. (when commerce launches) — online store and order management.
• Stripe, Inc. (when commerce launches) — payment processing; Stripe handles your payment card data directly under its own privacy policy.
• Analytics providers (if/when enabled) — for example [ANALYTICS PROVIDER — e.g., Google Analytics] and/or [ADVERTISING PIXEL — e.g., Meta Pixel], as described in Section 15.

Each processor is bound by its agreement with us to process personal data only on our instructions and to protect it.

Other recipients:

• Legal and safety disclosures — we may disclose personal data when we believe in good faith that it is required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of Stand Firm, our subscribers, or others.
• Business transfers — if Stand Firm is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.

8. International Data Transfers

Stand Firm operates in the United States, and our service providers may store and process data in the United States and other countries. If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data may be transferred to, and processed in, countries that may not provide the same level of data protection as your home country.

When we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, as incorporated into our agreements with our service providers. You may request a copy of the relevant safeguards by contacting us at john@wearestandfirm.com.

9. How Long We Keep Your Data

We keep personal data only as long as we need it for the purposes described in this policy:

• Subscriber and contact data: for as long as you remain an active subscriber, and for up to 30 days after you unsubscribe or request deletion, to process and confirm the removal (after which it is deleted or anonymized, except as required below).
• Purchase and transaction records (when commerce launches): for 7 years to meet tax and accounting requirements.
• Communications: for as long as needed to handle your request and a reasonable period afterward for our records.

We may retain limited data longer where required by law, to resolve disputes, or to enforce our agreements.

10. Your Rights Under GDPR

If you are in the EEA, UK, or Switzerland, you have the following rights regarding your personal data:

• Right of access — to obtain confirmation of whether we process your data and a copy of it.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure ("right to be forgotten") — to have your data deleted in certain circumstances.
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Right to restrict processing — to limit how we use your data in certain circumstances.
• Right to object — to object to processing based on legitimate interests, and to object to direct marketing at any time.
• Right to withdraw consent — where we rely on consent, you may withdraw it at any time without affecting processing already carried out.

You also have the right to lodge a complaint with your local data protection authority. We would, however, appreciate the chance to address your concerns first — please contact us at john@wearestandfirm.com.

11. Your Rights Under CCPA/CPRA (California Residents)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you the following rights:

• Right to know — what personal information we collect, the sources, the purposes, and the categories of recipients.
• Right to delete — to request deletion of personal information we have collected from you, subject to legal exceptions.
• Right to correct — to request correction of inaccurate personal information.
• Right to opt out of sale or sharing — although we do not sell or share your personal information as those terms are defined under the CCPA/CPRA.
• Right to limit use of sensitive personal information — we do not use or disclose sensitive personal information for purposes that would require offering this right.
• Right to non-discrimination — we will not discriminate against you for exercising any of your rights.

We do not offer financial incentives or price/service differences in exchange for the retention or sale of personal information.

You may exercise these rights as described in Section 17. You may use an authorized agent to submit a request on your behalf; we may require verification of your identity and the agent's authority.

Categories of personal information collected in the past 12 months: identifiers (such as name, email, IP address); internet or other electronic network activity (such as email engagement); and, when commerce launches, commercial information (such as purchase history). We collect this information for the business purposes described in Section 6.

12. Do Not Sell or Share / Global Privacy Control

Stand Firm does not sell your personal information, and does not share it for cross-context behavioral advertising, as those terms are defined under California law.

If we ever introduce practices that would constitute a "sale" or "share," we will update this policy and provide a clear "Do Not Sell or Share My Personal Information" mechanism beforehand.

We honor Global Privacy Control (GPC) and similar browser-based opt-out preference signals. When we detect a GPC signal from your browser, we treat it as a valid request to opt out of any sale or sharing for that browser and device.

13. "Shine the Light" (California)

California's "Shine the Light" law (Cal. Civ. Code § 1798.83) permits California residents to request information about our disclosure of personal information to third parties for those third parties' own direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes. You may confirm this by contacting us at john@wearestandfirm.com.

14. Children's Privacy

Stand Firm is intended for adults — specifically, men 18 years of age and older. Our content, community, and products are not directed to children, and we do not knowingly collect personal information from anyone under 18.

We comply with the Children's Online Privacy Protection Act (COPPA). If you believe a person under 18 has provided us with personal information, please contact us at john@wearestandfirm.com and we will delete it.

15. Cookies and Tracking Technologies

We use cookies and similar technologies to operate our website and, where enabled, to understand engagement.

• Essential cookies are necessary for the site to function (for example, security and load balancing provided by Cloudflare). These do not require consent.
• Analytics and advertising cookies — if and when we enable tools such as [ANALYTICS PROVIDER — e.g., Google Analytics] or [ADVERTISING PIXEL — e.g., Meta Pixel], we will use a consent banner to obtain consent where required before non-essential cookies are set.

Our emails may also contain pixels that tell us whether an email was opened and which links were clicked.

You can control cookies through your browser settings and, where offered, through our cookie banner. For full details, see our Cookie Policy at [COOKIE POLICY LINK — PLACEHOLDER].

16. How We Protect Your Data

We take reasonable and appropriate measures to protect your personal data, including:

• Encryption in transit (HTTPS/TLS) across our website and forms;
• Vetting our service providers and relying on their security and data-protection commitments;
• Two-factor authentication (2FA) on administrative accounts where available; and
• Limiting access to personal data to those who need it to operate Stand Firm.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. We continue to review and improve our safeguards as we grow.

17. How to Exercise Your Rights

To exercise any of the rights described in this policy:

• Email us at john@wearestandfirm.com with your request, or
• Use the unsubscribe link at the bottom of any email to stop receiving communications.

We will respond to verifiable requests within 30 days. If we need more time (for example, due to the complexity or number of requests), we will let you know within that period. We may need to verify your identity before acting on a request, and we will only use information you provide for verification to process the request.

18. Data Breach Notification

If we become aware of a data breach that affects your personal data and is likely to result in a risk to your rights and freedoms, we will notify you and any applicable regulator without undue delay and consistent with applicable law (for example, within 72 hours of becoming aware of the breach where the GDPR applies). Our notice will describe, to the extent known, what happened, the data involved, and the steps we are taking.

19. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date above and, for material changes, provide a more prominent notice (such as an email or a banner on our site).

Your continued use of our websites or services after an update takes effect means you accept the updated policy. We encourage you to review this page periodically.

20. Governing Law

This Privacy Policy and any dispute relating to it are governed by the laws of the State of Florida, United States, without regard to its conflict-of-laws principles, except where mandatory data-protection laws of your country of residence apply.

21. Contact Us

Questions, requests, or concerns about your privacy?

Stand Firm (operated by John Chelf)
Email: john@wearestandfirm.com
Mailing address available on request — email john@wearestandfirm.com