Privacy policy

Last updated: October 16, 2026

This Privacy Policy explains how Mattress Overstock Co. LLC ("Mattress Overstock," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit mattressoverstock.us, shop with us, contact a showroom, use our AI mattress guide, or otherwise interact with our services.

Contact us

Email: help@mattressoverstock.email
Phone: (859) 710-9265
Mail: Mattress Overstock Co. LLC, 961 Primrose Court, Suite A, Lexington, KY 40511, United States

Personal information we collect

Depending on how you interact with us, we may collect these categories of personal information:

  • Contact and identity information: name, email address, phone number, billing and delivery address, account identifiers, and privacy-request details.
  • Order and commercial information: products viewed, saved, added to cart, purchased, exchanged, or returned; order value; delivery information; warranty or service history; and related communications.
  • Payment information: payment method and transaction details. Shopify and our payment providers process payment-card information. We do not receive or store a complete payment-card number in our storefront systems.
  • Device and network information: IP address, browser and device type, operating system, time zone, cookie and similar identifiers, approximate region derived from IP, and security or fraud signals.
  • Website activity: pages, products, collections, searches, clicks, cart and checkout events, referring page, session timing, and interactions with site features.
  • Advertising and attribution information: gclid, gbraid, wbraid, fbclid, UTM parameters, landing page, referrer, ad-platform identifiers, and call-attribution information.
  • Communications and content: emails, support requests, call details, chat messages, quiz answers, saved picks, and information you choose to provide to our staff or AI mattress guide.
  • Preferences and inferences: mattress size, comfort, firmness, cooling, support, budget, purchase timing, product interests, and recommendations inferred from your answers and activity.
  • Consent and suppression records: the consent language shown, date and time, source form, phone or email authorized, opt-out requests, and records needed to prevent unwanted messages.

Please do not send highly sensitive information, such as Social Security numbers, account passwords, medical records, or full payment-card details, through chat, email, or support forms.

How we collect information

We collect information directly from you, automatically from your browser or device, from Shopify and other service providers, from advertising and analytics platforms, from call and messaging services, and from information our staff records while helping you with a purchase or service request.

How we use personal information

  • Operate the website, customer accounts, carts, checkout, pickup, delivery, exchanges, warranties, and customer service.
  • Answer questions, recommend products, save picks, provide quotes, and connect you with a local team member.
  • Send transactional messages and, when you consent, marketing email or text messages.
  • Measure website use, calls, advertising, lead quality, and store or online purchases.
  • Personalize products, content, and advertising where allowed.
  • Detect fraud, abuse, security threats, and technical errors.
  • Maintain business, tax, warranty, consent, suppression, and legal records.
  • Comply with law, enforce agreements, and protect customers, staff, and the business.

Cookies and similar technologies

We and our providers use cookies, pixels, local storage, server events, and similar technologies. The main categories are:

  • Necessary and security: Shopify storefront, cart, checkout, account, localization, fraud prevention, and hCaptcha controls.
  • Preferences: country, currency, saved settings, and site choices.
  • Analytics: Shopify analytics, Google Analytics, and our first-party visitor timeline used to understand site and checkout activity.
  • Advertising and attribution: Google Ads, Meta, Shopify Audiences or Network Intelligence, and related conversion and remarketing tools.
  • Call attribution: CallRail cookies and number-swapping tools that connect calls with a marketing source.
  • Chat and lead continuity: session and browser storage used to preserve a conversation, recommendations, attribution context, and consent state.

Cookie duration depends on the provider, purpose, and whether the cookie is a session or persistent cookie. Some end when you close the browser. Others remain until they expire, you delete them, or the related account or service record is removed. See Shopify's cookie policy for Shopify-managed cookies.

Where consent or a sale, sharing, or targeted-advertising opt-out is required, non-essential technologies follow the available regional privacy choice. Shopify's Customer Privacy settings control the regions where its cookie banner and data-sharing opt-out page apply. You can also change browser settings, use available cookie preferences, or visit Your Privacy Choices. That page states when its browser-based opt-out is not available for a visitor's location.

Analytics, advertising, sale, and sharing

We do not sell personal information for money. We use analytics and advertising services, and some disclosures of identifiers, commercial information, website activity, approximate location, or inferences to advertising partners may be treated as a "sale," "sharing," or "targeted advertising" under certain U.S. state privacy laws.

Our browser controls are regional. In U.S. states configured in our Shopify Customer Privacy settings for data-sale opt-outs, Your Privacy Choices and a recognized Global Privacy Control signal are treated as an opt-out of sale, sharing, and targeted advertising for the browser or device. Outside those configured regions, the form can state that the browser-based opt-out is not applicable. You may still contact us to request review of any privacy right that might apply.

Shopify, Meta, Google, and other providers can also apply their own privacy controls. A provider may restrict its processing when it receives a browser privacy signal even when our regional form is not active. A standard "Do Not Track" signal is different from Global Privacy Control and is not consistently defined across browsers.

When a choice concerns sale, sharing, or targeted advertising rather than analytics, we may continue analytics that is allowed by law and the visitor's other choices.

You may also manage ad settings directly with Google and Meta.

How we disclose personal information

We disclose personal information only for the purposes described in this policy. Recipient categories include:

  • Commerce and hosting: Shopify, Shopify Network Intelligence or Enhanced Services when enabled, and providers that host or support our website and custom services.
  • Payment, financing, fulfillment, and service: payment processors, financing providers you choose, delivery carriers, manufacturers, warranty partners, and providers needed to complete your request.
  • Analytics and advertising: Google; Meta through Shopify's Facebook & Instagram channel; Shopify Audiences; and providers used to measure, attribute, personalize, and improve marketing.
  • Calls and messaging: CallRail, Quo, telecommunications carriers, and vendors that route calls, texts, and staff alerts.
  • AI and chat processing: our Railway-hosted chat service and the AI provider used to answer questions, search the live catalog, prepare recommendations, and create staff follow-up context. The current AI routing provider is OpenRouter.
  • Security and fraud: Shopify, hCaptcha, and other providers that detect abuse or protect accounts and transactions.
  • Professional and legal: accountants, insurers, auditors, legal advisers, regulators, law enforcement, or parties to a business transaction when permitted by law.

We do not share mobile opt-in consent or mobile numbers with third parties for their own marketing.

Shopify

Shopify powers our online store and processes customer information for commerce, security, analytics, personalization, and services we enable. When Shopify Network Intelligence is enabled, Shopify may use activity from this store with information from Shopify and other merchants to provide Enhanced Services. These services can help personalize experiences and products, show more relevant ads, improve performance and security, and help us understand interactions with our store and ads. Store activity can be shared with Shopify and service providers in the United States or other countries for these purposes. Shopify states that other merchants cannot view our customer data.

Review the Shopify Consumer Privacy Policy and Shopify Privacy Portal for information about Shopify's processing and direct privacy controls.

Meta and Google advertising tools

Our Shopify Facebook & Instagram channel uses the Meta Pixel, advanced matching, and Conversions API when allowed by Shopify's privacy settings. Meta can receive device and browser identifiers, pages or products viewed, cart, checkout, purchase, and attribution events, and supported contact fields in hashed form. Meta uses this information for matching, measurement, reporting, and advertising. You can use Meta Ad Preferences and Meta's Off-Facebook Activity controls.

Google can receive the email address and phone number that you enter in our chat, sleep quiz or "Text me" forms, and the contact details of an in-store purchase, in hashed form. Google uses this data to match and measure ad conversions. If you submit a lead form inside a Google ad, Google sends us the name, phone number and email address you entered so our showroom team can call you back.

When you enter an email address or phone number at checkout, our first-party visitor timeline keeps only a keyed, coded (hashed) version of it, which we use to connect an online visit to a later in-store purchase for ad measurement.

Our Google tags use regional consent rules. In a region configured for sale or sharing opt-outs, a recognized Global Privacy Control signal or submitted opt-out denies Google advertising storage, ad-user data, and ad personalization for that browser. Outside those configured regions, custom Google advertising technologies may remain enabled unless another applicable marketing choice requires a different result. Analytics can remain enabled where permitted.

AI mattress guide, text messaging, and website chat

Our site identifies the assistant as an AI mattress guide. When you use it, we may collect and retain your chat messages, quiz answers, page context, recommendations, products shown, conversation identifier, contact information you submit, attribution identifiers, and related service events. We use this information to answer questions, recommend products, preserve the conversation, provide requested follow-up, improve service, prevent abuse, and measure marketing.

If you provide a mobile number and check the consent box, you authorize recurring automated marketing and cart or quote-reminder text messages from Mattress Overstock at that number. This includes the "Text me" buttons on our product and showroom pages, which send the bed and price, a delivery quote reply, or showroom directions that you request. Consent is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. You may also contact us using the information above.

Retention

We keep personal information only for as long as reasonably necessary for the purpose collected, our relationship with you, and legal or operational needs. We use these criteria:

  • Order, payment, delivery, tax, warranty, and dispute records are kept for the period needed to complete the transaction and meet tax, accounting, warranty, fraud, and legal duties.
  • Chat, lead, support, and call-attribution records are kept while needed to provide service, follow up, prevent duplicate outreach, measure outcomes, resolve disputes, and improve the system.
  • Analytics and advertising identifiers follow our settings and the retention controls of the relevant provider.
  • Consent, opt-out, suppression, and privacy-request records may be kept longer when needed to prove consent, honor an opt-out, or comply with law.

When information is no longer needed, we delete, deidentify, or securely isolate it, subject to backups and legal exceptions.

Your privacy rights and choices

Depending on where you live and which law applies, you may have rights to access, correct, delete, or receive a copy of personal information; opt out of targeted advertising, sale, sharing, or certain profiling; limit certain uses of sensitive information; and appeal a denied request.

  • Use Your Privacy Choices for browser and optional account-level sale, sharing, and targeted-advertising opt-outs where available. If the page says the browser option is not applicable in your location, you can still contact us for review.
  • Email help@mattressoverstock.email with the subject "Privacy Request" for access, correction, deletion, portability, or another privacy request.
  • Email the same address with the subject "Privacy Appeal" if you want us to review a denied request.

We may need to verify your identity or authority before completing a request. You may use an authorized agent where applicable. We will not discriminate against you for exercising an applicable privacy right.

For more state-specific information, see our U.S. State Privacy Notice.

Security

We use administrative, technical, and physical safeguards designed for the nature and volume of the information we handle. No Internet transmission or storage method is completely secure, so we cannot promise absolute security.

Children

The site is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child provided personal information, contact us so we can review and delete it where required.

International visitors

Mattress Overstock operates in the United States and does not currently service the European Union. Information may be processed in the United States and other places where our providers operate.

Changes to this policy

We may update this policy when our practices, services, or legal duties change. The date at the top shows the latest revision.