Privacy Policy

Cost Plus Vision Group · United States

Updated October 11, 2026.

This policy explains how Cost Plus Vision Group (“Cost Plus”, “we”, “our”) handles personal information on the U.S. Cost Plus website, where prices are shown in U.S. dollars (USD). We sell contact lenses, glasses and sunglasses. Online checkout is not yet enabled on the U.S. site; the parts of this policy about orders and payments apply once an ordering service is available to you. We do not sell personal information or share it for targeted advertising.

Who this covers

People in the United States who browse the U.S. site, chat with our shopping guide, use our measuring tools, create an account or ask about Group Plans, and customers who place an order once ordering is available.

What we collect

• Identifiers and account details: your name and email when you create an account or sign in.
• Order details, when ordering is available: products, box counts, shipping address, shipping choice, notes you add and order status. For glasses, the prescription values and measurements (such as PD and segment height) you enter so your lenses can be made. For contact lenses, the prescription and prescriber details federal law requires to verify your prescription.
• Payment, when available: card payments are handled by our payment processor, Stripe. We receive the payment status and the name, email and address you give at checkout. We never see or store your full card number.
• Group Plans briefing requests: organization, contact name, work email and your message.
• Internet and device information: IP address (which shows your approximate location), device and browser type, pages viewed and anonymous usage events tagged with the U.S. market. These events never contain your name, email or prescription.

Photos, chat and AI

Chat messages are sent to a third-party AI provider to write replies. When you choose to scan Contacts packaging, a frame or a glasses prescription, the photo is sent to our server and that AI provider to read product names or prescription numbers. We ask the provider not to store the results, but its own retention policies may still apply, so cover names, addresses, dates of birth, insurance numbers and prescriber details before you scan.

We do not save scan photos. Scan results are only a starting point: check every value against your prescription. The PD and segment-height tools measure your photo inside your browser, and that photo is not uploaded. Style Studio uses preferences you choose, not face analysis or biometric identifiers.

Annual administrative fee profiles and consumer health data

If you join annual administrative fee, we keep a member profile linked to your verified sign-in: your annual administrative fee market, paid-through date, renewal and cancellation status, payment method type and any group code you used. Stripe processes annual administrative fee payments; we never see your full card or bank account number.

A saved prescription is consumer health data. While your annual administrative fee year is paid, you may choose to save one glasses and one Contacts prescription to your own profile. We collect it only with that choice, encrypt it on our server, use it only to fill your own orders during a paid year, and do not sell it or share it with other group customers. Expired prescriptions are not reused, staff still review every order, and saved prescriptions are not stored in your browser. You can ask us to access or delete your member profile through the contact form.

What we do not collect on purpose

• We do not read your other health apps.
• We do not buy marketing lists.
• We do not ask for more health information than your order needs.

Why we use it

• To show products and prices.
• To process, fulfill and support your orders once ordering is available.
• To verify prescriptions as the FTC Contact Lens Rule and Eyeglass Rule require.
• To respond to Group Plans requests.
• To keep the site secure, prevent fraud and meet our legal obligations.
• To understand which pages and features are used, without identifying you.

Who sees your information

Authorized Cost Plus staff; the eye-care professional or lab that fills your order; your prescriber, when we verify a prescription; shipping carriers; and service providers that host the site, handle sign-in, process payments, send email and run AI features. Service providers may use your information only to provide their service to us. We may also disclose information when the law requires it. We do not sell personal information, share it for cross-context behavioral advertising, or rent it.

Health information

Prescription values and other eye-health details are sensitive. We use them only to provide what you ask for, never for advertising, and we never sell them. Cost Plus is not a health-care provider or health plan, so HIPAA may not apply to information you give us directly, but we protect it as health information.

Where state consumer health data laws apply, such as Washington’s My Health My Data Act and Nevada’s consumer health data law, we collect and share consumer health data only with your consent or as necessary to provide the product or service you request. You can ask to see which third parties received it, withdraw your consent and ask us to delete it.

How long we keep it

Order and prescription records, including prescription verification records, are kept for as long as federal and state law require, often at least three years. Technical logs are kept for a shorter time unless we need them for security or a dispute. When we no longer need information, we delete or de-identify it.

Your state privacy rights

Depending on where you live, including California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with consumer privacy laws, you may have the right to know what personal information we collect and how we use it, to access it, correct it, delete it and receive a portable copy, and to opt out of its sale, its sharing for targeted advertising and profiling. We do not sell personal information, share it for targeted advertising or use it for profiling that produces legal or similarly significant effects.

To make a request, use our contact form. You may use an authorized agent. We will verify your request and respond within 45 days. If we decline your request, you can appeal by replying to our decision, and if the appeal is denied you can contact your state attorney general. We will not discriminate against you for using your rights.

California notice

In the past 12 months we collected these categories of personal information: identifiers, customer records, commercial information (products and orders), sensitive personal information (prescription details, used only to provide the service), internet activity and approximate location. We collect it from you, your device and our service providers, and disclose it only to service providers for the business purposes described above. We have not sold or shared personal information, including that of consumers under 16.

Cookies and browser storage

We use browser storage for your language, your market and the products in your cart (catalog details only), and cookies needed for sign-in and checkout. We do not use advertising or cross-site tracking cookies. Clearing browser storage does not cancel an order.

Children

The site is not directed to children under 13, and we do not knowingly collect personal information from them. A parent or guardian should place any order for a child. If you believe a child under 13 has given us personal information, use our contact form and we will delete it.

Text messages and email

We do not currently send text messages. If we offer order alerts by text in the future, we will ask for your separate, express consent first and explain message frequency, possible message and data rates, and how to reply HELP or STOP. We will not sell or share text-message opt-in data with third parties. We do not send promotional email or text messages.

Security

We use encrypted connections, access controls and protected sign-in. No system is perfectly secure. If a breach affects your personal information, we will notify you as state law requires.

Contact and changes

Questions or requests: use our contact form.

This page describes our practices and is not legal advice. If we change it, we will post the update here with a new date.

Temporary Contacts cart drafts

When you confirm or edit a Contacts cart prescription, we save it in an encrypted private server draft so you can return to your cart from Stripe or after reloading. A private browser-owner cookie limits recovery to the same browser session on this site, without sign-in. Prescription values are never put in browser storage, URLs, analytics or Stripe. The draft is inaccessible 24 hours after your last confirmed prescription or cart-line edit; reading it or returning from payment does not extend that time. Removing a line or clearing the cart deletes its draft data; confirmed payment clears purchased draft lines.

Automated cleanup removes expired drafts from the active database. Deletion is not an assurance of immediate physical erasure from backups or infrastructure copies, which follow separate operational retention schedules. Submitted orders, including potentially payable orders, are separate from these drafts.

Completed-order prescription, verification and fulfillment records are retained separately under applicable U.S. federal and state requirements, including the FTC Contact Lens Rule; the 24-hour draft limit does not apply to those records.

Website diagnostics (proposed — pending legal review)

Proposed addition for legal review; not yet approved. With your permission — or, where the law allows, unless you opt out under "Privacy choices" in the footer — we would use PostHog, a diagnostics service, to collect sanitized error reports and fully masked recordings of public pages so we can find and fix website bugs. Recordings hide all text and everything you type, and are never made on checkout, payment, prescription, account, sign-in or portal pages.

These diagnostics would never include your name, email, address, prescription values or card numbers, and your browser’s Do Not Track or Global Privacy Control setting would always be honored. You could withdraw at any time under "Privacy choices" in the footer, which stops collection and clears the diagnostics identifiers stored in your browser.