Artfire Privacy Breach

**Not GlitterSniffer Cosmetics related.**
If you have shopped on Artfire you may want to read this.

On Friday night there was a glitch on Artfire that prepopulated the wrong information at checkout. The information that populated was name, address and email address, but the information was not for the customer chacking out. Instead it was for an entirely different customer. The blog linked above tells of one Artfire users experience and Artfire and Artfire Artisans reactions to the breach.

Artfire has stated that no financial information was released, that the issue appears to be resolved, and that they will be contacting affected customers via email in the coming days. The rough estimate of affected customers sits at 100 at this time. Artfire may be contacted via email.

I am working on a follow up post regarding the situation, including other affected customers/shops, complaints filed with the FTC,  and further information regarding privacy, which I hope to have vetted and posted on Monday.

You've Got Glittermail...And Another Customers Address

I posted recently about the store credit packages for GlitterSniffer Cosmetics. There have been some new developments with the glittermail that has been received.

In at least three cases those that received store credit packages got packages that had postage due. One of the customers who received one of these packages noticed that there appeared to be two labels on her package, one on top of the other. After removing the top label she found another label with a different customer name and address. Two other packages also had the same issue, though one was peeled back to reveal the customers own address on the second label.

The double labels could explain the postage due as it appears the label was paid and printed out for one customer, but then covered with another name and address and shipped. It is speculation at this point as to why this occurred, but it does, once again, put customer information into hands in which it does not belong. Below are pictures of two of the double labels, edited to remove personally identifying information. I am leaving in a portion of the zip code or the first letter of the city name so that it is clear these are indeed two different customer addresses.

For the first package the only issue was the postage due. The products arrived as discussed.

The second package was posted in the initial post about the store credit packages and had numerous issues aside from the double labels, including a melted soap and two of the same pigment that had striking variances in color.

You'll recall that less than a month ago GS posted pictures with customers names and addresses clearly visible on their Facebook Fan Page for a period of approximately 12 hours, an issue the company has refused to acknowledge, other than to remove the photo after a post to this blog. I previously contacted the FTC regarding other privacy issues as well. The company has now shown repeatedly that they release customer information without thought or care of repercussion or even alerting their customers that their personally identifying information has been released. While this latest privacy issue may have been a simple oversight or a case of bad judgment it gives pause to the notion that GS is doing everything in their power to do things correctly.

GlitterSniffer Cosmetics: Readying Packages and Releasing Customer Information

I apologize that I have been out of pocket. I have much to post and am going to condense it all into one post to streamline, outlining the happenings of the past week or so. I appreciate your understanding.

GlitterSniffer Cosmetics is working double time in order to gear up to open and begin sales.

Posted yesterday was a link to the new website as well as a Shop tab added to the Facebook Page.

On 7/22/11 GlitterSniffer Cosmetics posted a variety of pictures showing packages ready to be shipped out for those that requested store credit in lieu of a refund. There are no discernible ingredients labels in any of the photos. This is not to say they aren't being included elsewhere in the package to meet regulations, however. Once the packages begin going out will we know for certain.

What is troubling is that in at least one of these photos customer information, including name and address, is clearly visible for anyone to see. When conversing via email with Lela regarding FTC regulations on customer privacy during the exchange of refund information (for which I directed her to the FTC themselves) she stated in no uncertain terms she would be calling them to ensure she was meeting their guidelines. Though I don't claim to be an expert regarding FTC regulations it is doubtful that posting customers name and address on the internet meets those guidelines. (Picture has been edited to remove personally identifying information though I have the original intact).

Inadvertent though this may be it still constitutes an major issue for GS, namely that the focus on following all guidelines is not what it needs to be at this point.

Also this week on the GS Fan Page (which is *still* moderating comments) a post went up regarding Scentsy, with a link to purchase to help fund GS reopening. Lela stated she would not be receiving the funds but that supplies would be being purchased for GS, presumably with the profits the Scentsy seller is making from the purchases. Currently there is only one person who publicly announced a purchase, an (as of July 18, 2011) "associate" of GS who has been assisting in getting the company up and running.

It is not clear how being an "associate" of GlitterSniffer Cosmetics works, if it is a paid postion or not, but she was welcomed to the team, though currently there are only two employees publicly listed for GS besides Lela Warren, Brandy Cameron and Katherine Huhl-Herndon.

A new Private GS group was created ostensibly for the fans to post without being "harassed via messages". While there were instances in the past of others contacting fans via PM on Facebook in an effort to educate them on the past issues it should be noted that I have never done so myself. I was, however, contacted on July 18, 2011 on my own private Facebook profile via PM by a GS associate regarding matters related to GS, despite the email address for all things GlitterSniffer Cosmetics related being publicly available on the Complaints Facebook Page. I have yet to respond to the message but encourage the person to contact me via email to discuss the matter. I will again reiterate publicly that any owner, employees, affiliates, associates, or family members of GlitterSniffer Cosmetics or Lela Warren should contact me via that email address only.

 

 It has been my policy in the past not to post any information I received from the previous GS Private Group. The group as it was was run by fans for fans and although Lela was an Admin and a member it felt very invasive to me to post from that group. As it now stands the new Private Group was created by Lela herself and she is the sole Admin (even encouraging people to add her personal profile to be added to the group and despite her assertion she would not be running it). Therefore I have changed my stance on posting anything as it pertains to the Private Group as this is yet another extension of the GlitterSniffer Cosmetics business. Posting of information from the new GS Private Group is in line  with GS' new policy of openness with any information regarding their business practices.

And what of those business practices that brought GS to this point? As posted previously Lela has had issues separating business from personal, and actually lost her original Facebook account due to advertising (the second and third Facebook accounts are TOS violations). She admitted that keeping up with so many different forms of communication caused issues and repeatedly asked people not to contact her regarding GS on her personal profile (after telling them to add her to do so). Why then is Lela encouraging people to add or message her through her personal Facebook?

 

It also seems premature to be entertaining the idea of offering store credit/discounts as prizes, offering possible discounts to those inquiring about ordering, or sponsoring contests, especially when that cuts into the profit margin that is to be going to refunds, no matter how miniscule that cut may be.

As a quick update to the Refund information posted on July 11, 2011, I have not been contacted regarding the refund amount due nor with any information regarding the charities (TWLOHA, GLAAD, ASPCA) that Lela said she would be contacting to discuss the $3000.00 owed to them. Lela updated here stating she had contacted two of them, but there was no information given as to which they were or what the outcome was. She states that as soon as the third charity responds she will release that information. The note also states she provided FDA with her labels and ingredient information. She also states that FDA has been informed of the intent not to wear gloves while placing sifters in pots (or other tasks where this may "cause more harm than good"). GS is back to manufacturing again but has not, as yet, posted videos of this process as stated they would in this note. The refund form was posted to the GS Fan Page and a deadline of August 15, 2011 was enacted. When questioned Lela stated it will be GS policy not to accept returns or exchanges and she did not want new customers to be confused by the current refund process. It was also announced that refunds would be for $2.00 per jar, far less than the original amount offered. I have also been informed that 15% of the profits (minus shipping costs) will go towards refunds. 

While it is still my sincere hope that everyone affected by GlitterSniffer Cosmetics past business practices gets the refunds due to them the lingering issues do seem pervasive, especially the release of customer information, the amount being offered for refund (when customers provided proof of what they actually paid), and the dependance upon personally befriending Lela Warren for business purposes. This is in addition to the quality control concerns posted last week. One would hope that prior to proceeding these issues would have been recognized and a plan in place to prevent the same issues from recurring but sadly, it seems they have not.

7/3/11 ETA: Removed a piece of PII. I regret the oversight.

Party Time. Excellent.

GlitterSniffer Cosmetics has been working on branching out as of late. Mineral Makeup classes, parties, and now business opportunities.

From the now temporarily defunct GS Facebook page:

 

And via Facebook message to another MMU seller, who, previous to this message, had never been contacted by Lela Warren before:

It's not clear what these business opportunities entail, whether it be wholesale or the exciting! opportunity! to hold your own GS Party as GlitterSniffer Cosmetics has not publicly released the details.

It would seem though that these opportunities would fall under the purview of the Federal Trade Commission.  According to the FTC Business Opportunity Rule a company must provide several things to any interested parties:

 

According to the FTC GlitterSniffer Cosmetics may be required to disclose the amount of money that can be made,  information about the company, including whether it has faced any lawsuits from previous purchasers or lawsuits alleging fraud, and, if a certain income claim is made, then it also must give the number and percentage of previous purchasers who achieved the earnings or it could possibly be in violation of the law. The FTC also suggests that everything be in writing.

It is unknown if anyone has taken advantage of these opportunities as yet.

GlitterSniffer Cosmetics Facebook Page

The GlitterSniffer Cosmetics Facebook page is no longer accessible and hasn't been for a couple of days. The page was taken down by proprietor Lela Warren for various reasons, including illness and the posts that were on the page. Lela Warren states that in her absence the page was being abused and things will be done "(her) way now".

 

Here are screenshots, dated from 4/20-4/22/11, of what resulted in the temporary removal of the page.

 

It would seem that only one of the variety of posts referenced any other companies. Though it has never been my personal practice to post to the GS fan page, it is understandable that those with previous issues would be concerned about current customers and their own issues with the business practices of GS. Given the company's track record this type of post to the page should not be a surprise. Had these customers had their issues addressed, either by an answer to their (sometimes multiple) emails, their products arriving in a timely manner, or the correct order being sent, the posts to the page would not be happening and the proprietor could deal with any life affecting issues without a need to worry. Instead, after committing to change on 4/10/11, there was nothing but radio silence.

The easiest way to not have to deal with these sorts of posts, other than ignoring the issues by taking down the page, would be for the company to simply do what it says it will do. When a customer pays for something in good faith they have every right to receive exactly what they ordered in the stated turnaround time. The Federal Trade Commission says so

The United States Postal Service says so

Google Checkout says so

and the Michigan Attorney General says so.

The plain fact of the matter is it is not up to the proprietor to say it must be done her way. GS' way it would seem is to dismiss the issues and continue on to new customers. I can state for a fact that my complaint to the Michigan Attorney General came with the suggestion of pursuing the matter in court because GS failed to respond to multiple attempts at contact by the AG. The Better Business Bureau has rated GlitterSniiffer Cosmetics an F. Of the 5 complaints filed with the BBB NONE of the complaints received a response.

 

If the company doesn't want these things on their page then there is a simple way to deter them from ever being posted. Follow through on all commitments in accordance with every regulation, guideline, and Terms of Service you agreed to the day you put your first item up for sale. If that doesn't happen then whatever public comment about your business results from that is a consequence of that choice.

GlitterSniffer Cosmetics Turnaround Time- Google Checkout and The Mail and Telephone Order Merchandise Rule

On Saturday, March 12, 2011, GlitterSniffer Cosmetics announced a change in their turnaround time for orders. They extended it from 5 business days, as stated in their listings and their Artfire policies, to 15 days.  The explanation was that there is a 10 day hold on their funds remitted via their payment processor Google Checkout as a new merchant.

The company states this is temporary, for approximately a month.

A check of Google Checkout shows that it is a policy to place a 10 day hold on funds for new merchants for a period of 60 days, then for a review to be conducted to lift the hold.

GlitterSniffer Cosmetics began using Google Checkout on January 28, 2011. The review would be conducted by Google Checkout in about 2 weeks time, not the month that GlitterSniffer Cosmetics is stating.

The hold is placed on funds remitted to the merchant, not the actual charge to the method of payment. This means that GS has to charge the funds then wait the ten day hold. The company has 168 hours (7 days) to capture the funds. Despite the funds not actually being transferred to the company they are obligated, per Google Checkout Program Policies and Guidelines, to fulfill orders within 24 hours of charging the method of payment. 

This would seem to indicate that per Google Checkout Program Policies and Guidelines the new 15 day turnaround time is incorrect if the company wishes to be compliant with the guidelines. Once the money is charged (which at the longest is 7 days) the order must ship within 24 hours to meet the guidelines. That is, at most, 8 days. 


Additionally, the new turnaround time would need to meet the criteria set forth by the FTC Mail and Telephone Order Merchandise Rule, which states:

The Rule requires that when you advertise merchandise, you must have a reasonable basis for stating or implying that you can ship within a certain time. If you make no shipment statement, you must have a reasonable basis for believing that you can ship within 30 days.

 If, after taking the customer’s order, you learn that you cannot ship within the time you stated or within 30 days, you must seek the customer’s consent to the delayed shipment. If you cannot obtain the customer’s consent to the delay -- either because it is not a situation in which you are permitted to treat the customer’s silence as consent and the customer has not expressly consented to the delay, or because the customer has expressly refused to consent -- you must, without being asked, promptly refund all the money the customer paid you for the unshipped merchandise.

This means, per the Federal Trade Commission, the merchandise must be shipped out in the agreed turnaround time, or the customer must consent to the delay. If the customer does not agree expressly to the delay then the company must issue a refund without the customer having to ask.

It is unknown at this time if all customers with current orders have been notified and given consent for the delay, nor if Google Checkout is aware of the issue GlitterSniffer Cosmetics seems to be having with the new turnaround time and meeting their payment processors' policies and guidelines. As of publication, the listings and policies for GlitterSniffer Cosmetics on Artfire still give a stated turnaround time of 5 business days.

I will update in the event new information becomes available.

Personally Identifying Information/FTC Followup

I received an email today from a person regarding this post. To review, on February 4, 2011 GlitterSniffer Cosmetics asked to hire one of their fans via the Facebook Fan Page to access the company gmail account, gather almost 2,000 customer names and addresses, place it in a blank document and email it back to the company. The company then addressed concerns regarding the release of personally identifying information without consent by stating that it was a 4 year employee who actually did the task. Ironically, they declined to name the employee. They also provided no information as to the use of this information.

I was contacted today by the person who actually did access the information. They wish to remain anonymous. The person is not employed by GlitterSniffer Cosmetics but has done work like this in the past. They are unsure what the information would be used for, apart from it being for some type of mailing list. They assured me that they no longer have the information, did not save a copy of it, and only sent it to GlitterSniffer Cosmetics.

This information contradicts what GlitterSniffer Cosmetics states happened in this situation. Additionally, it should be noted that this appears to be a common practice with the company. Some GS Admins of the private GS Group stepped down yesterday and are no longer supporting the company. Here is what one of them had to say regarding the free sample offer recently posted by GlitterSniffer Cosmetics:

At my count there were at least 5 known Admins as of yesterday. These women are not employed by GlitterSniffer Cosmetics. They are simply supporters who also take (or took in some cases) a role in administrating a fan group.

I will be contacting the FTC Tuesday with this new information, as Monday is a holiday.

Mail and Telephone Order Merchandise Rule/FTC

The Federal Trade Commission has different measures in place to ensure that the purchasing process goes smoothly for consumers. One of the measures is the Mail or Telephone Order Merchandise Trade Regulation Rule. This measure covers not only telephone and mail orders, but internet orders as well.

As per the FTC site:

It applies to most goods a customer orders from the seller by mail, telephone, fax, or on the Internet.

It does not matter how the merchandise is advertised, how the customer pays, or who initiates the contact.

The Rule requires that when you advertise merchandise, you must have a reasonable basis for stating or implying that you can ship within a certain time. If you make no shipment statement, you must have a reasonable basis for believing that you can ship within 30 days.

 If, after taking the customer’s order, you learn that you cannot ship within the time you stated or within 30 days, you must seek the customer’s consent to the delayed shipment. If you cannot obtain the customer’s consent to the delay -- either because it is not a situation in which you are permitted to treat the customer’s silence as consent and the customer has not expressly consented to the delay, or because the customer has expressly refused to consent -- you must, without being asked, promptly refund all the money the customer paid you for the unshipped merchandise.

In a nutshell, if a customer has not received a shipment of an order placed with GlitterSniffer Cosmetics within the stated turnaround time or 30 days from the order placement date and does not give permission for further delay the company is required by the FTC to refund without the customer having to ask for a refund. This shipping expectation also appears to apply to anything purchased using the fee gift cards supplied by GS as it clearly states that it does not matter how the customer paid. The FTC is very consumer protection oriented and goes to great lengths to address consumer issues, especially those that may have violated any of the consumer protection rules.

Also from the site:

For more information about the Mail or Telephone Order Merchandise Rule, call the Federal Trade Commission toll-free: 1-877-FTC-HELP; write: Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue, N.W., Washington, DC 20580; or visit: www.ftc.gov.

Personally Identifying Information/FTC

On Friday, February 4, 2011 GlitterSniffer Cosmetics posted to the Facebook Fan Page asking to hire someone for administrative duties. Those duties included accessing sensitive consumer information including names and addresses provided to GlitterSniffer Cosmetics by the consumer via Paypal and Artfire for the purposes of purchase only. The only qualifications were internet access, a few hours of time, and GlitterSniffer Cosmetics knowing the person "somewhat".

It is not clear what the purpose of this is, but I can confidently say that when I made my purchase with GlitterSniffer Cosmetics it was conducted in good faith with the understanding that my personally identifying information would be used for that purchase and that purchase alone. As I am no longer a customer of GS my information has no business being accessed by an unknown third party for an undisclosed reason.

I called the Federal Trade Commission at 1-877-382-4357 and filed a complaint. The FTC has a Bureau of Consumer Protection that is tasked with helping consumers know their rights in terms of purchasing and their secure information. I spoke with a representative and provided my personal information, GlitterSniffer Cosmetics contact information, and a brief summary of the issue. I was given a confirmation number and the telephone number for my states Consumer Protection Office to file a complaint as well. I will be making that phone call as soon as I post this entry.

Information about the FTC and Consumer Privacy and Security can be found here. Complaints may also be filed online. 

2/7/11 ETA:
A concerned customer emailed GlitterSniffer Cosmetics and was told that the job had been given to an employee who had worked for the company for 4 years. GlitterSniffer Cosmetics declined to provide the name of the employee. There was also no information provided as to what purposes the information would be used.


According to the statement released by GlitterSniffer Cosmetics on December 23, 2010 the company had a new staff and a new Vice President. The information provided today in regards to the release of customers personally identifying information directly contradicts the statement the company released in December. While it is unknown at this time which of these statements are factual there is only one publicly identified employee of GlitterSniffer Cosmetics aside from Lela Warren:

2/20/2011 ETA: Please see the new information posted here. GlitterSniffer Cosmetics tasked a member of their fan page who is not an employee with retrieving customers personally identifying information.