P.F. Candle Co. built a privacy workflow that their lean ecommerce team could actually maintain.

TrueVault helped P.F. Candle Co identify hidden gaps, automate GPC opt-out requests, and keep workflows current as vendors, tracking tools, and privacy requirements continued changing.

Keeping privacy workflows aligned

When Matt Pineda took over ecommerce operations at P.F. Candle Co., one of the first priorities was gaining a clearer picture of how privacy was operating across the business.

The data mapping process helped connect the dots across customer data, vendors, tracking tools, and existing workflows.

That visibility also surfaced several places where the setup no longer reflected how the business was operating. That included a missing California Privacy Notice link, missing opt-out functionality, Google Analytics-related requirements, and issues with the site's cookie consent setup.

None of the findings were unusual.

They're the kind of issues that can build gradually as websites evolve, vendors get added, and privacy workflows drift over time.

The process also helped the team understand where workflows needed to evolve alongside the business.

"The support team was especially helpful in guiding us through implementation and explaining the reasoning behind each requirement," Matt says.

For many ecommerce teams, that's where privacy starts getting harder. Getting compliant once is usually manageable. Keeping workflows aligned as the business changes is what requires ongoing attention.

Building privacy into the workflow

P.F. Candle Co. doesn’t have a dedicated privacy department.

Ownership sits alongside ecommerce operations, vendor management, site updates, customer experience, and everything else the team already manages day-to-day.

That reality shaped how the team approached the work moving forward.

Now, when new vendors, pixels, apps, or storefront changes are introduced, review is part of the process instead of something the team circles back to later.

“Any major website or theme update now includes a compliance review,” Matt explains. “For new pixels, apps, or vendors, we verify whether an integration is required and make sure it’s configured correctly.”

The team also uses TrueVault to monitor evolving requirements and review action items when updates surface inside the platform.

“Most updates and required actions are surfaced directly within the portal through guidance and task lists,” Matt says. “It helps us understand what needs to be implemented on-site to remain compliant and reduce legal risk.”

Handling requests without adding more overhead

P.F. Candle Co. averages roughly 100 privacy-related requests each month.

Most are Global Privacy Control (GPC) opt-out requests, which get processed automatically through TrueVault. Deletion requests are less common and handled manually when needed.

The biggest improvement wasn’t simply automation. The workflow now requires far less manual coordination across teams.

Without a structured workflow, even manageable request volume can turn into inbox threads, spreadsheet tracking, developer follow-ups, and uncertainty around ownership.

For lean ecommerce teams, that kind of coordination adds up quickly.

Support that feels operational, not transactional

One of the biggest differences for Matt has been having a team that works closely with them and understands the realities of ecommerce operations.

Last year, when P.F. Candle Co. needed to implement updated CCPA requirements, the TrueVault team worked directly with their developer to help configure the required privacy and opt-out links correctly.

“Kamey's guidance helped us get back into compliance efficiently, and the process was clear and straightforward,” Matt says.

That kind of support matters when privacy ownership sits with ecommerce teams instead of dedicated compliance staff.

Most ecommerce operators don’t want a privacy lecture. They want someone who can explain:

• What changed
• What matters
• What needs attention now
• What can wait

“Learning the platform and working with the team felt seamless,” Matt says. “It made onboarding and understanding the process much easier.”

Keeping privacy manageable as things change

At P.F. Candle Co., privacy compliance isn’t treated like a one-time project.

The storefront changes. Vendors change. Tracking setups change. Privacy requirements keep evolving alongside them.

The goal isn’t turning the ecommerce team into privacy experts.

It’s about having workflows, guidance, and support that help the business keep up as requirements evolve, without adding unnecessary operational strain on the ecommerce team.

“It allows us to move more confidently and efficiently when compliance questions come up,” Matt says.

For lean ecommerce teams, that’s often what good privacy operations looks like: fewer surprises, less manual coordination, and more confidence that the setup still reflects how the business actually operates.