Privacy policy

What we collect

• Order details: your name, email, phone number, shipping and billing address, and what you bought.
• Payment details: handled by Stripe. We receive the last four digits, card brand and payment status, never your full card number.
• Account details: if you create an account, your email, password (stored hashed) and saved addresses.
• Messages: what you send us through the contact form.
• Encore votes: which designs you voted for, linked to your account or to a random id in a cookie.
• Technical data: your IP address and browser details, as recorded by our hosting provider and by Stripe for security and fraud prevention.

How we use it

• To take payment, make your order and ship it to you.
• To send order and shipping updates, and to answer your messages.
• To prevent fraud and keep the store secure.
• To run the encore ballot.
• To meet our legal, tax and accounting obligations.

We do not send marketing email unless you have asked for it, and every marketing email has an unsubscribe link.

Who we share it with

Only with the companies that help us run the store, and only what each one needs:

• Stripe processes payments and screens for fraud. See the Stripe privacy policy.
• Our print partners receive your name, shipping address and phone number to print and deliver your order. They never receive your email address and never contact you; every email about your order comes from us.
• The US Census Bureau address lookup receives the street, city, state and ZIP code you enter at checkout, without your name, so we can check the address can be delivered to before printing.
• Our email delivery provider sends the emails we write to you about your order.
• Shipping carriers receive your name and address to deliver the package.
• Hosting and infrastructure providers store our data on our behalf.
• Authorities, when the law requires it.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Cookies

We only use cookies that the store needs to work. We do not use advertising or analytics cookies. Stripe sets its own cookies on the payment form for fraud prevention.

How long we keep it

Order and payment records are kept for as long as tax and accounting law requires, usually seven years. Messages are kept for two years after the conversation ends. Account details are kept until you delete your account. Encore votes are taken off the ballot once the design they are for comes back.

Your privacy rights

Wherever you live in the US, you can ask us to:

• tell you what personal information we hold about you, and give you a copy;
• correct information that is wrong;
• delete your information, except what we must keep by law, such as order records;
• stop using your information for marketing.

California residents have these rights under the California Consumer Privacy Act, as amended by the CPRA, including the right to know, delete, correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of, and we do not use sensitive personal information to infer characteristics about you. We will not treat you differently for using any of these rights. Residents of other states with privacy laws, such as Colorado, Connecticut, Virginia and Texas, have similar rights, including the right to appeal a decision we make about a request.

To make a request, use the contact form with the subject "Privacy request" and the email you used with us. We will confirm your identity by email and reply within 45 days. You can use an authorized agent to make a request for you. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of sale and sharing, which we do not do anyway.

Children

The store is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has given us their details, contact us and we will delete them.

Security

Payments are handled by Stripe, a PCI DSS Level 1 certified provider. Passwords are stored hashed, and the site is served over encrypted connections. No system is perfectly secure, but we take reasonable measures to protect your information.

Changes to this policy

If we change how we use personal information, we will update this page and the date at the top, and, for significant changes, let account holders know by email.

Contact

Questions about this policy go through the contact form.