Privacy policy

Overview

This Privacy Policy describes how Rosys Craft Store (“we”, “us”, or “our”) operating rosyscraftstore.com (the “Site”) collects, uses, and discloses Personal Information when you visit the Site, create an account, contact us, or make a purchase.

“Personal Information” means information that identifies, relates to, or could reasonably be linked to an individual. This policy is written for shoppers and account holders using our storefront.

Personal Information we collect

We collect information in the categories below. The exact data depends on how you use the Site (browsing only, signing in, checking out, joining a membership, or contacting support).

Account information

• Examples: email address, username, first name, last name, and authentication identifiers. If you sign in with Google, we may receive your name and email from Google.
• Purpose: create and secure your account, wishlist, saved addresses, and order history.
• Source: you, and Google when you use Google sign-in.
• Shared with: Supabase (authentication and database), and our email provider for account emails.

Order and shipping information

• Examples: name, email, shipping address, order contents (including custom text you enter on products), shipping method, tax amounts, and order status or tracking details.
• Purpose: fulfill your order, calculate tax and shipping, send confirmations and updates, prevent fraud, and provide customer support.
• Source: you (and address suggestions you select via Google Places autocomplete).
• Shared with: Stripe (payments and tax), Supabase (order storage), AWS SES (transactional email), Shippo (shipping rates, label generation, and tracking handoff), and carriers such as USPS as needed to deliver packages.

Payment information

• Examples: payment method details entered in Stripe’s Payment Element (such as card number). We may store a Stripe customer id and display limited card metadata (brand, last four digits, expiration) when you save a payment method.
• Purpose: authorize and process payments, save payment methods you choose to keep, handle refunds, and resolve billing disputes (including sharing relevant transaction details with Stripe and, where needed, financial institutions or card networks).
• Source: you, via Stripe.
• Shared with: Stripe. We do not store card numbers or CVV on our servers.

Membership information

• Examples: membership plan and status, billing and renewal history, Membership Terms acceptance (version and time), promotional benefit usage (such as store credit earn/redeem, discounts, free-shipping perks, and allotments), and related order evidence used to apply those perks.
• Purpose: provide membership benefits, calculate store credit and discounts, operate your membership account, prevent fraud/abuse, and resolve billing disputes.
• Source: you, and records created when you use membership perks or pay invoices.
• Shared with: Stripe (subscription billing, invoices, payment authorization, and dispute handling), Supabase (storage), and AWS SES (membership and renewal emails).

Customer support and bug reports

• Examples: name, email, message subject and contents, related order references, in-app support thread messages, and technical details attached to bug reports (such as the page URL you were on). Guest support threads may be created without a signed-in account.
• Purpose: respond to questions, resolve order issues, improve the Site, and fix bugs.
• Source: you.
• Shared with: our hosting and database providers as needed to operate support tooling.

Guest carts and checkout sessions

• Examples: guest cart identifiers (cookies), abandoned or open checkout session data, and temporary fulfillment snapshots used to complete payment.
• Purpose: keep your cart and checkout working before you sign in or finish payment.
• Source: collected automatically during browsing and checkout.
• Retention: abandoned or expired checkout sessions and unfulfilled snapshots are closed after a short window (typically about one day) and then purged by scheduled cleanup. Completed guest orders are retained for fulfillment, tax, and support, with a guest access token so you can view the order from your confirmation email.

Device, usage, and security information

• Examples: IP address, browser type, device/approximate locale signals, pages viewed, referring URLs, and diagnostics. We also use Cloudflare Turnstile challenge signals to reduce bots and abuse.
• Purpose: load and secure the Site, diagnose errors, enforce rate limits, prevent fraud/abuse, and only if you accept optional analytics cookies, understand Site usage through Google Analytics and Microsoft Clarity.
• Source: collected automatically when you use the Site.
• Shared with: Cloudflare (including Turnstile), Google (Analytics; and Places when you use address autocomplete), Microsoft (Clarity), and our hosting infrastructure.

Microsoft Clarity

When you accept optional analytics cookies, we use Microsoft Clarity to capture how users interact with the website through behavioral metrics, heatmaps, and session replay. This helps us improve website usability. We share this data with Microsoft as a service provider. If you deny non-essential cookies or turn off Analytics in Cookie settings, Clarity does not load. See Microsoft’s Privacy Statement and our Cookie policy for related cookie details.

Cookies and similar technologies

We use cookies, local storage, and similar technologies for sign-in, cart and checkout continuity, theme preference, bot protection, and payments. Optional analytics cookies (Google Analytics and Microsoft Clarity) are used only when you accept them through our cookie banner or Cookie settings. We store your choice in a store_cookie_consent cookie. Details are in our Cookie policy.

How we use Personal Information

• Operate accounts, wishlists, carts, and checkout.
• Process payments, tax, shipping, and fulfillment.
• Operate memberships: apply benefits, calculate store credit and discounts, and keep billing records for fraud prevention and dispute resolution.
• Send transactional emails (for example password resets, order confirmations, shipping updates, membership welcome/invoice emails, and renewal reminders) via Amazon SES.
• Provide customer support, handle bug reports, and respond to privacy requests.
• Protect the Site against spam, fraud, and abuse (including Cloudflare Turnstile).
• Measure and improve Site performance and usability with Google Analytics and Microsoft Clarity (including heatmaps and session replay), only when you accept optional analytics cookies.
• If you subscribe to marketing email in the future, send product updates you opted into (the newsletter form may appear before subscriptions are fully enabled).

How we share Personal Information

We share Personal Information with service providers that help us run the store, under contracts or terms that limit use to providing their services. Current examples include:

• Stripe: payment processors for authorization, payments, saved payment methods, Stripe Tax, subscription invoices, and billing dispute resolution (and, where needed, financial institutions or card networks involved in those transactions).
• Supabase: authentication, database, and product image storage.
• Amazon Web Services (SES): transactional email delivery.
• Shippo: shipping rates, postage label generation, and tracking handoff to carriers.
• USPS or other carriers: delivery of packages.
• Google: Analytics (when you opt in), Fonts, Places/Maps address tools, and Google sign-in when you choose it.
• Microsoft: Clarity analytics (when you opt in): behavioral metrics, heatmaps, and session replay.
• Cloudflare: CDN/security edge services and Turnstile bot protection.
• Our hosting/deployment providers that run the Site infrastructure.

We may also disclose Personal Information to comply with law, respond to lawful requests, or protect our rights, customers, or the public. We do not sell Personal Information as “sale” is commonly defined under the California Consumer Privacy Act (CCPA).

Retention

We retain Personal Information as long as needed for the purposes above, including to maintain accounts, complete orders, meet legal/accounting requirements, and resolve disputes.

Guest carts and abandoned checkout data are short-lived as described above. Completed orders (including guest orders) and membership billing records may be kept longer for tax, fraud prevention, fulfillment history, and dispute resolution.

You may delete your account through account controls when available, or by contacting us. When you delete your account, we remove or unlink profile-linked data we no longer need. Essential transaction history (orders and related tax/financial records) may be retained with account linkage removed where applicable. You may ask us about erasure options by contacting us below.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of certain Personal Information, or to appeal a denial. We do not sell Personal Information. We may “share” identifiers and online activity with analytics providers (Google Analytics and Microsoft Clarity) for cross-context behavioral advertising–style analytics only when you accept optional analytics cookies.

California and other U.S. state privacy rights

California residents have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including rights to know, delete, correct, and opt out of sale or sharing of Personal Information. We do not sell Personal Information. Our primary sharing that may qualify as “sharing” under California law is optional analytics with Google and Microsoft as described above.

To opt out of that sharing: choose Deny non-essential on the cookie banner, turn off Analytics in Cookie settings (footer), or enable Global Privacy Control (GPC) in a supported browser, we honor GPC as an opt-out of optional analytics sharing. See our Cookie policy for details.

Residents of other U.S. states with comprehensive privacy laws (for example Colorado, Connecticut, Virginia, Utah, and Texas) may have similar rights to access, delete, correct, or opt out of certain processing. Because we do not sell Personal Information and gate optional analytics behind consent, many requests may be satisfied through the cookie tools above. For rights we cannot fulfill through those tools, email [email protected] with enough detail for us to verify your request.

Authorized agents may contact us at the same address. We may need to verify your identity before fulfilling a request. We will not discriminate against you for exercising privacy rights.

You can update some account details while signed in, and you can clear cookies through your browser (see the Cookie policy).

Children

The Site is not directed to children under 13, and we do not knowingly collect Personal Information from children under 13. If you believe a child provided Personal Information, contact us and we will take appropriate steps to delete it. By using the Site you also represent that you meet the age requirements in our Terms of service.

Do Not Track and Global Privacy Control

There is no consistent industry standard for responding to browser “Do Not Track” (DNT) signals. We do not alter our practices solely based on a DNT signal. We do honor Global Privacy Control (GPC) as an opt-out of optional analytics sharing, as described in our Cookie policy.

International visitors

We operate primarily in the United States and ship to U.S. addresses. If you access the Site from outside the U.S., your information may be processed in the United States or other countries where our providers operate. This policy is written for our U.S. storefront and U.S. state privacy frameworks; it is not a GDPR or EU-specific privacy notice.

Changes

We may update this Privacy Policy to reflect operational, legal, or regulatory changes. The “Last updated” date on this page will change when we do. Continued use of the Site after an update means you acknowledge the revised policy.

Contact

For privacy questions, complaints, or requests, contact us at [email protected].