Privacy PolicyPrivacy Policy

The short version

We collect what we need to make, ship and support your order. We do not sell or share your personal information, we do not show you ads, and the site uses no analytics, advertising or tracking cookies.

What we collect

Information you give us when you order: your first and last name, email address, the set, shape, length and add-ons you choose, your written design notes, and any reference photos you upload (up to four per set). Please don’t include other people in your photos without their consent.

Information collected by Square at checkout: your shipping address, the recipient’s name, any phone number you give, and your payment details. Your card details are entered on Square’s hosted checkout — we never see or store your full card number. Square tells us the order’s payment status, what was ordered, the shipping details and the email for the order.

Messages you send us: emails, and messages through Instagram or TikTok if you contact us there (for example about a Custom Art Set).

Technical information: when you visit, our hosting provider automatically receives your IP address, browser and device type, and the pages you request, in standard server logs. We use your IP address for a short time, in memory, to limit abuse of the checkout and email-check forms.

What stays on your device

Our site does not set cookies. Your cart — the sets you’ve added, your design notes and your reference photos — is saved in your own browser (localStorage under “sbs-cart-v1” and IndexedDB under “sbs-cart”) so it survives a page refresh. It isn’t sent to us until you check out, and it is cleared once your payment is confirmed. You can also clear it by removing the items or clearing your browser’s site data.

Square’s checkout pages and Google Fonts (see below) are run by those companies and may use their own cookies or similar technology under their own policies.

How we use it

To take and make your order: to create your order and checkout, take payment, make your set from your design notes and photos, ship it, and email you an order confirmation, shipping updates and any questions about your design. (We need this information to fulfil our agreement with you.)

To support you and keep records: to answer your questions, handle cancellations, replacements, refunds and payment disputes, and keep the business and tax records the law requires. (Contract and legal obligation.)

To keep the site safe: to check that your email domain can receive mail, prevent fraud and spam, and keep the site secure. (Our legitimate interest in running a safe shop.)

We do not use your information for advertising, profiling or automated decisions, and we don’t send marketing emails unless you ask us to. We will not publish your photos or your finished set without asking you first.

Who we share it with

We share information only with the service providers that run the shop for us, and only what each needs:

Square, Inc. — checkout, payment processing, receipts and refunds. Square receives your order lines (including a short version of your design notes), your email address and the details you enter at checkout, and uses them under its own privacy notice (squareup.com/us/en/legal/general/privacy).

Resend — delivers our order emails. Your order details pass through Resend, and your reference photos are attached to our private order-notification email.

Turso — stores our order records: your name, email, the sets and design notes you chose, order totals, the recipient name, shipping and tracking status. Reference photos are not stored there.

Vercel — hosts this website and keeps short-term server logs.

Cloudflare — receives only the domain part of your email address (for example “gmail.com”) to check it can receive mail.

Google Fonts — your browser downloads the site’s fonts from Google, which receives your IP address and browser information when it does.

Our email provider — stores the order emails and photos in our inbox. USPS or UPS — receive the recipient name and shipping address to deliver your parcel.

We may also disclose information if the law requires it, to protect our rights or someone’s safety, to our professional advisers (such as an accountant), or to a buyer if the business is ever transferred — in which case this policy would continue to apply.

Selling, sharing, Do Not Track and Global Privacy Control

We do not sell your personal information or share it for cross-context behavioral (targeted) advertising, and we have not done so in the past 12 months. We don’t knowingly sell or share the information of anyone under 16.

We don’t track you across other websites, so our site works the same whether or not your browser sends a Do Not Track signal. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing — which we already don’t do.

California residents: we do not disclose personal information to third parties for their own direct marketing purposes.

How long we keep it

Order records, receipts and order emails: for three years after the end of the year in which you ordered, which is how long Virginia and federal tax rules generally require us to keep sales records, and then deleted — longer only if we must keep them for a dispute or legal reason.

Reference photos: deleted from our inbox within 90 days after your order is delivered, unless you ask us to keep them for a repeat order or agree that we can feature your set.

Server logs are kept by our hosting provider for a short period under its standard settings. Your cart stays on your device until you check out or clear it.

Security

The site is served over HTTPS, payments happen on Square’s systems, our databases and email accounts are protected by access controls, and access to order information is limited to the studio owner. No method of transmission or storage is perfectly secure, but we take reasonable steps to protect your information and will tell you if a breach affects you where the law requires.

Children

This site is not directed to children under 13, and we do not knowingly collect personal information from them. Orders must be placed by an adult (see our Terms). If you believe a child under 13 has given us information, email us and we will delete it.

Your choices and rights

Wherever you live in the US, you can ask us to tell you what personal information we hold about you, give you a copy, correct it, or delete it. Residents of California, Virginia, Colorado, Connecticut and other states with privacy laws may have these rights by law; as a very small business we may not be covered by those laws, but we honor the same requests for everyone. We will not treat you differently for making a request.

To make a request, email justena.squire@starblossom.org from the email address on your order (or tell us how to verify you). An authorized agent may make a request for you with your written permission. We respond within 45 days, and will tell you if we need more time (up to a further 45 days). We may keep information we are legally required to keep, such as tax records, and will tell you if so.

If we decline your request, you can appeal by replying to our decision with the subject “Privacy appeal”. We will respond within 60 days. If you are still unhappy, you can contact your state attorney general (in Virginia, the Office of the Attorney General).

Where your information is stored

We are based in the United States, and our service providers store and process information mainly in the United States.

Changes

If this policy changes we will update the date at the top of this page. If a change materially affects how we use information we already hold, we will tell you by email or with a notice on the site before it takes effect.

Contact

Questions or requests about your privacy: justena.squire@starblossom.org, or write to Star Blossoms Studio, [BUSINESS MAILING ADDRESS].