This policy explains how Fern Mallis (“we”, “us”) handles personal information when you visit gmofbyfernmallis.com or buy from us. We collect only what we need to run the shop, and we do not sell your personal information.
1. Information we collect
When you order
Checkout is hosted by our payment provider, Stripe. When you pay, Stripe collects your name, email address, shipping and billing address, phone number if you give it, and payment card details. Stripe shares the order details with us so we can fulfil your order; we do not receive or store your full card number.
When you contact us
If you email us, we receive your email address and whatever you choose to include in your message.
When you browse
- Your bag. The items in your bag are saved in your own browser’s local storage so they are still there when you come back. This stays on your device and is sent to us only when you choose to check out.
- Technical data. Our hosting and security provider, Cloudflare, processes technical information such as IP address, browser type and pages requested in order to deliver the Site and protect it from attacks.
- Visit statistics. We may use Cloudflare Web Analytics, which counts visits without cookies and without tracking you across other websites.
We do not use advertising cookies, tracking pixels or cross-site tracking.
2. How we use information
- to process, make, ship and support your order, including returns and refunds;
- to reply to your messages;
- to prevent fraud and keep the Site secure;
- to keep business, tax and accounting records and to meet legal obligations;
- to understand, in aggregate, how the Site is used so we can improve it.
We will not send you marketing emails unless you have asked us to.
3. Who we share it with
We share personal information only with service providers that help us run the shop, under contracts that limit their use of it:
| Provider | Purpose |
|---|---|
| Stripe | Payments, fraud prevention, receipts |
| Cloudflare | Website hosting, security and visit statistics |
| Our production and fulfilment partners | Making and packing your order |
| Shipping carriers | Delivering your order and tracking |
| Our email provider | Corresponding with you |
We may also disclose information if the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganisation of the business.
We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined under California law.
4. How long we keep it
We keep order records for as long as needed for tax, accounting and legal purposes (generally seven years), email correspondence for up to two years after it ends, and technical logs only for short periods set by our providers.
5. Security
The Site is served over an encrypted (HTTPS) connection, and payments are handled by Stripe, which is certified to PCI DSS Level 1. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.
6. Your rights
Wherever you live, you can ask us to tell you what personal information we hold about you, to correct it, or to delete it (unless we must keep it, for example for tax records). Email privacy@gmofbyfernmallis.com. We will verify your request using the email address on your order and respond within 45 days.
California residents
Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. We do not sell or share personal information, and we use sensitive information (such as payment details, handled by Stripe) only to complete your purchase. We will not discriminate against you for exercising your rights. You may use an authorised agent to make a request on your behalf.
In the last 12 months we have collected these categories, from you directly and from Stripe, for the purposes in section 2, and disclosed them to the service providers in section 3:
| Category | Examples |
|---|---|
| Identifiers | Name, email address, postal address, IP address |
| Customer records | Phone number, billing address |
| Commercial information | Products bought, order history, returns |
| Internet activity | Pages visited, browser type (technical data) |
| Approximate location | Derived from IP address for security |
Other US states
Residents of states with consumer privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others) have similar rights. If we decline your request, you may appeal by replying to our decision; we will respond to appeals within the time the law requires.
Global Privacy Control
We honour the Global Privacy Control (GPC) signal as a request to opt out of the sale or sharing of personal information. Because we do not sell or share personal information, no further action is needed on your part.
7. Children
The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 16. If you believe a child has given us information, contact us and we will delete it.
8. Where information is processed
We are based in the United States and our providers process information in the United States and other countries where they operate.
9. Changes
We will update this policy if our practices change and revise the “Last updated” date above.
10. Contact
Fern Mallis · [Business address — to be confirmed] · privacy@gmofbyfernmallis.com