Sets by Hand Privacy Policy

Last updated: [DATE]

The short version

We collect what we need to make and ship your nails: your name, email, phone, address, nail sizes, orders, and any photos you send us.
We never see or store your card number. Stripe handles payments.
Before she accepts your order, your artist sees only your first name and your sizes, shape and length. After she accepts, she also sees the name and address for your shipping label. She never sees your email or phone number.
We don't sell your personal information. We don't use ad pixels or third-party trackers.
You can ask us to see, fix, or delete your data at any time by emailing [EMAIL].

1. Who we are

This Privacy Policy explains how [COMPANY LLC] ("Sets by Hand", "we", "us") collects, uses and shares personal information when you use our website and services (the "Service"). For privacy questions, email [EMAIL] or write to [COMPANY LLC], [MAILING ADDRESS].

2. What we collect

2.1 Information you give us

Information	Examples	Why we need it
Contact details	Name, email, phone number (collected at checkout)	To confirm your order and reach you about it
Shipping details	The name and address for your shipping label	To ship your order
Nail sizes	Your size (0 to 11) for each finger, shape and length	To make sets that fit
Order history	What you bought, when, add-ons, codes used, refunds	To fill orders, handle remakes, and keep records
Photos	Photos you email us for a claim	To resolve problems
Sign-up info	Email or phone you give us to hear when ordering opens, to hear when an artist opens, or to get a copy of your sizes (with those sizes)	To send you what you asked for
Reviews (when reviews open)	Ratings, review text, review photos	To show verified reviews
Artist information (artists only)	Phone number for sign-in, first name, shop name and shop content, the mailing address you ship from, payout and tax details (collected by Stripe), high-volume seller information required by law	To run your shop, buy your shipping labels, pay you, and meet legal duties. Your mailing address is only used to buy labels: USPS needs it to price them, but labels print our business return address, so shoppers never see it
Text message choices	Whether you agreed to texts, the wording you agreed to, when, and any STOP or HELP replies	To send only the texts you asked for, and to prove you asked

2.2 Payment information. Payments are handled by Stripe. When you pay, your card details go straight to Stripe on Stripe's checkout page. Sets by Hand never receives or stores your full card number or security code. We receive limited details from Stripe, such as your email, phone, shipping address, and whether the payment went through.

2.3 The size check. Our size check measures your nails from a photo of your hand next to a quarter. The photo stays on your phone. It is never sent to us. Your sizes are saved on your device. They are only sent to us when you place an order or ask us for a copy.

2.4 Information collected automatically. When you use the site, we collect:

Device and browser type, and IP address (for example, to keep the site secure and stop abuse).
How you first got to our site (for example, an artist's shop link, an artist code, or another website), so the right artist gets credit.
Cookies and similar technologies (see section 8).

2.5 Proof-of-shipping photos. Before shipping, artists photograph your finished set next to the order slip and your sealed package. The slip and package show a short order code. These photos are private. Only the artist who made your set and our team can see them. They are not shown to shoppers on the site. We keep them with your order to settle claims.

2.6 Information we don't want. Please don't send us health information, government ID numbers, or card numbers in emails or photos.

3. How we use your information

We use personal information to:

Process orders, take payment, and ship sets.
Share your sizes and order details with the artist making your set (see section 4).
Handle claims, remakes, refunds and disputes.
Send order updates, shipping notices, and the alerts you signed up for, by email, and by text if you agreed to texts (see section 4.1).
Send marketing emails, if you've agreed (you can unsubscribe any time).
Prevent fake reviews and fraud.
Keep the site secure, and fix bugs.
Credit artists for customers who come through their shop link or artist code.
Follow the law, including tax and marketplace seller laws.

We share personal information only as described here:

The artist making your order. Before she accepts it: your first name, your sizes, shape and length, and what you ordered. After she accepts it: also the name and address for your shipping label, until she is paid for the order (and never more than 30 days after delivery). Artists never see your email or phone number. Artists may use this only to make and ship your order.
Stripe: payment processing and artist payouts. Stripe's privacy policy applies to the data it collects.
Shippo and USPS: your name and shipping address, to buy labels and deliver your package. For artists: the mailing address you ship from, which USPS needs to price the label (it doesn't print on the label).
Twilio: your phone number and the text we're sending, to deliver sign-in codes and the texts you agreed to.
Service providers that help run Sets by Hand, such as website hosting, database, and email delivery. They may use your data only to provide services to us. [List current providers here, for example hosting, database and email vendors.]
Legal and safety: when required by law, or to protect the rights, property or safety of Sets by Hand, our users, or others.
Business transfer: if [COMPANY LLC] is sold, merged or reorganized, personal information may transfer to the new owner, who must honor this policy.
With your permission: any other sharing you agree to.

We do not sell your personal information. We don't share it for money or rent it to anyone.

4.1 Text messages. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties. We share your number only with Twilio, the company that delivers our texts, and only to send them. Reply STOP to any text to stop them. See section 17 of our Terms of Service for the full SMS terms.

Targeted advertising. We don't use your information for targeted advertising. We don't use ad pixels (such as Meta or TikTok) or third-party trackers. If that ever changes, we'll update this policy first.

5. How long we keep it

Contact and sign-up details: until you ask us to delete them, or within [90] days after you close an artist account, except as below.
Order records (including sizes, addresses and proof photos): [7] years, for tax, accounting, and dispute purposes. [Decision for Ryan: consider deleting proof photos sooner, for example 12 months after delivery.]
Claim photos and emails: [2] years after the order.
Marketing preferences: until you unsubscribe, plus a record that you opted out.

6. How we protect it

We use reasonable security measures, including encrypted connections (HTTPS), signed sign-in cookies, access limits so only people who need data can see it, and trusted providers for payments. No system is perfectly secure, so we can't promise absolute security. If a data breach affects your personal information, we'll notify you as required by law.

7. Your rights and choices

7.1 Everyone. No matter where you live, you can ask us to:

Tell you what personal information we have about you and give you a copy.
Correct information that's wrong.
Delete your information (we may keep some records the law requires, such as tax records).
Stop sending you marketing emails (use the unsubscribe link or email us).

7.2 Connecticut residents. Under the Connecticut Data Privacy Act (CTDPA), you have the right to:

Confirm whether we process your personal data, and access it.
Correct inaccurate personal data.
Delete personal data provided by or obtained about you.
Get a copy of your data in a portable, easy-to-use format.
Opt out of the sale of personal data, targeted advertising, and profiling that produces legal or similarly significant effects. (We don't sell data, do targeted advertising, or do that kind of profiling.)

Residents of other states with similar privacy laws have similar rights, and we honor these requests for all US users.

7.3 How to make a request. Email [EMAIL] with the subject line "Privacy Request". We'll verify your identity (usually by confirming the email you ordered with) and respond within 45 days. If we need more time, we'll tell you. You can use an authorized agent to make a request for you.

7.4 Appeals. If we decline your request, you can appeal by replying to our decision email with "Appeal" in the subject line. We'll respond within 60 days. If you're still not satisfied, you can contact the Connecticut Attorney General at portal.ct.gov/ag (or your own state's attorney general).

7.5 No discrimination. We won't treat you differently for using your privacy rights.

8. Cookies and storage on your device

Cookies are small files stored in your browser. We only use cookies and storage that run the site. We don't use analytics cookies, ad pixels or third-party trackers.

Cookies we set:

Name	What it does	How long
`sbh_session`	Keeps a signed-in artist or our team signed in. Your browser's scripts can't read it.	30 days
`sbh_ft`	Remembers how you first got to our site (for example, an artist's shop link or code), so the right artist gets credit. Your browser's scripts can't read it.	90 days
`sbh_claim`	Remembers an artist's progress while she claims her shop.	2 hours
`sbh_co`	Lets only the browser that paid see the order confirmation page.	2 hours

Storage on your device (it stays in your browser and isn't sent to us unless you order or ask us for something):

nh.sizes: your saved nail sizes.
sbh.bag (and sbh.bag.paying while you pay): the sets in your bag.
nh.orders: sample order history in this browser.
sbh.checkout.* (session storage, cleared when you close the tab): the shape, length, add-ons and code you picked on a set.
nh.theme: light or dark mode.

The artist Studio also saves a few settings on the artist's own device.

Other sites. When you pay, you go to Stripe's checkout page, and Stripe sets its own cookies there. The artist payout page in the Studio uses Stripe's tools too. Stripe's privacy policy applies. Our size check also downloads its hand-measuring tool from public code hosts (jsDelivr and Google). Your photo is never sent to them.

You can block or delete cookies and site storage in your browser settings. Blocking them may break parts of the site, like your bag or signing in.

9. Children

Sets by Hand is for adults 18 and older. We don't knowingly collect personal information from children under 13, or sell or target ads at anyone under 18. If you believe a child has given us personal information, email [EMAIL] and we'll delete it.

10. Changes to this policy

We may update this Privacy Policy. If we make important changes, we'll tell you by email or a notice on the site before they take effect. The "Last updated" date shows the latest version.

11. Contact

[COMPANY LLC] [MAILING ADDRESS] [EMAIL]