Return to Store

Privacy Policy

Effective and last updated: November 1, 2026

This policy explains how Arts and Crafts handles personal information when you visit artsandcrafts.dev, create a client account, save a cart, place an order, contact us, or use staff tools. For privacy questions or requests, contact [email protected].

  • Client accounts: your email address, an internal account identifier, a one-way password hash, and information needed to authenticate your session. Client passwords are not stored as readable text in the store’s account database.
  • Carts and orders: the items and quantities you save, purchased item descriptions and prices, currency, totals, order identifiers, order dates, payment status, Stripe Checkout references, and fulfilment or tracking updates.
  • Delivery and billing: Stripe may collect your name, billing address, shipping address, and other information needed for payment or delivery. We receive the delivery information made available to fulfil your order and can access relevant transaction information through Stripe’s merchant tools.
  • Support: the name, email address, message, order reference, photographs, and other information you choose to send through the contact form or by email.
  • Technical information: service providers and server logs may process IP addresses, requested pages, request times, browser or device information, error information, and security-related activity needed to operate and protect the service.
  • Staff activity: staff email, authentication results, catalog details, uploaded product images and links, and order updates. Staff credentials are sent to the Sky Cyber Sector staff-mail authentication service for verification, including two-factor verification where configured.

We obtain information directly from you, from your use of the store, and from payment or delivery providers involved in your transaction. Please do not send card numbers, card security codes, mailbox passwords, or unrelated sensitive information in support messages.

We use information to create and secure accounts, preserve saved carts, process purchases, confirm payments, display private order history, fulfil deliveries, provide digital access where applicable, and handle support, returns, refunds, and disputes.

We also use necessary information to detect abuse, troubleshoot failures, restrict staff functions, maintain records, and meet legal, tax, accounting, and payment obligations. We do not require a client account password or staff mailbox password for customer-support correspondence.

Information supplied to complete an order is used for that purpose, not treated as blanket permission for unrelated marketing. The current store does not include an advertising-pixel or optional third-party analytics integration. If we introduce a materially different use of personal information, we will explain it and obtain consent where required.

When Stripe Checkout is enabled, payment details are entered on Stripe’s hosted payment page. Our store backend does not receive or store your full payment-card number or card security code. Stripe processes payment-method details and may process identity, address, transaction, device, and fraud-prevention information under its own policies.

We send Stripe information needed to create your checkout, including your email, order reference, item names, amounts, and currency. Stripe sends us payment confirmations and transaction references. Its merchant tools may also make limited payment-method information, such as card brand or last digits, available to us for support and transaction management.

Stripe Checkout may offer optional saved-payment features for future purchases. These are handled by Stripe on its hosted pages. We store a Stripe customer reference linked to your account to associate checkout sessions; this website does not provide saved-card management.

If you enable authenticator-based two-factor authentication, we store an encrypted setup secret, the last accepted code time step to prevent replay, and hashes of one-time recovery codes. Microsoft Authenticator and Google Authenticator generate the codes on your device; enabling this feature does not connect your Microsoft or Google account to this store. Keep your recovery codes private.

Stripe’s separate services, including optional saved-payment services such as Link, have their own terms and privacy choices. See Stripe’s Privacy Policy and Privacy Center. A test-payment button is a demonstration, not a real order; use test information only.

The store uses a secure, HttpOnly authentication cookie named __Host-arts-shop to keep you signed in and enforce account permissions. The authentication ticket expires after approximately eight hours; closing the browser may end the session sooner depending on your browser settings. Signing out clears the store’s sign-in cookie.

Saved carts and order history are held on the server against your account, so clearing browser cookies does not delete those records. Blocking cookies may prevent sign-in, cart, or checkout features from working. Cloudflare and Stripe may use their own necessary security, payment, or service cookies; those providers explain their cookies in their own policies.

We disclose information where needed for the purposes described above, including to:

  • Authorized staff who manage customer support, the catalog, orders, returns, and fulfilment.
  • Stripe and its payment partners to process payments, refunds, fraud checks, and payment disputes.
  • Cloudflare and hosting/network providers to deliver and secure the website and route requests to the store server.
  • Email providers used to receive or respond to support messages. The contact-form service can route messages through email providers, including Gmail.
  • Carriers and fulfilment providers where required to deliver an order or investigate a delivery problem.
  • Professional advisers or public authorities where necessary for a legal obligation, a valid legal request, or the establishment or defence of legal rights.

We do not sell customer personal information or share it with advertisers for behavioural advertising through this store. If the business is transferred, relevant records may be transferred subject to appropriate safeguards and any notice or consent required by law.

Some products link to external storefronts, download services, or other websites. When you open a link, that provider may receive your IP address and information you give it. Purchases made there follow that seller’s privacy and refund policies; an external purchase does not automatically create an Arts and Crafts order-history entry.

Catalog descriptions, button links, and product images are public. Staff should not upload confidential documents or include credentials or private customer information in a listing. Uploaded product images are processed for display and their embedded metadata is stripped during normal image conversion.

Store account, cart, catalog, and order records are held in server-side storage outside the publicly served website folders. We use password hashing, HTTPS, secure session cookies, staff authorization checks, and validated payment notifications to help protect the service. These measures reduce risk but cannot guarantee that every transmission, device, or system is secure.

Staff mailbox passwords are not stored in the catalog/account database. They are processed by the separate staff-mail service for authentication; that service may temporarily retain encrypted credentials in server memory for its session. MailEnable and related authentication services may maintain their own security logs.

Our service providers may process information in countries other than your own. Local authorities in those countries may have lawful access under their laws. We do not promise that every provider stores information exclusively in Canada or any other single country.

We retain account and saved-cart records while needed to provide your account, and order, payment-reference, refund, and support records while needed for fulfilment, accounting, tax requirements, disputes, fraud prevention, and other legitimate obligations. Retention depends on the record’s purpose and applicable requirements; signing out does not delete an account or order.

You may request account closure and deletion of information we no longer need. Requests are handled manually; there is not currently a self-service deletion or export tool. Information that must be retained for a legal requirement or an unresolved transaction may be kept with its use restricted to the remaining purpose. Copies in backups may remain until those backups are replaced or expire. We do not promise immediate deletion from every provider or backup.

You may browse public product pages without registering, choose not to provide optional support information, manage cookies in your browser, and decline to proceed with a purchase. Some features need particular information: without an account we cannot save your client cart, and without required delivery or payment information we may be unable to complete an order.

To ask for access, correction, an export, account closure, deletion, or information about how your data was used or disclosed, email [email protected]. We may request proportionate verification of identity before releasing or changing account data. Do not send your password or payment-card details as verification.

We will consider requests under the laws that apply to you and explain any legal reason for refusing or limiting a request. Withdrawing consent may prevent us from continuing a feature that needs the information, but does not invalidate lawful processing already completed or remove necessary recordkeeping duties.

The account and checkout services are not intended for children under 13. We do not knowingly seek personal information from them. A parent or guardian who believes a child has provided personal information should contact us so we can review it and take appropriate action. A minor who is otherwise permitted to use the store must have any authorization required by applicable law.

Contact [email protected] with privacy questions or complaints. If we cannot resolve a concern, you may contact the privacy regulator with jurisdiction over the matter. This does not limit any other privacy rights or remedies you have.

We will update this page when our practices change and show the revised date at the top. Where a change requires a new notice or consent, we will provide it. Related purchasing and refund conditions are in our Terms of Service.