Privacy Policy

T-Shirt Cravers, LLC collects and uses information needed to operate our apparel store, fulfill orders, provide customer support, and send marketing messages when you ask to receive them.

Orders currently placed through Etsy are processed under Etsy's systems and policies. We are also preparing a WooCommerce storefront on our own server. When that storefront is available, it may store customer and order records on systems controlled by or operated for T-Shirt Cravers, LLC.

Printify prints and ships our made-to-order products. Mailchimp manages our marketing email list. Payment card details are handled by the applicable storefront or payment processor and are not received or stored by T-Shirt Cravers, LLC.

We do not sell personal information or share personal information for cross-context behavioral advertising. You may contact us at any time with privacy questions or requests.

Governing law: This Privacy Policy is governed by the laws of the State of New York.

This Privacy Policy explains how T-Shirt Cravers, LLC collects, uses, discloses, and protects personal information through:

• www.tshirtcravers.com;
• our Etsy storefront; and
• our WooCommerce storefront when it becomes available.

For data protection purposes, T-Shirt Cravers, LLC, a New York State company, with its registered/business mailing address at 400 Rella Blvd., Suite 207 #954, Montebello, NY 10901, generally acts as the controller or business responsible for personal information that we collect and use for our own business purposes.

Privacy Contact

We have not appointed a separate statutory Data Protection Officer at this time. For privacy matters, please contact us using the privacy email address above. We will route your request to the appropriate privacy contact.

Etsy, payment processors, Printify, Mailchimp, our hosting provider, and other providers may act as separate controllers or processors for the information they handle. Their own privacy notices may also apply.

This Policy applies to personal information collected through our website, storefronts, email communications, customer-support interactions, and related business activities.

It does not replace the privacy policies of third-party services. When you shop through Etsy, for example, Etsy's privacy policy also applies to Etsy's collection and use of your information.

"Personal information" or "personal data" means information that identifies, relates to, describes, or could reasonably be linked with an identifiable person. Information that has been irreversibly anonymized is not personal information for purposes of this Policy.

The categories of information we collect depend on how you interact with us.

We do not intentionally request or collect unnecessary sensitive personal information. Please do not send us payment-card numbers, passwords, government identification numbers, health information, or other sensitive information by email.

3.1 Information We Do Not Store Directly

Payment card numbers and full payment credentials are processed by the applicable storefront and/or payment processor. They are not received or stored by T-Shirt Cravers, LLC.

Our marketing website does not create customer accounts by itself. Etsy maintains accounts and transaction information within Etsy's systems. When the WooCommerce storefront is active, WooCommerce may store customer records, order history, billing information, and shipping addresses on our systems or on systems operated by our hosting provider.

We use personal information to:

1. operate, maintain, secure, and improve our website and storefronts;
2. process and administer orders;
3. coordinate printing, fulfillment, and shipping through Printify;
4. provide order confirmations, shipping updates, customer support, and other transactional communications;
5. process returns, replacements, refunds, and order-related inquiries;
6. maintain business, accounting, tax, fraud-prevention, and transaction records;
7. manage our email list and send marketing messages when you have requested or otherwise authorized them;
8. measure email performance and improve our products, website, and customer experience;
9. detect, prevent, investigate, and address fraud, abuse, security incidents, and unlawful activity;
10. comply with legal obligations and respond to lawful requests;
11. establish, exercise, or defend legal claims; and
12. enforce our terms, policies, and agreements.

We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects.

Where the EU General Data Protection Regulation ("GDPR") or UK GDPR applies, we rely on the following legal bases:

When we rely on consent, you may withdraw your consent at any time. Withdrawal does not affect processing that occurred before withdrawal or processing based on another lawful basis.

We use third-party services to operate our business. These providers may receive personal information necessary to perform their services. Depending on the circumstances and applicable law, a provider may act as our processor, service provider, contractor, or an independent controller.

Relevant services include:

• Etsy: Our currently active storefront and marketplace. Etsy processes account, order, payment, shipping, device, and other information under its own policies. See Etsy's Privacy Policy (https://www.etsy.com/legal/privacy/).
• WooCommerce and WordPress: We are preparing a WooCommerce storefront on our own server. WooCommerce and WordPress software may support customer, order, checkout, and website functions. See WooCommerce's Privacy Policy (https://woocommerce.com/privacy-policy/) and, where applicable, Automattic's Privacy Policy (https://automattic.com/privacy/). The privacy practices of our self-hosted WordPress installation also depend on our hosting configuration and installed plugins.
• Printify: Printify receives order and shipping information needed to produce and ship made-to-order products. See Printify's Privacy Policy (https://printify.com/privacy-policy/).
• Mailchimp: Mailchimp manages our marketing email list, sends email messages, records subscription and unsubscribe preferences, and may provide campaign-performance information. See Mailchimp's Privacy Policy (https://mailchimp.com/legal/privacy/).
• Payment processors: Payments for Etsy orders are handled through Etsy and its payment systems. Payments for the WooCommerce storefront will be handled by the processor configured for that storefront, such as Stripe (https://stripe.com/privacy) or PayPal (https://www.paypal.com/us/legalhub/paypal/privacy-full?locale.x=en_us), if used. The applicable processor's policy applies to its processing.
• Vercel: Our website is hosted and served by Vercel (privacy policy: https://vercel.com/legal/privacy-policy), including the code that handles our email signup pop-up. Vercel processes visitor IP addresses and server request logs, and processes email addresses submitted through the signup pop-up on our behalf before passing them to Mailchimp.
• Web hosting provider: Our domain, our WordPress installation and, when active, our WooCommerce storefront are hosted by SiteGround, contracted through SG Hosting Inc. (privacy policy: https://www.siteground.co.uk/viewtos/privacy_policy).
• Analytics provider: Cloudflare Web Analytics, which is cookieless and privacy-first. It does not use cookies, local storage or fingerprinting, does not track individual users, and collects only aggregate, non-identifying traffic statistics (such as page views, referrers and country). Privacy policy: https://www.cloudflare.com/privacypolicy
• Professional advisers and business providers: We may disclose information to legal, accounting, tax, insurance, security, information-technology, and other professional service providers when reasonably necessary for business operations.
• Authorities and legal recipients: We may disclose information when required by law, subpoena, court order, governmental request, or to protect rights, safety, security, or property.

We require service providers to use personal information only for authorized business purposes and to apply appropriate confidentiality and security obligations where required by law.

We do not sell personal information for monetary or other valuable consideration.

We do not share personal information for cross-context behavioral advertising or targeted advertising based on activity across unrelated businesses.

We may disclose information to service providers and processors, such as Etsy, Printify, Mailchimp, payment processors, and hosting providers, when necessary to provide services or operate our business. These disclosures are not sales or sharing for cross-context behavioral advertising.

Because we do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, there is no sale or sharing to opt out of at this time. We will update this Policy and provide any legally required opt-out mechanism if our practices change.

Cookies are small files placed on your device. Our website uses only strictly necessary cookies and similar technologies that are required for the site to function and to keep it secure (for example, load balancing, security protections, and basic website functionality).

We do not use cookies for advertising or marketing, and we do not use cookies for analytics because Cloudflare Web Analytics is cookieless.

You may delete or block cookies through your browser settings. Blocking strictly necessary cookies may affect website functionality and some parts of the site may not work correctly.

8.2 Do Not Track and Global Privacy Control

Some browsers offer a "Do Not Track" signal. Because there is no consistent industry standard for responding to that signal, our website may not respond to all Do Not Track settings.

We do not sell or share personal information for cross-context behavioral advertising. If our website receives a legally recognized Global Privacy Control ("GPC") signal, we will treat it as a request to opt out of sale or sharing to the extent required by applicable law.

If you subscribe to our email list, we may send product news, promotions, collection announcements, and other marketing messages.

Every marketing email includes an unsubscribe link. You may unsubscribe at any time by selecting that link or by contacting info@tshirtcravers.com.

Unsubscribing from marketing emails does not stop transactional or service communications, including order confirmations, shipping updates, refund notices, fraud alerts, or important account or policy notices.

We may retain your email address on a suppression list after you unsubscribe so that we can honor your request and avoid sending you unwanted marketing messages.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including legal, accounting, tax, security, dispute-resolution, and recordkeeping requirements.

Our ordinary retention periods are:

We may retain information for longer when required by law, necessary to establish or defend legal claims, or reasonably necessary to prevent fraud or repeated unwanted marketing.

T-Shirt Cravers, LLC is based in the United States. Our service providers, including Etsy, Printify, Mailchimp, payment processors, hosting providers, and analytics providers, may process personal information in the United States or other countries outside your country of residence.

When applicable law requires safeguards for an international transfer, we seek to use appropriate safeguards, which may include contractual protections, adequacy decisions, standard contractual clauses, or another legally recognized transfer mechanism.

Our website and store are directed to a general audience and are not directed to children under 13. We do not knowingly collect personal information from children under 13.

If you believe a child under 13 has provided personal information to us, please contact info@tshirtcravers.com. We will take reasonable steps to investigate and delete the information when required.

If we learn that we have collected personal information from a child under 13 in circumstances requiring verifiable parental consent under the Children's Online Privacy Protection Act ("COPPA"), we will take appropriate steps to obtain consent or delete the information as required by law.

Privacy rights vary by location and may be subject to legal exceptions, identity verification, and other limitations.

14.1 European Union and United Kingdom Rights

If the GDPR or UK GDPR applies to our processing of your personal information, you may have the right to:

• Access your personal information and receive related information about its processing;
• Rectify inaccurate or incomplete personal information;
• Erase personal information in certain circumstances;
• Restrict processing in certain circumstances;
• Receive or port certain personal information in a structured, commonly used, machine-readable format;
• Object to processing based on legitimate interests and to direct marketing;
• Withdraw consent at any time when processing is based on consent; and
• Lodge a complaint with a data protection supervisory authority.

You may contact the supervisory authority in the country where you live, work, or believe an infringement occurred. UK residents may contact the UK Information Commissioner's Office (https://ico.org.uk/make-a-complaint/). EU residents may contact their local data protection authority through the European Data Protection Board (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en).

The right to object to direct marketing is absolute. Other rights may be limited by applicable law, including where we must retain information to comply with a legal obligation or establish, exercise, or defend legal claims.

14.2 California Rights Under the CCPA and CPRA

Subject to applicable thresholds and exceptions, California residents may have the right to:

• Know the categories and specific pieces of personal information collected, the sources of that information, the purposes for collection or use, and the categories of recipients to whom it is disclosed;
• Delete personal information, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information;
• Limit the use and disclosure of sensitive personal information in circumstances covered by California law;
• Receive equal treatment and service without unlawful discrimination or retaliation for exercising privacy rights; and
• Use an authorized agent to submit a request on the consumer's behalf.

We do not sell or share personal information for cross-context behavioral advertising. We also do not use or disclose sensitive personal information for purposes requiring a "Limit the Use and Disclosure of Sensitive Personal Information" option beyond what is reasonably necessary to provide the products and services you request, operate the business, maintain security, or comply with law.

We will not discriminate against you for exercising rights under the CCPA or CPRA. We will not deny goods or services, charge different prices, provide a different level or quality of service, or suggest that you will receive such treatment because you exercised a privacy right, except where a legally permitted financial incentive applies and its terms are disclosed.

14.3 California Shine the Light Notice

California Civil Code §1798.83, commonly known as the "Shine the Light" law, permits California residents to request information about certain disclosures of personal information to third parties for those third parties' direct-marketing purposes.

We do not currently disclose personal information to third parties for their own direct-marketing purposes. If you have questions about our practices or wish to make a request, contact info@tshirtcravers.com.

Privacy rights requests may be submitted by email or by mail to the address listed below.

To submit a privacy request, email:

info@tshirtcravers.com

You may also contact customer support at support@tshirtcravers.com, which will forward privacy requests to the appropriate contact.

For written requests, you may write to:

T-Shirt Cravers, LLC
Attn: Privacy Request
400 Rella Blvd., Suite 207 #954
Montebello, NY 10901

Please state:

1. your name and contact information;
2. the nature of your request;
3. the email address, order number, or other information reasonably needed to locate your records; and
4. your preferred method of response.

Do not send passwords, full payment-card numbers, Social Security numbers, or other unnecessary sensitive information with your request.

15.1 Verification

To protect personal information, we may need to verify your identity before completing an access, deletion, correction, or similar request. Verification may include confirming information already associated with your account or transaction, such as your name, email address, order number, shipping address, or recent order details.

We will request only information reasonably necessary for verification. We will not require you to create an account to submit a request.

If we cannot reasonably verify your identity, we may deny the request or limit the information we provide, as permitted by law. We may retain information about the request and its verification to document compliance and prevent fraud.

15.2 Authorized Agents

California residents may designate an authorized agent to submit a request on their behalf.

An authorized agent must provide:

• proof that the consumer authorized the agent to act;
• information reasonably necessary to verify the consumer's identity; and
• information reasonably necessary to verify the agent's identity.

Where permitted by law, we may require the consumer to confirm directly that the agent is authorized. A power of attorney may be accepted where required by applicable law.

15.3 Response Times

For GDPR or UK GDPR requests, we generally respond within one month. If a request is complex or we receive multiple requests, we may extend the response period by up to two additional months where permitted. We will tell you within the initial one-month period if an extension is needed and explain why.

For California requests to know, delete, or correct, we generally acknowledge the request within 10 business days and respond within 45 calendar days. Where permitted by law, we may extend the response period by an additional 45 calendar days after notifying you of the reason for the extension.

Requests to opt out of sale or sharing will be processed as soon as reasonably practicable and within the time required by applicable law. We do not require verification for an opt-out request unless reasonably necessary to prevent fraud or comply with law.

If we deny a request, we will explain the reason to the extent required by law and describe any available appeal or complaint options.

Our website may contain links to third-party websites, marketplaces, payment services, social-media platforms, or other services. We are not responsible for the privacy, security, content, or practices of third parties.

Before providing information to a third party, review that party's privacy policy and terms. Your use of Etsy, payment processors, Mailchimp, or other third-party services may be governed by their own agreements.

We may update this Privacy Policy when our services, technology, legal obligations, or data practices change.

When we make changes, we will post the revised Policy on this page and update the "Last updated" date. If a change is material, we may also provide additional notice, such as a website notice or email, where required by law.

Your continued use of the website after an updated Policy is posted means that you have received notice of the updated Policy. Where consent is legally required for a new use of personal information, we will request consent before making that use.