Privacy & Data Security Policy

Crow Wing Heritage Co. ("we," "us," or "our") respects your personal privacy and is deeply committed to protecting the confidential information you share with us. This Privacy Policy discloses our operational practices regarding the collection, use, maintenance, tokenization, and disclosure of information gathered through crowwingheritage.shop and our associated direct-to-consumer services.

1. Information We Collect

When you browse, interact with, or make a purchase from our store, we collect several categories of information:

• Personal Identifiers: Name, shipping address, billing address, email address, phone number, and account credentials.
• Commercial & Order Information: Purchase history, order totals, items placed in your shopping bag, tailoring/sizing preferences, and correspondence with our workshop.
• Device & Usage Data: IP address, browser type, operating system, referring URLs, timestamps, and interaction logs collected via essential session cookies.

2. Payment Card Security & Stripe Processing Disclosures

We prioritize world-class financial security. Crow Wing Heritage NEVER stores, processes, or retains raw credit or debit card numbers, expiration dates, or CVV/CVC security codes on our local servers.

All payment transactions are handled exclusively through our certified Level 1 PCI-DSS compliant payment gateway, Stripe, Inc. (510 Townsend Street, San Francisco, CA 94103). When you input payment details at checkout:

• Your payment data is directly transmitted from your browser to Stripe via an encrypted Transport Layer Security (TLS 1.3 / 256-bit SSL) channel.
• Stripe generates an encrypted alphanumeric token representing your payment authorization. Our store only receives this secure token and confirmation of payment approval.
• Stripe Radar utilizes machine-learning fraud detection algorithms to evaluate transaction risk, prevent chargebacks, and protect your identity.
• For more details on Stripe’s rigorous data protection, visit Stripe Privacy Policy.

3. Purpose & Legal Grounds For Data Use

We process your personal information for lawful and transparent business purposes:

• Order Fulfillment: Cutting fabric, packing garments, generating shipping labels, tracking packages with carriers (USPS, UPS, FedEx), and sending email receipts.
• Customer Concierge: Answering inquiries regarding denim break-in, size exchanges, bespoke hemlines, and lifetime warranty repairs.
• Fraud Prevention: Verifying order authenticity and preventing fraudulent or unauthorized transactions.
• Marketing (With Consent): Dispatching our periodic newsletter containing new shuttle loom drop alerts (you may unsubscribe at any moment).

4. Third-Party Disclosures & Service Providers

Crow Wing Heritage does NOT sell, rent, or trade your personal information to third-party data brokers or marketing aggregators.

We share necessary data solely with trusted infrastructure service providers strictly to execute our services:

• Payment Processors: Stripe Inc. for payment clearance.
• Logistics & Fulfillment: United States Postal Service (USPS), United Parcel Service (UPS), and DHL Express for delivery.
• Communication Platforms: Encrypted transactional email servers for order confirmations and tracking updates.

5. California Privacy Rights (CCPA / CPRA Notice)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have specific statutory rights:

• Right to Know & Access: Request disclosure of the specific pieces of personal information collected about you over the past 12 months.
• Right to Delete: Request deletion of personal data collected, subject to legal record-retention requirements for tax and accounting.
• Right to Opt-Out: We do not sell your personal information. You have the right to request confirmation of non-sale.
• Non-Discrimination: We will never deny goods, charge differing prices, or provide a lower quality of service for exercising your privacy rights.

To exercise any of these rights, email us at info@crowwingheritage.shop with the subject line "CCPA Rights Request".

6. Cookies & Tracking Technologies

Our website uses minimal, functional cookies necessary for shopping cart persistence, session authorization, and security. We do not employ intrusive cross-site tracking beacons. You may configure your browser to reject cookies; however, cart drawer functionality may be impacted.

7. Data Retention & Physical Safeguards

We maintain industry-standard physical, electronic, and administrative safeguards. Personal information associated with completed orders is retained only as long as necessary to satisfy legal, tax, warranty, and accounting obligations under Minnesota and US federal laws.

8. Contact Our Data Protection Officer

For inquiries regarding our privacy standards, Stripe integration, or data handling practices: