Privacy policy

Short version: we collect what we need to make and post your order, we use cookieless analytics that can't identify you, and we don't sell your data to anybody. Ever.

Who we are

This shop is run by Noodlebots LLC, doing business as Threads by Mimi, at threadsbymimi.com. We're the data controller for the information described here.

TODO: registered LLC address, and a privacy contact if different.

What we collect

When you order

Checkout happens on Square's secure hosted page, not on our site. Square collects your name, email, delivery address and payment details, and shares the order and contact details with us so we can make and post your parcel. We never see your full card number — no card data ever touches our code.

When you contact us

Our contact form collects your name, email, subject and message, so we can reply. That's it.

When you browse

We use Plausible Analytics, which is cookieless and privacy-focused. It reports aggregate numbers — page views, referrers, rough country — and does not set cookies, fingerprint you, or collect anything that identifies you personally. Our host, Cloudflare, also keeps short-lived technical logs for security and abuse prevention.

How we use it

• To make, pack and post your order, and to email you about it.
• To answer a message you've sent us.
• To understand, in aggregate, which pages people find useful.
• To meet our tax and record-keeping obligations.

We do not sell or rent your personal information, and we don't run advertising trackers. We only email you about an order you placed or a message you sent — there's no marketing list at launch.

Who else sees it

• Square — payments, checkout, order and receipt emails.
• Cloudflare — hosting, delivery and security for this site.
• Plausible Analytics — aggregate, cookieless traffic statistics.
• USPS — the delivery address, so your parcel can reach you.
• TODO: add the email provider that will deliver contact-form messages once chosen.

Each handles your data under its own privacy policy. We share data with them only so they can perform these services for us.

Cookies

We use strictly necessary cookies only — the ones Square needs to run a secure checkout. Our analytics are cookieless, so there's no consent banner to click through. Your bag is stored in your own browser's local storage, on your device, and is never sent to us until you check out.

If we ever add a marketing or advertising tracker, we'll add a proper consent banner and update this page first.

How long we keep it

Order records are kept as long as we need them for accounting and tax purposes TODO: confirm retention period with your accountant. Contact-form messages are kept while we're helping you and deleted once the conversation is clearly finished. Aggregate analytics contain no personal data and are kept indefinitely.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or get a copy of the personal information we hold about you, and to object to certain uses of it. Residents of California and several other US states also have the right to opt out of the "sale" or "sharing" of personal information — we don't do either, so there's nothing to opt out of, but you're welcome to ask us to confirm that.

To exercise any of these, contact us and we'll respond within the time your state's law allows. We won't treat you differently for asking.

TODO: professional review of state-specific rights wording.

Children

This shop isn't directed at children, and we don't knowingly collect personal information from anyone under 13. If you believe a child has given us their details, tell us and we'll delete them.

Changes to this policy

If we change how we handle your data, we'll update this page and move the "last updated" date at the top. Material changes will be called out clearly.