Privacy Policy

TraceAndTale (“we,” “us,” “our”) respects your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and your rights regarding it. It applies to the TraceAndTale website at traceandtale.com and all associated services (the “Service”).

We are committed to data minimization — we collect only what is necessary to deliver the Service. We do not sell your personal information. Ever.

Information you provide directly:

• Email address (when creating an organizer account)
• Your name (when creating an account or submitting a drawing)
• Shipping address (entered at checkout for product delivery)
• Payment information — processed by Stripe; we do not store card numbers or CVVs
• Drawing content submitted by contributors
• Optional personal messages attached to drawings
• Communications you send us (email, support requests)

Information collected automatically:

• IP address and approximate geographic location (country/region)
• Browser type, version, and operating system
• Pages visited and time spent on the Service
• Referring URL
• Authentication session tokens (stored in secure cookies via Supabase Auth)

Information we do not collect:

• Social security numbers or government-issued ID
• Health or biometric data
• Precise location (GPS)
• Content of private communications not sent to us directly

• To create and manage your account and campaigns
• To enable contributors to submit drawings via token links
• To assemble the artwork and fulfill your print order (production and shipping)
• To process payments via Stripe and manage billing records
• To send transactional communications: campaign updates, order confirmations, delivery notifications
• To send marketing emails about our products and promotions (you may unsubscribe at any time)
• To detect, investigate, and prevent fraud, abuse, and security incidents
• To comply with applicable legal obligations and respond to legal process
• To improve the Service through aggregated, anonymized analytics

We do not sell, rent, or trade your personal information with third parties for their marketing purposes. We share information only as described below:

Service providers (data processors):

• Supabase — database hosting and authentication (United States)
• Stripe — payment processing (United States; Stripe is PCI DSS Level 1 certified)
• Gelato — print-on-demand fulfillment; receives shipping address and assembled artwork (global network)
• Resend — transactional email delivery (United States)

Each service provider is bound by contractual obligations to process your data only as instructed by us and to protect it with appropriate security measures.

Legal disclosures: We may disclose your information if required by applicable law, court order, or government authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of TraceAndTale, our users, or the public.

Business transfers: If TraceAndTale is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

We use only essential cookies required to operate the Service. Specifically:

• Authentication cookies: set by Supabase Auth to maintain your login session (secure, HTTP-only)
• Session tokens: short-lived tokens provided to contributors via unique campaign links

We do not use advertising cookies, third-party tracking pixels, or behavioral profiling tools. We do not participate in ad networks or retargeting programs.

Essential cookies cannot be opted out of without disabling the Service entirely. All other cookies require your consent, which we do not currently request because we do not use them.

• Account data: retained while your account is active and for 90 days after deletion request
• Campaign data and drawings: retained for 2 years after campaign completion, then permanently deleted
• Payment records: retained for 7 years to comply with financial record-keeping requirements
• Audit logs and security records: retained for 2 years
• Marketing opt-out records: retained indefinitely to honor your preference

You may request deletion of your account and associated data at any time (see Section 8). Some data may be retained longer where required by law.

We implement industry-standard security measures including HTTPS encryption for all data in transit, encrypted database storage, and strict access controls limiting which personnel can access your data. Payment data is handled exclusively by Stripe and never stored on our servers.

No system is completely secure. We cannot guarantee that unauthorized third parties will never be able to defeat our security measures. If we become aware of a security breach that materially affects your data, we will notify you as required by applicable law.

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected information from a child under 13, we will delete it promptly. If you believe a child under 13 has used the Service, please contact us at hello@traceandtale.com.

Contributors accessing the Service through a campaign link must be at least 13 years of age. Organizers are responsible for ensuring that the campaign links they share are not provided to children under 13.

Depending on your location, you may have the following rights regarding your personal information:

• Access: request a copy of the personal data we hold about you
• Correction: request correction of inaccurate or incomplete data
• Deletion: request deletion of your personal data (subject to legal retention requirements)
• Portability: receive your data in a structured, machine-readable format
• Objection: object to certain uses of your data, including marketing
• Opt-out of marketing: unsubscribe from marketing emails at any time via the link in each email

California residents (CCPA / CPRA): You have the right to know what categories of personal information we collect and how they are used, the right to delete your personal information (with exceptions), the right to correct inaccurate information, and the right to opt out of the sale or sharing of your personal information. We do not sell or share personal information for cross-context behavioral advertising. You have the right to non-discrimination for exercising these rights.

To exercise any of these rights, email hello@traceandtale.com with the subject line “Privacy Request” and describe your request. We will respond within 30 days. We may need to verify your identity before fulfilling your request.

TraceAndTale is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to this transfer.

For users in the European Economic Area (EEA) or United Kingdom, we rely on the following legal bases for processing: performance of a contract (order fulfillment), legitimate interests (fraud prevention, service improvement), and consent (marketing communications).

We may update this Privacy Policy from time to time. We will notify you of material changes by sending an email to the address associated with your account at least 30 days before the changes take effect. For non-material changes, we will post the updated policy with a revised “Last updated” date.

Continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

For privacy questions, requests, or concerns, contact us at hello@traceandtale.com with the subject line “Privacy Request.” We aim to respond within 30 days.