Privacy Policy

What We Collect

When you create an account: your name and email address. When you place an order: your shipping name and address. If you sign in with a wallet: your public Ethereum wallet address. We do not collect payment card details — those are handled directly by Stripe.

Information We Collect Automatically

When you visit the site, our servers automatically record standard log information sent by your browser, such as your IP address, browser type and version, the pages you view, and the date and time of your visit. We use this strictly to operate and protect the site — for example, to keep you signed in, prevent fraud and abuse, apply rate limits, and diagnose technical problems. We do not build advertising profiles from it.

How We Use It

We use your information to fulfill orders, send order confirmations and shipping updates, and respond to support requests. We do not use your information for advertising or sell it to third parties.

Third-Party Services

Stripe — payment processing. Your card details go directly to Stripe and are never stored by us. Stripe is PCI-DSS compliant.

Shippo — shipping labels and tracking. Your shipping name and address are shared to generate a label and track delivery.

Resend — transactional email. Your email address is passed to Resend solely to deliver order-related emails.

Printful — print-on-demand production. If you order merchandise, your shipping name and address are passed to Printful so they can produce and ship that item to you.

Sentry — error monitoring. When something breaks, technical diagnostic data is sent to Sentry, which can include your IP address and the page you were on. It is used only to find and fix faults.

Backblaze B2 — encrypted offsite backup. Our database backups, which contain order records, are encrypted before they leave our server and stored with Backblaze.

Free Market Protocol — decentralized identity and record layer. If you create an Auth-Key account, your wallet address is recorded on the protocol. When an order is recorded, what is written on-chain is limited to wallet addresses, the amount and currency, an order reference, and a cryptographic hash of the order — a one-way fingerprint. Your name, email address, and shipping address are never written on-chain, and a guest order records no buyer identity at all. On-chain records are inherently public and permanent by design.

Data Security

Card payments are handled entirely by Stripe and never touch our servers. If you sign in with email, we generate a custodial wallet for you whose private key is encrypted at rest with AES-256. We restrict access to personal data to what is needed to operate the store. No system is perfectly secure, but we take reasonable measures to protect your information.

Data Retention

We keep order and payment records for seven years to meet tax and accounting obligations. Account details are kept while your account is open, and web/security logs for about 90 days. You may request deletion of your account data at any time by emailing us; we will delete what we are not legally required to keep. On-chain records cannot be deleted by their nature — see the Free Market Protocol note above for the narrow set of data that reaches them.

Cookies

We use a session cookie to keep you signed in and to maintain your shopping cart. We do not use tracking or advertising cookies.

Children's Privacy

This site is intended for adults. We do not knowingly collect personal information from children under 13. If you are between 13 and 18, you may use the site only with the involvement of a parent or guardian. If we learn that we have collected information from a child under 13, we will delete it. Parents who believe their child has provided us information may contact us at the address below.

Your Privacy Rights

Member rewards. Our rewards programme is tied to your account and your purchase history, so taking part means we associate orders with you in order to work out what you have earned. Rewards have no cash value and you are free not to take part; declining does not change the price you pay or the service you receive.

You may request a copy of the personal data we hold about you, or ask us to correct or delete it, by contacting us at the address below. We'll respond within 30 days.

California residents (CCPA/CPRA) — you have the right to know what personal information we collect, to request a copy of it, to request its deletion, to correct it, and to not be discriminated against for exercising these rights. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We honour a Global Privacy Control signal where your browser sends one. To make a request, email us and we will verify and respond as required by law.

Changes to This Policy

We may update this policy from time to time. The current version will always be posted at this URL with the date above. Continued use of the site after changes constitutes acceptance.

Contact

hello@harlequinsmarket.com
We typically respond within one business day.