What we collect, what we don't

Who we are

“Stitched Memory,” “we,” “us,” and “our” refer to the Stitched Memory keepsake studio operating at 117 Emerald Cove Dr, Woodstock, GA 30189. Questions about this policy can be sent to katie@stitchedmemory.com.

What we collect

We collect only what we need to make and ship your keepsake and answer your questions:

• Order information — name, email, shipping address, the keepsake you ordered, and any notes you add at checkout.
• Payment information — handled entirely by Stripe. We never see or store your card number, expiration date, or CVC. Stripe gives us back a payment confirmation and the last four digits for our records.
• Email subscriptions — if you sign up for the newsletter, we store the email you provided. You can unsubscribe at any time using the link in any email we send you.
• Site usage — standard web analytics: pages viewed, approximate location (city/region from IP), browser, device, referring source. We use this to understand which pages help and which don't.

How we use it

• To make and ship your keepsake — generating shipping labels and sending order updates.
• To reply when you write us, and to send the transactional emails (order confirmation, label, status updates).
• To send marketing emails only if you've subscribed. Order confirmations and status updates aren't marketing — they go out regardless.
• To improve the site — measuring which pages help customers and which don't.
• To prevent abuse — spam filtering, fraud screening, and basic security logging.

Service providers we share with

We do not sell your personal information. We share what's necessary with the following providers, who are bound to use your information only to provide their service to us:

• Stripe — payment processing.
• EasyPost / USPS — generating prepaid inbound and outbound shipping labels.
• Supabase — database and authentication.
• Vercel — website hosting and basic visitor analytics.
• Resend — transactional email delivery (order confirmations and status updates).
• Klaviyo — newsletter and marketing email delivery (only if you've subscribed).
• Google Analytics & Google Ads — site analytics and ad measurement.
• Meta (Facebook/Instagram) — ad measurement via the Meta Pixel.

We may also disclose information when required by law (e.g. a valid subpoena) or when necessary to protect the safety, rights, or property of Stitched Memory or our customers.

Cookies and tracking

The site uses cookies and similar technologies mainly to measure traffic so we can understand which pages help, plus a few functional cookies that keep the site working as you move between pages. Analytics cookies come from Google Analytics, Vercel Analytics, and the Meta Pixel. You can disable cookies in your browser settings at any time.

How long we keep things

• Orders and shipping records — kept for at least 7 years to satisfy tax and accounting requirements.
• Newsletter subscribers — kept until you unsubscribe.
• Site analytics — aggregated reports kept indefinitely; individual session data follows the providers' default retention windows (typically 14–26 months).

Your rights

Wherever you live, you can email katie@stitchedmemory.com and ask us to:

• Show you what personal information we hold about you.
• Correct anything that's wrong.
• Delete the personal information we hold about you, where we're not required to keep it.
• Stop sending you marketing email (or click “unsubscribe” in any email).

If you live in California, the EU/UK, or another jurisdiction with specific privacy rights, you have those rights too — the same email gets you to the same person. We do not sell your personal information, so there is nothing to opt out of on that front.

Children

The site is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us information without a parent's involvement, email us and we'll investigate and remove it.

Security

The site is served over HTTPS. Order and customer data are stored in Supabase with row-level security policies that restrict access. Payment information never reaches our servers — it's submitted directly to Stripe. No system is perfectly secure; if we ever discover a breach affecting your data, we will notify you and the appropriate authorities as required by law.

Changes to this policy

If we change this policy in a meaningful way, we'll update the effective date at the top and, for significant changes, email subscribers. Continued use of the site after a change means you accept the updated policy.