Privacy Policy
This page applies to every piece of personal data that prettypettymerch.com receives from you, whether you place an order, write to support or only browse, and it names each company that handles that data for the store.
Whenever another company handles data on the store’s behalf
Service provider: a company that handles personal data only to do a job for PrettyPettyMerch, under a contract that stops it from using the data for anything else. Five do:
| Provider | What it receives | Its job |
|---|---|---|
| Our partner in China | Name, delivery address, phone number, the bags ordered | Packing, labeling and dispatching the package |
| The carriers | Name, delivery address, phone number | Moving and delivering the package |
| Stripe, through the MeshCheckout gateway | Card number, expiry date, security code, billing address | Processing a card payment |
| PayPal | Your PayPal account, billing address, the amount | Processing a PayPal payment |
| Brevo (Sendinblue SAS) | Email address, the content of order emails | Sending order and support emails |
The hosting company and Cloudflare, the network that fronts the site, see the technical data of each visit while keeping the site online and blocking attacks. Google receives the product catalog for Shopping listings, which holds prices and photos and no personal data.
If a court or an agency asks
Disclosure: handing data to someone outside the list above. It happens in three cases only: when a court order, subpoena or lawful request from a government body requires it; when the data is needed to stop fraud or defend a legal claim; and when the business is sold, in which case the buyer takes over this policy. No advertiser, data broker or marketing company receives anything.
Whenever your data crosses a border
International transfer: data leaving the United States. Your name, delivery address, phone number and order contents go to the partner in China so that the package can be packed and labeled, and order emails are sent through Brevo, a French company that can process data inside the European Union. Both are bound by contract to use the data for their job alone. The store itself is run from Illinois.
Whenever something is typed into this site
Data you give: your name, email address, phone number, delivery address and billing address at checkout, the bags you choose, and whatever you write or attach in a message to support, including return photos. The site has no customer accounts, so nothing is stored that could be called a password. Checkout works as a guest every time.
Whenever a page loads
Data collected automatically: your IP address, the browser and device you use, which pages you open and at what time, recorded in the server’s log, plus the WooCommerce cookies that remember your cart. No advertising tag, no analytics script and no social media plugin loads on this site.
Once a payment or a delivery is processed
Data received from others: the result of a payment from Stripe or PayPal, limited to approved or declined, the brand of card and its final four digits; and the scan events for your package from the carrier. The full card number never arrives here.
Whenever a piece of data is put to use
Purpose: the reason a piece of data is used. The list is short: taking payment, packing and delivering the bags, sending the emails that belong to an order, answering your messages, handling returns and refunds, stopping fraud and keeping the records that tax and accounting law require. Your data is not used to build a profile of you, to send marketing you did not ask for or to decide a price.
If anyone asks whether data is sold
Sale of personal data: handing data to another business for payment or for any other benefit. PrettyPettyMerch does not do it, and does not share data for cross-context behavioral advertising either. The list of third parties to whom personal data has been sold in the past 12 months is empty. The steps that record an opt-out anyway sit behind the Do Not Sell or Share My Personal Information link in the footer.
If artificial intelligence comes up
Model training: feeding data to a system that learns from it. No order, email, photo or address is handed to any company to train a large language model or any other machine learning system, and none is used by the store to train one.
Until the retention period ends
Retention period: how long a record is kept. Six years for anything tied to an order or a payment, which is what the tax code expects. Support email is kept 12 months after the last message in the thread. Server logs are kept 14 days. When a period ends the record is erased or cut down to a form from which no person can be picked out.
Whenever data sits on a server
Safeguard: a measure that keeps data from being read or changed by the wrong people. Every page of the site loads over HTTPS. Stripe or PayPal receives the card data directly; no PrettyPettyMerch server ever holds it. Order data can be opened only by the support staff who answer email and by the partner’s packing staff, each with their own login. No measure is perfect, and the store does not claim that one is.
If a cookie banner is expected
Cookie: a small file a site stores in your browser. The cookies here keep the shop working: WooCommerce sets the ones that remember your cart and carry checkout from step to step, the payment fields set the ones Stripe and PayPal use to detect fraud, and Cloudflare can set a security cookie to tell a visitor from a bot. None of them tracks you across other sites. Block cookies in your browser settings and the site still loads, but the cart empties between pages.
Unless you type it in yourself
Sensitive personal data: health information, biometric data, precise location, dates of birth, Social Security and driver’s license numbers, racial or ethnic origin, religious beliefs and the contents of private messages. Checkout asks for none of it. Do not type any of it into the contact form.
If data has to be seen, fixed or erased
Privacy request: an email to support asking for a look at your data, a correction, an erasure or a copy in a portable file. Four steps:
- Write to contact@prettypettymerch.com from your checkout email address; the subject is Privacy request.
- Say which of the four rights you are using.
- Support confirms the request within 2 business days.
- The answer arrives within 45 days. If more time is needed, support says so within those 45 days and takes at most 45 more.
There is no fee. The email address and the confirmation number are matched to confirm identity; no ID document is requested. Someone you have authorized in writing may send the request for you. A record that the law requires the store to keep, such as a tax record, is held until its period ends even after a deletion request.
If you live in California
California Consumer Privacy Act: the California law, in the shape the California Privacy Rights Act gave it, that gives California residents the rights above plus the right to say no to sale and sharing, and protection against being treated differently for using any of them. Over the past 12 months the categories collected were identifiers, commercial information, internet activity and the rough location an IP address gives, used only as this page describes; none was sold or shared. An opt-out goes on file through the footer link Do Not Sell or Share My Personal Information. A request under this law gets the same 45-day answer as any other.
Whenever your state has a privacy law of its own
State privacy law: a law that gives residents of one state rights over their personal data. By 2026 such a law is in force in nineteen states, grouped here by the year each one began to apply.
- Between 2020 and 2023: California, then Virginia, Colorado, Connecticut and Utah.
- During 2024: Texas, Oregon and Montana.
- During 2025: New Jersey, New Hampshire, Nebraska, Delaware and Iowa in January, then Tennessee, Minnesota and Maryland.
- During 2026: Rhode Island, Kentucky and Indiana.
The Privacy request steps above are open to residents of all nineteen, and to residents of every other state as well.
If a request is refused
Appeal: a second look at a refused privacy request. Reply to the refusal email within 30 days and write appeal in the subject line. A different person reviews the request and answers within 45 days. If the appeal is refused as well, the answer tells you how to contact the attorney general of your state.
If you are under 13
Child: anyone under 13 years of age. The store sells adult accessories and knowingly collects no data from a child. If a parent or guardian suspects that a child has placed an order or written to support, one email to contact@prettypettymerch.com gets the data deleted within 2 business days of the request being confirmed.
If a breach ever exposes your data
Breach: an unauthorized person getting hold of personal data held for the store. You are notified by email without unreasonable delay, and in any case within 30 days of the breach being discovered, as the Illinois Personal Information Protection Act requires, and the notice says what was exposed and what to do about it. The Illinois Attorney General is notified when the law calls for it.
Once another site opens
Third-party link: a link to a carrier’s tracking page, to PayPal, to Google Maps or to any other site PrettyPettyMerch does not run. Each has its own privacy practices, and this page does not cover them.
Whenever this page is updated
Effective date: the day a version of this page starts to apply. This version applies from Oct. 16, 2026. Changes appear here under a new date; one that touches an existing order also goes by email to the address on that order.
Whenever you need a person
| Who | What they do |
|---|---|
| You | Send a Privacy request from the checkout email address |
| The five providers | Handle only the data their job needs |
| TEJA TRIPLETT FUNY LLC | Owns the data, answers requests, keeps the records |
| Support | Email contact@prettypettymerch.com, call +1 (708) 621-4769 on weekdays, 8:00 AM through 4:00 PM Central Time, or send the form on the Contact Us page; every message is answered no later than 1 business day after it arrives |