Privacy Policy

This privacy notice for Luvvo Studio ("we," "us," or "our") describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:

• Visit our website at https://luvvo.studio, or any page of ours that links to this privacy notice
• Buy a made-to-order product, back a "Back the Build" campaign, create an optional shopper account, or sign up for our newsletter
• Engage with us in other related ways — including any sales, marketing, or events

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at chris@luvvo.studio.

Summary of key points

What personal information do we process? Only what a small storefront needs: your email, your name and shipping address when you buy something that ships, optional account credentials, and an optional public display name if you choose to appear on the backer wall.

Do we process any sensitive personal information? We do not process sensitive personal information, other than the login credentials for an optional account, which we use solely to authenticate you.

Do we receive any information from third parties? No. We do not buy, receive, or enrich data about you from outside sources.

Do we sell or share your personal information? No. We have never sold or shared personal information, and we will not.

Do we use tracking cookies or advertising? No. Our analytics provider, Plausible, is cookieless and collects only aggregate, anonymous usage statistics. The only cookies we set are essential ones that keep you signed in to an optional account. There is no advertising, no cross-site tracking, and no retargeting.

How do you exercise your rights? The easiest way is via our data request page at /data-request, or by emailing us at chris@luvvo.studio. We will consider and act upon any request in accordance with applicable data protection laws.

1. What information do we collect?

Personal information you disclose to us. We collect personal information that you voluntarily provide to us when you place an order, back a campaign, register an optional account, sign up for the newsletter, or otherwise contact us. Depending on what you do, this may include:

• Email address
• Name and shipping address (collected by Stripe at checkout when your purchase or reward ships)
• Account login credentials (email and password) if you create an optional shopper account
• Saved shipping addresses you choose to store in your account
• An optional public display name, if you opt in to appear on the campaign backer wall

Payment data. We may collect data necessary to process your payment if you make a purchase or back a campaign, such as your payment instrument number and its security code. All payment data is collected and stored by Stripe; card details never touch our servers. You may find Stripe's privacy notice here: https://stripe.com/privacy.

Sensitive information. We do not process sensitive personal information, other than account login credentials used solely for authentication.

Information automatically collected. We automatically collect certain limited technical information when you visit the Services: server logs (IP address, browser type, pages requested) maintained by our hosting provider for security and operations, and error reports through our monitoring tool, from which personal details (email, address, payment data, IP) are scrubbed before storage. Our analytics (Plausible) is cookieless and aggregates page views without identifying you.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

2. How do we process your information?

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To fulfill and manage your orders and campaign rewards — payments, building your piece, shipping it, and handling returns.
• To facilitate account creation and authentication and otherwise manage optional user accounts (order history and saved shipping addresses).
• To send administrative and transactional email — order confirmations, backer confirmations, and shipping notifications with tracking.
• To send the newsletter, only if you asked for it — signup is double-opt-in and every email contains a working unsubscribe link.
• To display your backer recognition, only if you opted in — your chosen display name and tier on the public backer wall; never your email, amount, or address.
• To respond to your inquiries and offer support.
• To protect our Services — fraud monitoring, security, and error diagnosis.
• To identify aggregate usage trends — via cookieless analytics that cannot identify you.

3. What legal bases do we rely on to process your information?

We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law: with your consent (newsletter, backer wall), to perform our contract with you (orders, backing, accounts), to comply with laws, or for our legitimate interests (site security, error monitoring, aggregate analytics) where those interests do not override your rights. If you are located in the EEA or UK, these are the GDPR legal bases we rely on. You can withdraw consent at any time.

4. When and with whom do we share your personal information?

We share personal information only with the service providers that operate the store, under their respective data processing terms, and only what each needs to do its job:

• Stripe — payment processing (payment details, email, shipping address)
• Supabase — our database and authentication provider (order records, account data)
• Shippo — shipping label purchase (name and shipping address, when your item ships)
• Resend — transactional email delivery (email address and order/shipping facts)
• Vercel — website hosting (server logs)
• Sentry — error monitoring (technical error reports with personal details scrubbed)
• Plausible — cookieless, aggregate analytics (no personal information)
• Government entities — only when required by law

We may also disclose information in connection with a business transfer (merger, sale of assets), or where required by law. We do not sell or share personal information for advertising, and there are no ad networks, data brokers, or social plugins on the Services.

Backer wall. If — and only if — you opt in when backing a campaign, your chosen display name and reward tier appear on the public backer wall. Your email, contribution amount, and address are never displayed.

5. What is our stance on third-party websites?

The Services may link to third-party websites (for example, Stripe's checkout page or a carrier's tracking page). We are not responsible for the content or privacy practices of third parties. Any data collected by third parties is not covered by this privacy notice; you should review the policies of any third-party site you visit.

6. Do we use cookies and other tracking technologies?

We use only essential cookies: the session cookie that keeps you signed in to an optional shopper or admin account. We set no analytics, advertising, or tracking cookies. Our analytics provider, Plausible, is cookieless — it collects aggregate usage statistics without cookies, without persistent identifiers, and without tracking you across sites. This is why the Services do not show a cookie banner. Your cart is stored locally in your own browser (localStorage) and is not transmitted to us until you check out.

7. Is your information transferred internationally?

Our servers are located in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States by us and the service providers listed above. These countries may not have data protection laws as comprehensive as those in your country; we take the measures described in this notice to protect your personal information in accordance with applicable law.

8. How long do we keep your information?

We keep your personal information only as long as necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law (such as tax or accounting requirements). Order and contribution records are retained as required for tax and accounting purposes. Account data is kept while your account exists and deleted when you ask us to close it. Newsletter addresses are kept until you unsubscribe. When we have no ongoing legitimate business need to process your personal information, we will delete or anonymize it.

9. How do we keep your information safe?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process — including default-deny database access rules, server-only handling of secrets, and scrubbing of personal details from error reports. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security. Transmission of personal information to and from our Services is at your own risk.

10. Do we collect information from minors?

We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at chris@luvvo.studio.

11. What are your privacy rights?

Depending on where you live (for example, the EEA, UK, or certain U.S. states), you may have rights including: the right to request access to and obtain a copy of your personal information, to request correction or deletion, to restrict or object to our processing, and to data portability. You can exercise any of these via /data-request or by emailing chris@luvvo.studio. We will act on requests in accordance with applicable data protection laws and will not discriminate against you for exercising them.

Withdrawing consent: where we rely on your consent, you may withdraw it at any time (this does not affect the lawfulness of processing before withdrawal).

Newsletter: you can unsubscribe at any time using the link in every email. You may still receive service-related messages (like order confirmations) that are necessary to administer your purchase.

Account information: you can review or change your account information by logging in to your account, or contact us to terminate it. On termination we will delete your account data from our active databases, though we may retain some information as required for fraud prevention, legal compliance, or tax and accounting purposes.

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you have the right to complain to your local data protection supervisory authority.

12. California and other U.S. state privacy rights

If you are a resident of California (CCPA/CPRA), Virginia (VCDPA), or another U.S. state with a comprehensive privacy law, you have rights to know, access, correct, and delete the personal information we hold about you, and the right to opt out of the sale or sharing of personal information and of targeted advertising.

In the preceding twelve (12) months, we have collected only the categories described in Section 1 (identifiers such as name, email, and shipping address; commercial information such as purchase history; and internet activity in the form of server logs), we have disclosed them only to the service providers listed in Section 4 for business purposes, and we have not sold or shared any personal information to third parties, and will not. We do not use targeted advertising or profiling, and we do not use or disclose sensitive personal information for any purpose other than providing the Services.

California's "Shine The Light" law (Civil Code Section 1798.83) permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes; we make no such disclosures. To exercise any state privacy right, use /data-request or email chris@luvvo.studio. You may use an authorized agent, in which case we may require proof of valid authorization. If we decline a request, you may appeal by replying to our decision email, and, where applicable, contact your state Attorney General.

13. Controls for Do-Not-Track features

Most web browsers include a Do-Not-Track ("DNT") feature. No uniform technology standard for recognizing and implementing DNT signals has been finalized — but because we do not track visitors across websites in the first place, there is nothing for a DNT signal to turn off.

14. Do we make updates to this notice?

Yes, we will update this notice as necessary to stay compliant with relevant laws. The updated version will be indicated by an updated "Last updated" date and will be effective as soon as it is accessible. If we make material changes, we may notify you by prominently posting a notice or by sending you a notification.

15. How can you contact us about this notice?

If you have questions or comments about this notice, email us at chris@luvvo.studio.

16. How can you review, update, or delete the data we collect from you?

You have the right to request access to the personal information we collect from you, change that information, or delete it. To request to review, update, or delete your personal information, visit /data-request or email chris@luvvo.studio.