Privacy Policy

1. Who We Are

Tuemmler & Harris is a small craft business based in Maine, United States. Every hat and leather purse we sell is made by hand, no overseas manufacturing, no mass production. This policy applies to tuemmlerandharris.com and any related services. You can reach us at support@tuemmlerandharris.com.

2. Information We Collect

We collect the following categories of information:

• Account information: your name and email address, provided directly when you register or received from Google or Facebook when you use social sign-in.
• Order and commission information: name, email address, shipping address, phone number (optional), and details about the items you order or commission.
• Payment information: processed entirely by Stripe. We never receive or store your full card number. Stripe is PCI-DSS Level 1 certified.
• Communications: messages you send through your orders page or our contact form regarding a custom piece or support request.
• Marketing preferences: whether you have opted in to receive marketing emails. We only subscribe you if you explicitly check the opt-in box.
• Technical data: IP address and browser type, collected automatically to protect the site from abuse and to keep it functional. We do not use analytics cookies or build behavioral profiles.

3. How We Use Your Information

We use the information we collect exclusively to:

• Process and fulfill your orders and commissions.
• Send order confirmations, shipping notifications, and commission status updates.
• Respond to messages and support requests you initiate.
• Send marketing emails about new products and offers, but only if you have opted in. You can unsubscribe at any time via the link in any marketing email.
• Maintain your account and order history so you can access them.
• Detect and prevent fraud or abuse of our systems.

4. How We Do NOT Use Your Information

We do not use your personal information, including any data received from Google or Facebook, for any of the following purposes:

• Targeted or personalized advertising, on our site or anywhere else.
• Training artificial intelligence or machine learning models.
• Selling, renting, or transferring your data to data brokers, information resellers, or any third party for their independent use.
• Credit scoring, lending decisions, or financial profiling.
• Building behavioral profiles or tracking you across other websites or apps.

We never sell your personal information. Full stop.

5. Google Sign-In Data

If you choose to sign in with Google, we request access to your Google account using the following OAuth scopes:

• email: your email address
• profile: your display name
• openid: a unique identifier to recognize your account

We use this data exclusively to create and maintain your Tuemmler & Harris account so you can log in, view your orders, and manage your commissions. We do not access any other Google account data, do not post to Google on your behalf, and do not share this data with any third party.

You can revoke our access to your Google account at any time by visiting myaccount.google.com/permissions. Revoking access does not delete your Tuemmler & Harris account or order history; contact us if you would also like those removed.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Facebook Sign-In Data

If you choose to sign in with Facebook, we receive your name and email address from Meta. We use this data exclusively to create and maintain your account. We do not access other Facebook profile data, post to Facebook on your behalf, or share this data with third parties.

You can revoke our access in Facebook Settings → Apps and Websites.

7. Third-Party Service Providers

We share data with the following services only as required to operate our business. Each provider is contractually restricted from using your data for their own purposes:

• Stripe: payment processing and invoicing. Stripe receives your payment card details and billing information. See Stripe's Privacy Policy.
• Amazon Web Services (AWS): our accounts, orders, emails, and files are stored and processed on AWS infrastructure in the United States (us-east-1 region).
• Cloudflare: CAPTCHA on forms to prevent automated abuse. Cloudflare receives your IP address for this purpose.

No other third parties receive your personal information.

8. Data Security

We protect your information using HTTPS encryption in transit, encrypted storage at rest on AWS, and strict access controls limiting who within our organization can view customer data. Payment data is handled entirely by Stripe and never touches our servers. We review and update our security practices regularly.

9. Data Retention and Deletion

We retain your account and order information for as long as your account is active or as required by law (typically 7 years for financial transaction records under US tax law).

To request deletion of your account and associated personal data, email us at support@tuemmlerandharris.com. We will delete your data within 30 days, except where retention is required by law. Note that deleting your account does not affect order records that are legally required to be retained for tax and accounting purposes.

10. Your Rights

You have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and personal data (see Section 9).
• Opt out of marketing emails at any time via the unsubscribe link in any email.
• Revoke Google or Facebook sign-in access (see Sections 5 and 6).

To exercise any of these rights, contact us at support@tuemmlerandharris.com.

11. Children

Our site is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. We will update the date at the top of this page when we do. If changes materially affect how we handle your data, we will notify you by email or by a prominent notice on the site.

13. Contact

Questions or concerns about this privacy policy? Email support@tuemmlerandharris.com or use our contact form.