Privacy Policy

This Privacy Policy explains what personal information CottageCrafted, operated by A Plan in Place LLC ("CottageCrafted," "we," "us") collects when you use cottagecrafted.co (the "Service"), how we use and share it, and the choices and rights you have. It applies to everyone who uses the Service — shoppers, sellers and visitors. Our Terms of Service also apply.

1. Information we collect

Information you give us

• Account information: your name, email address and password. Passwords are stored only as a one-way cryptographic hash — we can't read them. We also record when you accepted our Terms.
• Order information: the items you order, the seller, totals, your chosen pickup or delivery option, delivery address (for delivery orders), phone number (optional), notes to the seller, and — if you pay through an app like Venmo or Cash App — the payment username you choose to give so the seller can match your payment.
• Reviews: your ratings and comments on products and sellers. Your name is displayed publicly with your review.
• Messages: if you use a seller's "Contact seller" form, we relay your name, email address and message to that seller by email. We do not store the message on our servers, but it passes through our email provider.
• Seller information: business name, description, city, logo, banner and product photos, product details and prices, contact email and phone, pickup address and notes, delivery area and fee, and any payment-app usernames you add (Venmo/Cash App). Your business profile, products, city and ratings are public. Your contact email and phone are public only if you choose to show them. Your pickup address is shared only with customers whose orders you confirm.
• Payments through Stripe (sellers): if you connect a Stripe account, we store the connected-account identifier and whether it can accept charges. Stripe collects your identity and bank details directly; we never see or store them.
• Communications with us: anything you send when you contact us.

Information collected automatically

• Technical and log data: IP address, browser type, device, pages requested and timestamps, recorded in server and security logs. We use it to run, secure and troubleshoot the Service, and to limit abuse (for example, rate-limiting sign-ups and messages).
• Shared-link activity: when someone presses a Share button, or opens a link that someone shared, we record which shop or product it was, the sharer's referral code, and the time. If a visitor then orders from that shop within 30 days, the order is marked with that code. We do not record the visitor's IP address, browser or device in this record, and we do not count automated link-preview bots.
• Cookies: see Section 4. We use only the cookies needed for signing in, security and shared-link attribution.

We do not intentionally collect sensitive personal information such as government IDs, health data, or precise geolocation.

2. How we use information

• to create and secure your account, including verifying your email with one-time codes;
• to show shops and products, process orders, and let sellers and customers communicate about them;
• to send service emails — order confirmations and updates, pickup details, seller approvals, password-change and verification notices;
• to process and reconcile payments and pay fees, and to help sellers get paid where they use Stripe;
• to prevent fraud, abuse and security incidents, and to enforce our Terms;
• to respond to requests, provide support, and improve and maintain the Service; and
• to comply with legal obligations, including tax and accounting records.

We do not use your information to build advertising profiles, and we do not make decisions about you by automated means that have legal or similarly significant effects.

3. How we share information

We share personal information only in the ways below, and we do not sell it or share it for cross-context behavioral advertising.

With other users, to complete orders

• Sellers receive the information needed to fulfill an order you place with them: your name, email, phone number (if you gave one), delivery address (for delivery orders), notes, payment-app username (if given) and the order details. Sellers may use it only to fulfill and communicate about your order.
• Customers see a seller's public shop information, and — after the seller confirms a pickup order — the pickup address and pickup notes.
• The public can see seller profiles, products, ratings and reviews (with the reviewer's name).

With service providers that help us run the Service

• Hosting and infrastructure: our servers, where the database and application run.
• Cloudflare: network security and content delivery — it handles web traffic to the site, so it sees IP addresses and requests, and may set security cookies.
• Resend: delivers our emails (order updates, verification codes, contact-form messages). It processes email addresses and message content.
• Bunny.net: stores and delivers uploaded images (logos, banners, product photos), and stores backups of our database.
• Stripe: processes card payments and seller payouts where a seller has enabled them. Stripe acts under its own privacy policy for the information it collects.

These providers may use the information only to provide their services to us, under agreements that require appropriate protection.

For legal and business reasons

• to comply with law, legal process or a valid government request;
• to protect the rights, property and safety of users, CottageCrafted or others, and to investigate fraud or abuse; and
• as part of a merger, acquisition, financing or sale of assets, in which case we'll require the recipient to honor this policy or tell you first.

We may also share aggregated or de-identified information that can't reasonably identify you.

4. Cookies and similar technologies

We use a small number of first-party cookies:

• Sign-in session cookie — keeps you signed in (set by our authentication system; not readable by page scripts).
• Security cookies — a CSRF-protection token and a return-address cookie used during sign-in, and (for sellers) a short-lived cookie used while connecting a Stripe account.
• Shared-link cookie (cc_ref) — if you open a link someone shared, we remember the sharer's code and the shop for 30 days so that an order you place with that shop can be credited to the share. It holds no personal information about you and is deleted when it expires or when you clear your cookies.
• Cloudflare cookies — Cloudflare may set cookies to detect bots and protect the site.

Your shopping cart is held in your browser while the page is open and is not stored on our servers until you place an order. We do not use advertising, social-media or third-party analytics cookies or trackers. Because we don't track you across other websites or share data for advertising, there is nothing to opt out of, and we treat Do Not Track and Global Privacy Control signals accordingly (the shared-link cookie is first-party and used only to credit a share to the shop and the person who shared it). You can block cookies in your browser, but you won't be able to sign in.

5. How long we keep information

• Account information — while your account is open. When you ask us to delete it, we delete or de-identify it, subject to the exceptions below.
• Orders and transaction records — kept as long as needed to provide the Service, resolve disputes, and meet tax, accounting and legal obligations (generally several years). After account deletion we may keep these records in a form limited to what we're required or permitted to retain.
• Reviews — may remain on the Service; on deletion we can remove or anonymize your name.
• Verification codes — stored hashed and valid for 10 minutes.
• Backups — our database is backed up nightly and backups are kept for about 14 days, so deleted information can persist in backups for that period before it is overwritten.
• Logs — kept for a limited period for security and troubleshooting.

6. Security

We use reasonable safeguards, including encrypted connections (HTTPS), hashed passwords and one-time codes, limits on sign-in and verification attempts, and access controls on our systems. No method of transmission or storage is perfectly secure, so we can't guarantee absolute security. Please use a strong, unique password. If a breach affects your information, we'll notify you and regulators as the law requires.

7. Your rights and choices

Depending on where you live, you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• correct inaccurate information;
• delete your personal information, subject to legal exceptions (for example, records we must keep);
• opt out of sale, sharing, and targeted advertising — we do none of these, so there's nothing to opt out of;
• limit use of sensitive information — we don't collect it for purposes that require this right;
• receive your information in a portable format; and
• not be discriminated against for exercising your rights.

Residents of California and other states with privacy laws (such as Colorado, Connecticut, Virginia, Utah and Texas) have these rights under those laws. You can already update your name and password on your account page. To exercise any right, email (email address appears when JavaScript is on) from the address on your account. We'll verify your identity — typically by confirming control of your account email — and respond within the time the law requires (generally 45 days). You may use an authorized agent to make a request; we may ask for proof of their authority. If we deny a request you can appeal by replying to our response, and you may also contact your state attorney general.

California categories (past 12 months). We collected identifiers (name, email, IP address), customer-records information (address, phone), commercial information (orders), internet activity (logs), and images you upload. We disclosed these to service providers for business purposes as described in Section 3, and to sellers as needed to complete orders. We did not sell or share personal information.

8. Children

The Service is for adults. You must be at least 18 to create an account, and we don't knowingly collect information from anyone under 13. If you believe a child has given us personal information, contact us and we'll delete it.

9. Where information is processed

The Service is operated from and intended for the United States, and information is processed and stored in the United States (and by providers as described above). If you use the Service from elsewhere, you understand your information will be handled in the U.S., where privacy laws may differ from yours.

10. Links to other sites

The Service links to third parties — for example, map links for pickup locations and Stripe's sign-in and dashboard. We're not responsible for their privacy practices; read their policies.

11. Changes to this policy

We may update this policy from time to time. We'll change the date at the top and, for material changes, notify you by email or on the Service. Your continued use after the change means you accept the updated policy.

12. Contact us

CottageCrafted, operated by A Plan in Place LLC
Email: (email address appears when JavaScript is on)