Privacy Policy

We collect the following categories of personal information:

• Contact information — your name and email address, provided when you create an account, place an order, subscribe to our mailing list, or contact us.
• Shipping and billing addresses — collected at checkout to fulfill and deliver your order.
• Order details — the pieces you purchase, order history, and any correspondence relating to your order.
• Payment information — processed securely by Stripe and Shopify. We do not store your full card number, CVV, or bank credentials on our servers.
• Marketing preferences — your opt-in status for our mailing list and occasional collection previews.
• Cookies and device data — including IP address, browser type, device type, referring page, and pages visited. See Cookies below.
• Analytics data — anonymous or pseudonymous usage information to help us improve the boutique experience.

We use your personal information only for the following purposes:

• To process, fulfill, and deliver your orders, including custom commissions
• To send order confirmations, shipping updates, and tracking information
• To provide customer care and respond to your inquiries
• To send marketing emails and collection previews, only where you have opted in
• To operate, secure, and improve our website and services
• To detect and prevent fraud, unauthorized transactions, and abuse
• To comply with legal, tax, and regulatory obligations

If you are in the EEA or UK, we rely on the following legal bases:

• Contract — to process your order and provide the services you request.
• Consent — for marketing emails and non-essential cookies. You may withdraw consent at any time.
• Legitimate interests — to secure our site, prevent fraud, and improve our services, balanced against your rights and freedoms.
• Legal obligation — to comply with tax, accounting, and consumer protection laws.

We share personal information only with trusted service providers required to operate the boutique. Each is contractually bound to protect your data and to use it solely for the services they provide to us:

• Shopify — storefront, cart, checkout, and order management.
• Stripe — secure payment processing.
• Shipping carriers (USPS, UPS, FedEx, DHL) — to deliver your order.
• Email service providers — to send order confirmations, shipping notifications, and (where opted in) marketing correspondence.
• Analytics providers — to understand aggregate site usage in an anonymous or pseudonymous form.

We do not sell or rent your personal information. We do not share your information with third parties for their independent marketing.

House of Palomino is based in the United States, and our service providers may process data in the U.S. and other countries. Where personal data of EEA or UK residents is transferred outside those regions, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.

We retain personal information only for as long as necessary to fulfill the purposes set out in this policy:

• Order and transaction records: retained for up to 7 years, as required by tax and accounting law.
• Account information: retained for as long as your account is active.
• Marketing preferences: retained until you unsubscribe or request deletion.
• Analytics data: retained in aggregated or anonymized form.

Once no longer needed, personal data is securely deleted or anonymized.

We use administrative, technical, and physical safeguards designed to protect your personal information — including SSL/TLS encryption in transit, secure PCI-compliant payment processing through Stripe and Shopify, and restricted access to personal data on a need-to-know basis. No method of transmission or storage is entirely secure, but we work continuously to protect your information.

Depending on where you live, you have the following rights regarding your personal information:

Rights under GDPR / UK GDPR (EEA and UK residents):

• Right of access to your personal data
• Right to rectification of inaccurate or incomplete data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time
• Right to lodge a complaint with your local Data Protection Authority

Rights under CCPA / CPRA (California residents) and comparable U.S. state laws:

• Right to know what personal information we collect, use, and disclose
• Right to request deletion of your personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information (we do not sell)
• Right to limit the use of sensitive personal information
• Right to non-discrimination for exercising your rights

To exercise any of these rights, please contact sales@houseofpalomino.org. We will respond within the timeframes required by law (typically 30 days under GDPR, 45 days under CCPA/CPRA). We may need to verify your identity before fulfilling certain requests.

Our website uses cookies and similar technologies for the following purposes:

• Strictly necessary cookies — required to operate the site, shopping cart, and secure checkout. These cannot be disabled.
• Preference cookies — to remember your choices, such as region or language.
• Analytics cookies — to understand aggregate site usage. Used only with your consent where required.
• Marketing cookies — to measure the performance of our email and campaign activity. Used only with your consent where required.

You may manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect your ability to use the site or complete a purchase.

We send marketing emails only to those who have opted in. Each email includes an unsubscribe link, and you may opt out at any time by clicking that link or by writing to sales@houseofpalomino.org. Transactional emails — such as order and shipping confirmations — will still be sent as required to fulfill your order.

Our website and services are not directed to children under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we may promptly delete it.

We honor Global Privacy Control (GPC) signals from browsers where required by applicable law. Because there is no consistent industry standard for "Do Not Track" browser signals, we do not currently respond to them separately.

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. The "Last updated" date above indicates when it was most recently revised. Material changes will be communicated by prominent notice on this site or by email where appropriate.

For any questions, concerns, or requests regarding this Privacy Policy or your personal information:

House of Palomino
Saratoga Springs, New York, USA
sales@houseofpalomino.org

EEA/UK residents may also contact their local Data Protection Authority. California residents may contact the California Privacy Protection Agency.