Privacy Policy

Privacy Policy

Last updated: July 29, 2026

Stitched Hats ("we", "us", "our") operates stitchedhats.com. This policy explains what personal information we collect, how we use and protect it, who we share it with, and what control you have over it.

We keep this short and specific on purpose. If anything here is unclear, email support@stitchedhats.com and we'll answer in plain language.

1. The Short Version

• We never see or store your full card number. Payments are processed by PCI-DSS compliant providers.
• We do not sell your personal information, and we do not hand it to third parties for their own marketing.
• Our entire site runs on HTTPS encryption, including checkout.
• Your custom artwork stays yours. We never use your photos or logos in our own marketing without asking you first.
• You can ask us to delete your data at any time.

2. Information We Collect

Information you give us directly:

• Name, email address, phone number
• Shipping address and billing address
• Order details and purchase history
• Custom order content — the text, names, dates, logos, artwork, or photos you send us for embroidery
• Messages you send us by email, phone, or the contact form
• Your email address if you subscribe to marketing emails

Information collected automatically when you visit:

• IP address, browser type, device type, and operating system
• Pages viewed, time on site, and the site or ad that referred you
• Cookie and pixel data (see Section 8)

Information we receive from others:

• Payment confirmation and fraud-screening results from our payment processors
• Delivery status from shipping carriers

3. Payment Information

This is the part customers ask about most, so we'll be direct.

We do not collect, see, process, or store your full credit card number, CVV security code, or bank account details. When you pay, your card details are transmitted directly to our payment processor over an encrypted connection. They are never stored on our servers.

Payments are handled by PCI-DSS Level 1 compliant providers — the highest certification level in the payment card industry — including Shopify Payments and, depending on the method you choose at checkout, providers such as PayPal, Shop Pay, Apple Pay, or Google Pay. Each processor handles your payment data under its own privacy policy.

What we do receive and retain is limited to: the last four digits of your card, the card brand, the billing name and address, the amount, and whether the transaction succeeded. We need this to match payments to orders, process refunds, and investigate chargebacks. It is not enough information for anyone to make a charge.

4. Custom Artwork, Photos & Logos

Because we embroider custom orders, some customers send us personal photographs, family names, dates, and business logos. We treat these carefully:

• Your artwork is used only to digitize and produce your order.
• We never publish your photo, logo, name, or finished custom design in our marketing, on social media, or on our website without asking your permission first.
• We do not sell, license, or share your artwork with anyone outside our production process.
• We retain stitch files for 12 months after your order so you can reorder without paying to digitize again. After that they are deleted. You can ask us to delete yours sooner at any time.
• You are responsible for holding the rights to any logo or image you send us for embroidery.

5. How We Use Your Information

• To process, produce, and ship your order
• To send order confirmations, design proofs, shipping notices, and tracking numbers
• To answer your questions and provide customer support
• To handle returns, replacements, and refunds
• To detect and prevent fraud and abuse
• To meet legal, tax, and accounting obligations
• To send marketing emails — only if you opted in, and you can unsubscribe from any email in one click
• To improve our products, site, and service using aggregated analytics

6. We Do Not Sell Your Personal Information

We do not sell your personal information, and we never have. We do not exchange, rent, or trade your name, email address, phone number, postal address, or order history to any third party for money or other consideration.

We do not share your personal information with third parties for their own independent or unauthorized marketing purposes. No one buys a list from us. If you receive marketing email from us, it is because you asked for it, and you can stop it in one click.

The only parties who receive your information are the service providers we need to actually run the business — listed in Section 7 — and they are contractually limited to acting on our instructions.

One point of full transparency: like most online stores, we use advertising and analytics cookies (Section 8). Under some U.S. state privacy laws, such as California's CCPA/CPRA, this kind of cookie-based advertising activity can be legally classified as "sharing" personal information for cross-context behavioural advertising, even though no money changes hands and we receive nothing in return. We would rather tell you that plainly than make a blanket claim that isn't precise. You can opt out at any time using the instructions in Section 8 or by emailing us.

7. Who We Share Information With

We share only what is necessary, only with providers who need it to do their job:

We may also disclose information where legally required — in response to a valid subpoena, court order, or lawful government request, or to protect our rights, safety, or property. If our business is ever sold or merged, customer data may transfer as part of that transaction, and this policy will continue to apply to it.

8. Cookies, Analytics & Advertising

We use cookies and similar technologies to keep your cart working, remember your preferences, understand how the site is used, and measure whether our ads work.

• Essential cookies — required for the cart, checkout, and security. The site cannot function without these.
• Analytics cookies — anonymous, aggregated statistics about how visitors use the site.
• Advertising cookies — let us measure ad performance and show relevant ads on platforms such as Google and Meta.

How to opt out: you can block or delete cookies in your browser settings at any time. You can also opt out of interest-based advertising at optout.aboutads.info and networkadvertising.org/choices, and Google Analytics specifically at tools.google.com/dlpage/gaoptout. We also honour browser Global Privacy Control (GPC) signals where required by law.

9. Security & Encryption

• Our entire site runs on HTTPS. Every page, image, and script is served over an encrypted TLS connection — not just checkout. You can confirm this by the padlock icon in your browser's address bar.
• Checkout and payment pages are hosted on PCI-DSS Level 1 compliant infrastructure.
• Access to customer data is limited to team members who need it to fulfil orders or provide support, and is protected by strong passwords and two-factor authentication.
• We do not store payment card numbers anywhere in our systems.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach ever affects your personal information, we will notify you and the relevant authorities as required by law.

10. How Long We Keep Your Data

11. Your Privacy Rights

Wherever you live, you may ask us to:

• Access the personal information we hold about you
• Correct anything inaccurate
• Delete your personal information, subject to records we must legally keep
• Receive a copy of your data in a portable format
• Opt out of marketing email, and of targeted advertising
• Withdraw consent you previously gave

California residents (CCPA/CPRA) additionally have the right to know the categories of personal information collected, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. We do not sell personal information. To opt out of cookie-based advertising sharing, see Section 8 or email us.

Texas residents (TDPSA) and residents of other U.S. states with comprehensive privacy laws have equivalent rights of access, correction, deletion, portability, and opt-out of targeted advertising.

EU, UK, and other international visitors: where GDPR or similar law applies, we process your data on the legal bases of contract performance (to fulfil your order), legitimate interest (to prevent fraud and improve our service), consent (for marketing), and legal obligation. You also have the right to lodge a complaint with your local data protection authority.

To exercise any right, email support@stitchedhats.com with the subject line "Privacy Request". We respond within 30 days. We may need to verify your identity before acting, and we will never charge you or degrade your service for making a request.

12. Children's Privacy

Our store is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us personal information, email us and we will delete it promptly.

13. Changes to This Policy

We may update this policy as our business, the law, or our tools change. The "Last updated" date at the top always reflects the current version. If we make a material change to how we handle your information, we will notify subscribers by email.

14. Contact Us