Privacy Policy

— Name and email address

— Phone number (optional)

— Password (stored as a one-way hash — we cannot read it)

— If you sign in with Google, your Google account email and profile information

— Shipping addresses you save to your account

— Shipping name and address collected at checkout (provided to the seller to fulfill your order)

— Payment information — processed directly by Stripe on the seller's behalf. BLD Adventures, LLC does not collect, store, or have access to your payment card details

— Recently viewed products (stored locally in your browser)

— Shop name and zip code

— Personal bio, craft type, years of experience, and description of your handmade process

— Materials used and product categories

— Photos of your craft space and process (uploaded during application)

— Website and social media URLs (optional)

— Draft application data saved locally in your browser until submitted

— Shop name, location (city, state, zip code, coordinates derived from zip), and logo

— Stripe Connect account ID — stored to authorize direct checkout sessions on your behalf. When a buyer checks out with your shop, their payment details are collected directly by your Stripe Connect account. BLD Adventures, LLC is not a party to that transaction and does not see or store buyer payment card details

— Stripe customer ID — stored to manage your platform subscription billing. Stripe's own privacy policy governs all data Stripe collects during onboarding and billing (identity verification, bank account, SSN last 4, etc.): stripe.com/privacy

— Product listings, descriptions, images, and pricing

— Messages sent between buyers and sellers through the platform, including subject and message content. Messages may be linked to a specific product or order

— IP address — used temporarily for rate limiting (e.g. to prevent message spam). IP addresses used for rate limiting are stored transiently in Redis and are not persisted to our database

— Authentication and refresh tokens — stored in secure HTTP-only cookies to keep you logged in. These cookies are cleared on logout and expire automatically

— Session cache — a subset of your account data (name, email, role, and shop ID) derived from your authentication token is cached in your browser's local storage to improve application performance and reduce unnecessary network requests. This cache mirrors data already in your account and is cleared on logout

— Email address submitted via our homepage interest form prior to or during launch

— To create and manage your account

— To facilitate checkout — your shipping address is shared with the seller to fulfill your order. Payment data flows directly between you and the seller via Stripe. We do not handle or store payment card details

— To send transactional emails — order confirmations, shipping updates, account notifications, and seller application status updates

— To review seller applications and manage shop listings

— To enforce rate limits and protect the platform from abuse

— To send platform update emails to users who opted in via our interest form

— To track internal platform analytics (trial lifecycle events) to improve the seller experience. No third-party analytics services are used

— To respond to support requests and contact form submissions

— Sellers — when you place an order, your shipping name and address are shared with the seller to fulfill your purchase. Your payment information flows directly to the seller's Stripe account and is never seen or stored by BLD Adventures, LLC

— Stripe — payment processing, seller identity verification, and subscription billing. Stripe processes data under its own privacy policy: stripe.com/privacy

— Google — if you sign in with Google, your authentication is handled by Google under its own privacy policy: policies.google.com/privacy

— Amazon Web Services — our infrastructure, database, file storage (S3), and transactional email delivery (SES) are hosted on AWS in the United States within a private VPC. AWS processes data under its own privacy policy

— Legal obligations — we may disclose your information if required by law, subpoena, court order, or to protect the rights, property, or safety of BLD Adventures, LLC, its users, or others

— We do not sell your personal information to third parties

— Cookies — we use HTTP-only cookies strictly necessary for authentication and session management (access token and refresh token). We do not use advertising, tracking, or third-party analytics cookies

— Local storage — we store a lightweight session cache in your browser's local storage containing your name, email, role, and shop ID. This is derived from your authentication token and used to improve performance by reducing unnecessary API calls. We also store recently viewed products and your shop application draft locally. None of this data is transmitted to third parties

— All data is transmitted over HTTPS/TLS

— Our database and application code run on Amazon RDS and AWS ECS within a private AWS VPC, not accessible from the public internet

— Application containers run on AWS ECS behind an Elastic Load Balancer with security group restrictions

— Publicly visible assets, including product images and shop logos, are hosted via Amazon S3 and are intentionally publicly readable so buyers can view them. They are not part of the private VPC

— Passwords are stored as one-way hashes and cannot be recovered

— Access to production systems is limited to authorized personnel of BLD Adventures, LLC only

— While we take reasonable measures to protect your data, no system is completely secure. We encourage you to use a strong, unique password for your account

— Account data is retained for as long as your account is active

— Order records and transaction-related data may be retained beyond account deletion as required by law or for legitimate business purposes such as dispute resolution

— IP addresses used for rate limiting are stored transiently and automatically expire

— If you request account deletion, we will remove your personal data within 30 days except where retention is legally required

— Access — you may request a copy of the personal data we hold about you

— Correction — you may update your account information at any time through your account settings

— Deletion — you may request deletion of your account and personal data by contacting us at support@artistryfair.com. Some data may be retained as described in Section 6

— Opt-out of marketing emails — you may unsubscribe at any time via the unsubscribe link in any marketing email or by contacting us. Transactional emails (order confirmations, account notifications) cannot be opted out of while your account is active

— Cookies — authentication cookies are required for the platform to function. You may disable cookies in your browser settings but this will prevent you from logging in

— Local storage — you may clear your browser's local storage at any time through your browser settings. This will clear your session cache, recently viewed products, and any saved application drafts. You will need to log in again

Questions about this policy or requests regarding your personal data:

Email: support@artistryfair.com

Corporate Entity: BLD Adventures, LLC, Massachusetts, United States