Privacy Policy

Last updated: October 20, 2026

This Privacy Policy explains how Herbariumstitch, a trade name of Herbarium Stitch ("we", "us", "our"), collects, uses and shares personal information when you visit https://herbariumstitch.com or place an order. It also explains the privacy rights available to you as a customer in the United States.

Information we collect

Information you provide

• Your name, email address and phone number
• Billing and shipping addresses
• Order history and details of your purchases
• Messages you send to our support team

Information collected automatically

• IP address, device type, browser and operating system
• Cookies and similar technologies
• How you browse and interact with our site, such as pages viewed and searches made

How we use your information

• To process, ship and track your orders
• To process payments and prevent fraud
• To answer your questions and support requests
• To send order confirmations and shipping updates
• To send marketing emails, where you have signed up to receive them
• To understand how our site is used and to improve it
• To comply with legal obligations

Who we share information with

We share personal information only with service providers that help us run our store:

• PayPal, to process payments
• DigitalOcean Spaces, to store files and images
• OpenAI, to power product search on our site
• Telegram, to send order notifications to our staff
• Our email (SMTP) provider, to send order and support emails
• Shipping carriers (USPS, UPS, FedEx, DHL), to deliver your orders
• Google Analytics and Google Ads, which use analytics and advertising cookies

Data inventory

The table below summarizes the categories of personal information we collect and who receives them.

Cookies

We use cookies to keep our site working, to understand how visitors use it (Google Analytics) and to measure and show advertising (Google Ads). You can block or delete cookies through your browser settings; some parts of the site may not work as expected without them.

Sale and sharing of personal information

We do not sell your personal information for money. However, the advertising and analytics cookies used by Google Ads and Google Analytics may be considered "sharing" for cross-context behavioral advertising under the California Privacy Rights Act (CPRA) and similar state laws. You can opt out at any time on our Do Not Sell or Share My Personal Information page.

Your privacy rights

We extend the following rights to all customers in the United States:

• Right to know what personal information we collect, use and share
• Right to access a copy of your personal information
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of your personal information
• Right to non-discrimination for using any of these rights

Depending on your state, you may also have the right to data portability and the right to opt out of targeted advertising and profiling.

How to submit a request

Email us at [email protected] or use the form below. Tell us which right you would like to use.

How we respond

• Opt-out requests are honored within 15 business days. You do not need an account, and we do not require identity verification to opt out.
• Other requests (know, access, delete, correct) are answered within 45 days. If we need more time, we may extend this by a further 45 days and will let you know. We may need to verify your identity before completing these requests.
• Appeals: if we decline your request, you can appeal by emailing us with the subject line "Privacy Appeal". We will respond within 60 days. If you disagree with our decision, you may contact your state Attorney General.

Authorized agents

You may use an authorized agent to submit a request on your behalf. The agent must provide written permission signed by you.

Children's privacy

Our site is not directed to children. We do not sell or share the personal information of consumers under 16 without prior consent: consumers aged 13 to 15 must give their own consent, and children under 13 need a parent's or guardian's consent.

Sensitive personal information

We do not collect sensitive personal information, so we do not use or disclose it for any purpose.

Marketing emails

Every marketing email we send includes an unsubscribe link. Unsubscribing does not stop transactional emails, such as order confirmations and shipping updates.

Data retention and security

We keep personal information only as long as needed for the purposes described in this policy or as required by law. Our site is served over an encrypted SSL connection, and we use reasonable measures to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Changes to this policy

We may update this Privacy Policy from time to time. Changes take effect when posted on this page, and the date above shows the latest version.