Privacy Policy

1. Who we are

Rullands Creek Enterprises LLC (Stamped Sidewalks, "we", "us", "our") operates https://stampedsidewalks.com. This policy explains what personal information we collect, how we use it, and your rights.

2. Information we collect

• Account information: name, email, password (hashed), phone (optional), company (optional).
• Order information: shipping address, order history, design files you create, email used at checkout.
• Payment information: credit card numbers are processed by Stripe and never reach our servers. We keep payment, invoice and refund references, amounts, status and tax records needed to fulfill and account for your purchase. Supported wallet payments also have public blockchain transaction records.
• Device & usage: IP address, device and browser type, approximate location based on your IP address, pages visited, referring site, and how you use the site and design tool, including clicks and what you type into the designer. Used for security and for the analytics and advertising described in section 4.
• How you found us: the referring site, campaign tags in the link, the first page you landed on and your number of visits, saved with your order, plus your answer if you choose to tell us how you heard about us (see section 4).

3. How we use information

• To process orders and provide customer support.
• To produce, ship, and deliver your stamps.
• To send transactional emails about your orders (confirmations, shipping, delivery, refunds).
• To prevent fraud and abuse.
• To understand how the site and design tool are used, find where people get stuck, and run and measure our advertising (see the next section).

4. Analytics & advertising

We use the tools below to see how people find and use the site, where they get stuck, and whether our advertising works.

Google Analytics

Google Analytics records the pages you view; how you arrived (the referring site, a search, or ad and campaign tags in the link); your device and browser; your approximate location based on your IP address; and site events such as starting a design, adding to cart, beginning checkout, and completing a purchase, including the order value and order number. It uses first-party cookies (_ga, _ga_*).

Vercel Web Analytics and Speed Insights

Vercel, which hosts the site, gives us aggregate counts of page views, referring sites and countries, plus page-speed measurements. These tools don't use cookies.

PostHog

PostHog provides product analytics and session replay. It records how you use the site, including the stamp designer (clicks, pages viewed, and what you type into the designer), so we can see where people get stuck. Form fields such as email, address and password are masked in recordings. Payment details are entered on Stripe's page and are never recorded. When you sign in or place an order, PostHog activity from that browser is linked to your email address. PostHog uses a first-party cookie and local storage (keys starting with ph_).

Google Ads and Meta

When we advertise, we may use Google Ads and the Meta (Facebook and Instagram) Pixel to measure which ads lead to orders and to show our ads to people who have visited the site (remarketing). These services set their own cookies, such as _gcl_* and _fbp.

How you found us

When you place an order, we save how you arrived with it: the referring site's domain, campaign tags in the link (such as utm_source), the first page you landed on, and your number of visits. If you choose to answer "How did you hear about us?" on the order confirmation page, we save your answer too. The referring domain, campaign tags, landing pages and whether an ad link was clicked also go with your order to the production system our shop uses to make it, so we can see which of our marketing brings orders. If you opt out, none of this is recorded.

Our own site measurement

We also keep our own first-party records of a small set of site steps. They contain fixed step names, broad device categories, page-purpose categories, how the visit arrived (search, social, email, another site or direct) and an anonymous session identifier that rotates after 30 minutes. They don't include inscription text, design names, artwork, addresses, full page URLs or private-link tokens. Raw events expire after 90 days. Purchase and revenue reports use verified order records.

Your choices

You can opt out on Your Privacy Choices. We also honor the Global Privacy Control signal from your browser. Either way, opting out turns off:

• Google Ads and Meta advertising signals, including ad personalization
• PostHog session replay and analytics
• Our own site measurement
• Saving how you found us with your order

Basic Google Analytics measurement and Vercel's cookieless analytics continue after you opt out. Browser ad and tracker blockers also work. Signing in, designing and checkout keep working either way.

5. Subprocessors

We share information with these service providers to run the site, fulfill orders, and measure and run our advertising:

• Supabase — database, authentication, file storage.
• Stripe — payment processing and B2B invoicing.
• Resend — transactional email delivery.
• Shippo and shipping carriers — address validation, shipping rates, labels, customs declarations and package tracking. They receive the contact, destination and package details needed to deliver your order.
• Vercel — site hosting, Web Analytics and Speed Insights.
• Google — Google Analytics, and Google Ads when we advertise.
• Meta — the Meta Pixel, for Facebook and Instagram advertising when we advertise.
• PostHog — product analytics and session replay.
• Sentry — error telemetry so we can diagnose and fix site errors (with PII scrubbed). When an error happens, Sentry also saves a session replay: a reconstruction of the preceding moments in your browser. Every replay is captured with all text and every form field masked and images blocked — we see layout and clicks, not what you typed or read — and checkout, the sign-in pages, your account settings and staff admin screens are never recorded at all.

6. Your rights

You may request access, correction, or deletion of your personal information by emailing support@stampedsidewalks.com.

We don't sell personal information for money. Using advertising cookies from Google and Meta can count as "sharing" personal information for cross-context behavioral advertising under California law. California residents can opt out of that sharing on our Your Privacy Choices page (we honor the Global Privacy Control signal), and have rights to data portability and non-discrimination under the CCPA/CPRA. If you're in the EU/UK (GDPR), you have similar rights including the right to lodge a complaint with a supervisory authority.

7. Data retention

• Order, payment, invoice, tax and service records are retained for accounting, payment reconciliation and order support. These records are not automatically deleted after a fixed seven-year period.
• Shipping contact details on an order are cleared one year after delivery, or one year after the last update to a cancelled order. Copies in shipping, customs, quote and financial records are retained with those records. Saved addresses remain in your account until you remove them.
• Inactive, never-paid checkouts without payment attempts or linked order history are deleted after 30 days. Checkouts with unresolved payments, quotes or service records are retained so we can resolve them without losing your payment or order history.
• Sentry error events and the session replays attached to them: retained for the Sentry default (~90 days).

8. Cookies

We set strictly-necessary cookies and browser storage (your Supabase sign-in session, your locally-stored cart, and Stripe's cookies during checkout). We also use analytics cookies and storage from Google Analytics and PostHog, advertising cookies from Google Ads and Meta when we advertise, and browser storage for our own site measurement and for how you found us, as described in section 4. On Your Privacy Choices you can turn off everything except basic Google Analytics and Vercel's cookieless analytics. See our Cookie Policy for the full list.

9. Children

Our service is not directed at children under 13. We do not knowingly collect personal information from children under 13.

10. Changes to this policy

We may update this policy from time to time. When we do, we post the new version on this page and change the effective date at the top. If a change materially affects how we use information you have already given us, we will email account holders before it applies to that information.

11. Contact

Email support@stampedsidewalks.com or write to us at: