Privacy Policy

Stick and Snap (“we”, “us”) is a student-run group project that sells hand-drawn stickers online for pickup at in-person pop-up markets. The group members are Sabina Borjes, Jonathan Duchauffour, Cannon Good, Yatin Manuel, George Parzych. Stickers are drawn by Sabina Borjes; the website is built and maintained by Yatin Manuel.

We are responsible for the personal information described in this policy. Stick and Snap is not an official service of any school or university, and no school or university is responsible for how we handle your information. Questions about this policy go to yatinm@vt.edu.

This policy covers this website and the orders placed through it. It does not cover conversations you have with us in person at a market, or third-party websites we link to.

We collect as little as we can and still get your stickers to you.

When you check out

Payment happens on a secure checkout page run by our payment processor, Stripe. On that page Stripe collects, and shares with us:

• Your name, so we can match your order at the booth.
• Your email address, for your order confirmation and for questions about your order.
• Your phone number, so we can reach you about your pickup (for example, if a market moves).
• Order details: which stickers and packs you bought, quantities, prices, the total, the date, your order number, and the pop-up market you chose for pickup.
• Limited payment details: the type of payment method and, for cards, the brand, the last four digits, the expiry date and the billing country or postal code.

We never see or store your full card number or security code. Stripe handles those directly. If you use a promotion code, Stripe tells us which code was applied.

While you browse

• Your cart, saved on your own device. We use your browser's local storage (under the name stick-and-snap-cart) to remember the stickers in your cart and the market you picked. This stays in your browser; it is not sent to us until you start checkout, and then only the sticker names, quantities and chosen market are sent. You can delete it at any time by clearing your browser's site data.
• Technical request data. Like nearly every website, the service that hosts our site automatically receives standard information when your browser requests a page: your IP address, browser type, the page requested, the referring page and the time. This is used to deliver pages, keep the site secure and fix problems.

What we don't collect

• We don't offer accounts or logins.
• We don't use analytics, advertising, tracking pixels or social media widgets.
• We don't set our own cookies. (Stripe's checkout page may set its own; see section 6.)
• We don't collect your home or shipping address, because we don't ship.
• We don't knowingly collect sensitive information (such as health, financial account, government ID or precise location data).

When you contact us

If you email us, we receive your email address and whatever you choose to include, and we keep that conversation to answer you.

We use your information only to:

• take payment and confirm your order;
• prepare your order and hand it to you at the market you chose;
• contact you about your order: market changes or cancellations, items that sold out, refunds, or unclaimed orders;
• answer your questions and handle refund, privacy and other requests;
• keep records of sales as required for accounting, tax and legal purposes;
• prevent fraud, abuse and security problems, and keep the website working; and
• comply with the law and enforce our Terms of Service.

We do not send marketing emails or texts, and we won't add you to a mailing list. If we ever start a newsletter, it will be opt-in only, and this policy will be updated first.

We do not use your information for automated decision-making or profiling.

We do not sell your personal information, and we do not share it for targeted advertising. We share it only in these situations:

• Stripe, our payment processor, which collects and processes your payment and order information to run the checkout, prevent fraud and meet its own legal obligations. Stripe's handling of your data is described in the Stripe Privacy Policy.
• Our website host, which runs our servers and receives the technical request data described above in order to deliver the site.
• Members of our group, who can see orders in our Stripe account so they can prepare and hand out orders at markets. Access is limited to group members who need it.
• When required by law, such as to respond to a valid subpoena or court order, or to protect the rights, safety or property of our customers, our group or others.
• If the project changes hands, for example if another group takes over the shop, in which case this policy would continue to apply to information collected under it.

• Order and payment records are kept in our Stripe account for as long as we need them to fulfil and support your order and to meet accounting, tax and legal requirements. Stripe also keeps transaction records for the periods its own legal obligations require.
• Emails you send us are kept until your question is resolved and then for up to one year, unless you ask us to delete them sooner.
• Your saved cart stays in your browser until you check out, remove the items or clear your browser's site data.
• Server logs are kept by our host for a short period for security and troubleshooting. The logs our own code writes about orders contain only an order reference, the market and the amount, never your name, email or phone number.

When information is no longer needed, we delete it or ask Stripe to remove it where Stripe allows.

Our website does not set cookies. It stores your cart in your browser's local storage, as described in section 2, which is strictly necessary for the cart to work, and nothing else.

When you go to checkout you leave our website for Stripe's checkout page. Stripe uses cookies and similar technologies there to run the payment, remember your details if you opt into Stripe's Link service, and detect fraud. See Stripe's cookie information.

Because we don't track you across websites, our site does not change its behavior in response to “Do Not Track” or Global Privacy Control signals. There is no tracking to turn off.

Our site is served over HTTPS, so data between your browser and our site is encrypted. Payments are handled by Stripe, which is certified to PCI DSS Level 1, the highest level of payment-card security. We limit who can sign in to our Stripe account to group members who need it, and we keep our secret keys out of our code.

No method of transmission or storage is completely secure, so we can't guarantee absolute security. If we learn of a security incident that affects your personal information, we will notify you and any authorities as required by law.

Wherever you live, you can ask us to:

• Access: tell you what personal information we have about you and give you a copy;
• Correct: fix information that's wrong, such as a misspelled name or new phone number;
• Delete: remove your personal information, unless we must keep it (for example, sales records we're legally required to keep, or information needed for an order that's still open); and
• Port: give you your information in a common, machine-readable format.

We don't sell personal information, use it for targeted advertising, or profile you, so there is nothing to opt out of. If that ever changes, we'll update this policy and give you a way to opt out first.

To make a request, email yatinm@vt.edu from the email address you used for your order, or include your order number. We may ask for a little more information to confirm it's really you. We'll respond within 45 days. You can also have an authorized agent make a request for you, with your written permission. We won't treat you differently for exercising any of these rights.

If we decline a request, we'll explain why, and you can appeal by replying to our decision. We'll answer your appeal within 60 days.

Residents of Virginia, California and other states

State privacy laws, such as the Virginia Consumer Data Protection Act and the California Consumer Privacy Act, give residents rights like those above. Our project is small enough that these laws may not formally apply to us, but we honor the rights listed in this section for everyone, regardless of where they live. If you are a Virginia resident and are unhappy with our response to an appeal, you may contact the Virginia Attorney General.

Our website is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are under 18, please ask a parent or guardian before buying, and have them complete the checkout.

If you believe a child under 13 has given us personal information, email yatinm@vt.edu and we will delete it.

We are based in the United States, and our website and the services we use operate primarily in the United States. Stripe may process information in other countries as described in its privacy policy. By using our site from outside the United States, you understand that your information will be processed in the United States.

We may update this policy when our practices change. We'll change the “Last updated” date at the top, and for significant changes we'll put a notice on the site before they take effect. Changes apply to information collected after the update.

For any question or request about your privacy, email yatinm@vt.edu. You can also talk to any of us at the booth, but please follow up by email for formal requests so we have a record.