Privacy policy
last updated 19 august 2026
the short version: we sell shirts. we keep your order so we can post it to you, and we answer your emails. we do not run ads, we do not use tracking pixels, and we have never sold anyone's information and never will.
This policy explains what ani mal and friends collects when you visit animalandfriends.com, why we collect it, who else sees it, how long we keep it, and how to make us delete it. It is written in plain English on purpose. If anything here is unclear, email support@animalandfriends.com and we will explain it.
- 1. Who we are
- 2. What we collect
- 3. Why we collect it
- 4. Payment information
- 5. Who else sees it
- 6. Where it is stored and for how long
- 7. Cookies and local storage
- 8. Email from us
- 9. Your rights
- 10. We do not sell your information
- 11. Children
- 12. Security
- 13. Visiting from outside the United States
- 14. Changes to this policy
- 15. How to reach us
1. Who we are
ani mal and friends is a small independent shop. We design our own artwork, buy blank garments, and press and pack every order by hand. We are the data controller for the information described in this policy.
Before this page goes live: replace this box with your legal business name (for example "ani mal and friends, a sole proprietorship of Firstname Lastname") and a postal address you are willing to publish, such as a PO box. Delete this box once that is done. Everything else on the page is ready.
2. What we collect
an order, a message, or a note asking us to tell you when something is back. that is the whole list.
When you place an order
Stripe, our payment processor, collects your name, email address, shipping address, billing address, and (if you provide one) your phone number, along with your payment details. Stripe passes everything except your payment details back to us so we can make and post your order.
When you send us a message
If you use the postcard form on our home page, or email us directly, we receive your name, your email address, and whatever you write to us.
When you ask to be told about something
If you ask us to let you know when a design or a size comes back, we keep your email address so we can do exactly that.
When you simply visit
Our host, Vercel, records ordinary server logs: IP address, the page requested, the time, the browser's user agent, and the referring page. These are standard security and reliability logs. We do not run analytics software, advertising pixels, session recording, fingerprinting, or any third-party tracker on this site.
3. Why we collect it
| What | Why | Basis |
|---|---|---|
| Name and shipping address | To post your order to the right place | Performing our contract with you |
| Email address | Order confirmation, postage notice, answering your questions | Performing our contract with you |
| Phone number, if given | Only if a carrier needs it for a delivery problem | Performing our contract with you |
| Order contents and amounts | Making your order, stock counts, tax records | Contract and legal obligation |
| Messages you send us | Answering you | Your request |
| Email address, if you join the tea party | Sending you the occasional shop email | Your consent, which you can withdraw by replying stop |
| Server logs | Keeping the site up and blocking abuse | Our legitimate interest |
4. Payment information
we never see your card. not the number, not the expiry, not the code on the back.
All payments are taken by Stripe on Stripe's own hosted checkout page. Card numbers, expiry dates, and security codes are entered on Stripe's page and are never transmitted to, processed by, or stored on our servers. We receive only a payment reference, the amount, the last few digits and card brand as Stripe reports them, and the address you gave for shipping.
5. Who else sees it
We share the minimum necessary with the following service providers, and with nobody else:
- Stripe (payments and fraud prevention). Stripe is an independent controller of the payment data it collects. See Stripe's privacy policy.
- Resend (sending and receiving our email). Your address and the contents of order and support emails pass through Resend.
- Amazon Web Services (the database that holds our orders, and the inbound mail servers behind our support address), in the United States.
- Vercel (hosting the website and its server logs).
- Google Fonts. The site loads three typefaces from Google's font servers, which means Google receives your IP address and browser details when a page loads. If you would rather that did not happen, a content blocker that blocks fonts.googleapis.com will stop it, and the site stays perfectly usable with its fallback typefaces.
- The postal carrier you chose or we selected, which needs your name and address to deliver the parcel.
We will also disclose information if we are legally required to, or where it is necessary to establish or defend a legal claim, or to prevent fraud.
6. Where it is stored and for how long
Order records are stored in a database hosted by Amazon Web Services in the United States (us-east-1). Access is restricted to the shop owner and protected by a password and an encrypted connection.
- Orders and receipts: kept for seven years, because tax records have to be.
- Support messages: kept for up to two years, so we can pick up a conversation where it left off.
- Restock notification requests: deleted once we have told you, or on request, whichever comes first.
- Server logs: retained by our host for a short period on their normal schedule.
7. Cookies and local storage
no advertising cookies. no consent banner, because there is nothing to consent to.
This site sets no advertising or analytics cookies of any kind. What it does use:
- Local storage in your own browser, to remember what is in your basket between visits, whether you have already tapped Ani and Mal so the hint stops appearing, and whether you asked for the background music. This never leaves your device and we cannot read it. Clearing your browser data removes it.
- A single sign-in cookie on the private owner dashboard at /dash. It is set only when the shop owner logs in, and never for a visitor.
- Stripe sets its own cookies on Stripe's checkout page for fraud prevention. Those are governed by Stripe's policy, not ours.
8. Email from us
We email you about your order: a confirmation, and a note when it is posted. Those are transactional and you cannot opt out of them while an order is in progress, because they are the order.
If you ask us to tell you when something restocks, that is the only thing we will use your address for. Any promotional email we ever send will carry a working unsubscribe link and our postal address, and unsubscribing will be honoured promptly.
9. Your rights
ask us for your data, ask us to fix it, or ask us to delete it. we will not make it difficult.
Wherever you live, you may ask us to:
- Tell you what personal information we hold about you and where it came from.
- Give you a copy of it.
- Correct anything that is wrong.
- Delete it, except for the parts we are legally required to keep, such as the record of a completed sale.
- Stop using it for anything optional.
Email support@animalandfriends.com and we will respond within 45 days, usually much sooner. We may need to confirm you are the person whose address is on the order before we hand anything over. We will not charge you, and we will not treat you differently for asking. If we ever refuse a request we will tell you why, and you may appeal by replying to that message; if you are still unsatisfied you may complain to your state attorney general.
Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with consumer privacy laws have these rights by statute, and residents everywhere else have them here because we see no reason to draw the line differently. An authorised agent may make a request on your behalf with written permission.
10. We do not sell your information
We have never sold or shared personal information for money or for anything else of value, and we do not share it for cross-context behavioural advertising. We have no plans to. There is therefore nothing for you to opt out of, but if that ever changes we will say so here and give you a way to opt out before it takes effect.
11. Children
Our characters are cute, but this is a shop for people old enough to buy things. It is not directed to children under 13 and we do not knowingly collect information from them. If you believe a child has sent us their information, email us and we will delete it.
12. Security
The site is served over HTTPS. Card data never reaches us. The order database is reachable only over an encrypted connection with a verified certificate, and the owner dashboard is behind a password with rate limiting and a signed, HTTP-only session cookie. No system is perfect, and we will tell you promptly if we ever learn that your information has been exposed.
13. Visiting from outside the United States
We are based in the United States and we currently ship within the United States only. If you browse from elsewhere, your information is processed in the United States, where privacy law may differ from your own. Using the site means you understand that. If you are in the UK or the European Economic Area, you may still exercise the rights in section 9 by emailing us.
14. Changes to this policy
If we change this policy we will update the date at the top. If a change is significant, such as collecting something new or sharing with someone new, we will say so plainly on this page for at least 30 days.
15. How to reach us
ani mal and friends
support@animalandfriends.com
A real person, and one toad, answers.
See also our terms of service, our shipping and returns policy, and our accessibility statement.