Privacy Policy

Who we are

Whimsey & Grace, a Mahjong Marketplace is operated by Karen Stuart out of Frisco, Texas. Email wgmahjong@gmail.com or message her through her Facebook page for anything privacy-related.

What we collect

The specific information we hold depends on what you do here:

• When you place an order: your name, shipping address, email, phone (if you give one), the items you bought, and the payment method. Card details never reach our servers — Shopify Payments (powered by Stripe) handles the card and returns a token to us, not the card number. If you choose Venmo, PayPal, or Zelle at checkout, we record only the handle you give us so Karen can match your payment.
• If you create a customer account: the same contact details, plus your order history so you can look up past purchases.
• If you subscribe to the newsletter: your email address, and which categories you said you were interested in. Subscription is opt-in; there's an unsubscribe link at the bottom of every email.
• If you ask to be notified when a sold-out item is back: your email address (we also store a one-way hashed copy so we can recognize it without reading it), the specific product and option you asked about, and — as a record that you asked us — the date, your IP address, and your browser type at that moment. This is separate from the newsletter: asking for a back-in-stock alert does not subscribe you to anything else, and you get a single email when that item returns. There is an unsubscribe link in it.
• If you leave items in your cart and we have your email: Shopify may send one or two abandoned-cart reminders. Unsubscribing from those is one click.
• If you just browse: our host, Vercel, records anonymous traffic data — pages viewed, rough country, browser type. This data does not identify you personally and is not joined with any account.

How we use it

• To pack, ship, and follow up on your order.
• To send transactional emails (order confirmation, shipping with tracking, refund confirmation).
• To send the newsletter, only if you subscribed.
• To help Karen answer questions about your order if you reach out.
• To keep records the IRS, Texas Comptroller, and our payment processor require us to keep.
• To fight fraud and chargebacks — Shopify and Stripe analyze transaction patterns; that's part of how card payments work.

We do not sell your information, share it with advertisers, or use it to track you across other sites.

Product reviews

• After a purchase, we email the buyer a private link to review what they bought. Only a verified buyer of that item can leave a review.
• A review stores your star rating, your written comment, and a display name that appears publicly on the product page in abbreviated form (for example, “Karen S.”). You can change or shorten that name — or leave it blank to show only “Verified Buyer” — on the review form.
• We store a one-way hashed version of your email with the review (never the plain address); it's only used to match the review to your purchase.
• You must be 18 or older to post a review, and reviews are shown only on this website — we don't send them to Google, the Shop app, or any other site.
• If you ask us to delete your data, we anonymize your reviews — we remove your name and hashed email but keep the rating and comment. We're allowed to keep that content under GDPR Article 17(3)(b)/(e), because U.S. review-integrity law (the FTC's 2024 rule) requires us not to quietly delete genuine reviews. The kept review no longer identifies you by name.

Services we use

• Shopify runs the store, the checkout, the customer account system, and Shopify Email (the newsletter tool). See Shopify's privacy policy.
• Shopify Payments (powered by Stripe) processes credit and debit card transactions. They handle the card data; we never see the card number. See Stripe's privacy policy.
• Venmo, PayPal, and Zelle are manual payment options at checkout. If you pick one, the actual money movement happens inside those apps under their own privacy policies — we just record the order and mark it paid when your transfer arrives.
• Vercel hosts the website and provides anonymous traffic analytics. See Vercel's privacy policy.
• Cloudflare manages our domain name and DNS. See Cloudflare's privacy policy.
• Cloudflare Turnstile runs a silent, invisible check on the back-in-stock form to keep bots from abusing it. As a condition of using it we point you to Cloudflare's Turnstile Privacy Addendum.
• Neon (database) and Upstash (rate-limiting) store the back-in-stock waitlist and keep the form from being flooded. They hold only what's described above and never receive payment or card data.

Cookies

Shopify sets cookies that make the cart work — without them, the store can't remember what you've added between pages. Shopify may also set a small number of cookies for security and fraud prevention on checkout. We don't run advertising cookies and we don't use cross-site tracking pixels.

How long we keep things

• Order records — kept as long as the IRS and Texas Comptroller require us to keep business records (at least seven years).
• Customer accounts — kept until you ask us to delete them. Even after deletion, the order records themselves stay (with name and address) because tax law says so.
• Newsletter subscription — kept until you unsubscribe, then removed from the sending list. We may retain a "suppression" record (an email address or a one-way hash of it) so we don't accidentally email you again.
• Back-in-stock requests — kept until the item comes back and we notify you, until you unsubscribe, or for up to 180 days, whichever comes first; then the request expires. If an email to you ever bounces or is marked as spam, we keep a one-way hashed "suppression" record so we never email that address again — that record has no name attached and exists only to protect you and our sending reputation.
• Web analytics — Vercel's retention policy governs this; it's anonymous and not joined with any account.

Your choices

• Unsubscribe from the newsletter using the link at the bottom of any email.
• See, correct, or delete your data. Email wgmahjong@gmail.com and Karen will pull what we have on file, fix anything that's wrong, or delete it. We'll keep records the law requires us to keep, but everything else can go.
• Close your account. Same email address — Karen handles it personally.

Children

This site isn't directed at children under 13, and we don't knowingly collect information from them. If you believe a child has provided us with information, email Karen at wgmahjong@gmail.com and we'll delete it.

Changes to this policy

If we change anything material, we'll update this page and bump the "Last updated" date at the top. For changes that affect existing customers in a significant way, we'll email a heads-up before they take effect.

Questions

Email wgmahjong@gmail.com. Karen reads every message herself.