What we know about you.

What we collect

When you order. Your name, email address, shipping address and order contents. Payment happens on Stripe's checkout page — we never see or store your card number. Stripe passes us a confirmation, the amount, and the shipping details you entered.

When you track an order. The order number and email you type into the tracking page, used only to match your order for that lookup.

When you email us. Whatever you put in the message, kept in our mailbox so we can answer you and handle any return.

Automatically. Our host records standard server logs, including your IP address, browser type and the pages requested. Links from social posts carry campaign tags (utm_source and similar) that tell us which post a visit came from, not who you are.

We do not run advertising trackers or analytics cookies on this site, and there is no account to create, so there is no password to lose.

The one thing stored on your device

Your bag is kept in your browser's local storage under drip-cart-v2 so it survives a refresh. It never leaves your device until you start checkout, and clearing your browser data removes it.

Who we share it with

Only the companies needed to complete your order:

Stripe — payment processing. They receive your payment and contact details directly and handle them under their own privacy policy.

CJ Dropshipping — fulfilment. They receive your name, shipping address and the items ordered so a warehouse can pack and post the parcel. They do not receive your payment details.

Vercel — hosting. Our site and server logs sit on their infrastructure.

Google Fonts — typefaces load from Google's servers, so Google receives your IP address when a page loads. Product images load from CJ's image CDN, which likewise sees your IP address.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We may disclose information if the law requires it.

How long we keep it

Order records are kept for as long as we may need them for tax, accounting and dispute purposes — generally seven years, which is the retention period our records obligations assume. Email correspondence is kept for up to two years. Server logs are kept for the shorter period our host retains them.

Your choices

Wherever you live, you can email us to ask what we hold about you, to have it corrected, or to have it deleted. If you are in California, the CCPA gives you the rights to know, delete, correct, and to opt out of sale or sharing — we do not sell or share, so there is nothing to opt out of, and we will not discriminate against you for asking. If you are in the EU or UK, you also have the rights to object, restrict, and to receive your data in a portable form.

We answer requests within 30 days. We may need to confirm your order number before releasing anything, so that we are not handing your details to someone else.

Deletion has one limit: we cannot delete records we are required to keep for tax purposes, and we cannot pull back data already passed to Stripe or the warehouse to complete an order you placed.

Children

This shop is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has given us data, email us and we will delete it.

Where your data goes

We operate from the United States and ship to U.S. addresses. Our fulfilment partner operates internationally, so your name and shipping address are processed outside the United States in order to dispatch your parcel.

Changes

If this policy changes we will update the date at the top of this page. Material changes affecting orders already placed will be emailed to the address on the order.