Privacy POlicy

Last Updated: 11/10/2026

1. Who we are

Scars and Stitches Clothing Company LLC (“Scars & Stitches,” “we,” “us,” or “our”) operates https://shopscarsandstitches.com and is the controller of personal information used to operate our store.

Scars and Stitches Clothing Company LLC
1121 Virginia Street East
Charleston, West Virginia 25301, United States
Email: trav@scarsandstitches.shop

This policy explains our handling of personal information when you browse, purchase, request a custom product, subscribe to emails, or contact us. It does not treat your use of our website as consent to optional tracking or marketing.

2. Information we collect

We collect information you provide, including your name, email, billing and delivery addresses, telephone number where requested, order details, customization selections, text instructions, photos, and messages. Newsletter records include your subscription preferences and information needed to record and confirm your subscription.

Our website and providers also process technical information such as IP addresses, device and browser details, security logs, shopping-cart/session information, and consent preferences. With applicable consent, Google Analytics processes information about visits and interactions, including pages viewed, referring sources, and device information.

We receive payment confirmations and limited transaction details from Square, delivery and tracking information from shipping services, and email delivery information from MailPoet. We do not intentionally store complete payment-card numbers on our website; Square processes payment details.

Purchases use guest checkout; we do not offer customer account registration.

Our contact form sends your message to our email inbox. It is not intended to retain submissions in the website database. The resulting email and any replies remain personal information covered by this policy.

3. Purposes and legal bases

Where GDPR applies, we rely on the following bases as appropriate to the activity:

Purpose	Legal basis
Taking orders, processing payment, producing custom items, arranging delivery, and handling purchase-related requests	Performance of our contract with you or steps you request before entering a contract
Sending necessary order, payment, and shipping communications	Performance of our contract with you
Responding to other inquiries	Pre-contractual steps where you inquire about a purchase; otherwise our legitimate interest in responding to communications
Website security, fraud prevention, dispute handling, and necessary business administration	Our legitimate interests in protecting customers, operating a secure business, and establishing or defending claims, subject to your rights
Recordkeeping required by applicable EU or Member State law	Compliance with the relevant legal obligation
Other necessary financial recordkeeping, including US requirements	Our legitimate interests in maintaining business records and meeting obligations applicable to our US business, subject to your rights
Newsletters and optional analytics or embedded tracking	Your consent where required
Recording and honoring privacy and consent choices	Applicable legal obligations and our legitimate interest in demonstrating and respecting your choices

We require certain contact, payment, shipping, and customization details to fulfill an order. If you do not provide necessary information, we may be unable to process or deliver it. Newsletter subscriptions and optional tracking are not required to purchase.

4. Custom orders and photos

We use your text instructions and photos to understand, create, and fulfill your custom order and address related customer-service requests. Authorized website support and production personnel may access this information as described below.

Please do not submit medical information or other sensitive personal details. You do not need to disclose diagnoses, treatment, trauma, or other private experiences to purchase a custom product. Please provide only the information needed to describe your requested design, and submit other people’s information only where you are entitled to do so.

Finished products may be photographed for promotional purposes and published to social media without any identifying characteristics of the customer who placed the order.

5. Payments, delivery, and service providers

We share information as necessary for the following purposes:

Square: payment processing, refunds, transaction management, and fraud prevention. Square also processes information under its own applicable privacy notice: https://squareup.com/us/en/legal/general/privacy-no-account.
Shippo and shipping carriers: shipping rates, labels, delivery, and tracking. The 1Team Shippo plugin connects our WooCommerce store to Shippo.
The Shirt Gallery: merchandise production and fulfillment. Its authorized administrator account currently has access to the store’s orders and customer uploads, including information beyond individual merchandise orders.
Hostinger: hosting, website infrastructure, and backups.
Courts Creative LLC: authorized website administration, maintenance, and support, including administrative access to orders and uploads.
MailPoet Sending Service: delivery of transactional emails and newsletters. Transactional messages can include customer and order information needed for those communications.
Google: analytics where the applicable consent has been provided.
Elfsight and TikTok: delivery of embedded video content and related processing described below.
Professional advisers and authorities: where necessary for advice, legal obligations, or the establishment or defense of legal claims.

WordPress and WooCommerce provide the website and store software. Bit Integrations transfers newsletter signup names and email addresses to MailPoet. Live Carts supports cart management; its email-capture feature is disabled and we do not send abandoned-cart recovery emails.

6. Newsletters and transactional emails

Newsletter subscriptions require confirmation of the email address. Checkout customers are subscribed only when they separately opt in. We do not use MailPoet email-open or link-click tracking, and we have not configured purchase-based marketing segmentation or purchase-triggered marketing campaigns.

You can unsubscribe using the link in a marketing email or contact us. This does not stop necessary transactional messages about your orders or requests. We retain limited suppression information where necessary to honor an unsubscribe request.

7. Cookies, analytics, and embedded videos

We use essential technologies to operate the store, maintain carts, support checkout, secure the website, and remember consent choices. Optional analytics and embedded services are controlled through Complianz where consent is required.

Google Analytics helps us understand website use. Elfsight displays embedded TikTok videos. Loading an embed may allow Elfsight and TikTok to receive technical information, including an IP address and browser information, and to use cookies or similar technologies. Facebook embeds are not currently included in this description and will be assessed before introduction.

See our Cookie Policy for the current cookie inventory, purposes, providers, and durations. Rejecting optional technologies does not prevent purchasing, although embedded videos may remain unavailable.

8. Retention

Information	Retention
Completed order records	Five years from the date the order is placed
Failed or canceled order records	One year from the date the order is placed
Abandoned cart records	Two days from cart creation
Uploaded photos where no order is placed	Three days from upload
Uploaded photos associated with a shipped order	Until 30 days after shipment
Uploaded photos associated with an order that never ships	30 days from the date the order is placed
Customization text instructions	Retained with the order; five years from placement for completed orders and one year from placement for failed or canceled orders
Contact emails and replies	Five years from receipt
Newsletter information	While subscribed and as needed to administer the subscription.

Abandoned cart deletion and abandoned photo deletion have different schedules, so an uploaded photo may remain for the additional day. We may retain information longer where specifically necessary for a legal obligation or a legal claim. Deletion rights are subject to applicable exceptions.

9. International processing

We operate in the United States. Our providers may process personal information in the United States and other countries. Where a transfer outside the EEA is subject to GDPR transfer requirements, the applicable transfer mechanism and safeguards must be identified.

10. Your rights

Where GDPR applies, you may request access, correction, deletion, restriction, or portability of your personal information, subject to the conditions of each right. You may object to processing based on legitimate interests on grounds relating to your situation, and you may object to direct marketing at any time.

Where processing relies on consent, you can withdraw consent at any time without affecting processing that was lawful before withdrawal. Use Cookie settings for website consent choices, the unsubscribe link for newsletters, or contact us.

Send requests to trav@scarsandstitches.shop. We may request proportionate information to verify identity. We generally respond within one month. Where permitted, a complex or numerous request may take up to two additional months; we will explain an extension within the initial month. Requests are generally free, subject to the legal rules for manifestly unfounded or excessive requests.

You may complain to a competent data protection supervisory authority, particularly in the EU/EEA country of your habitual residence, workplace, or the alleged infringement. You do not have to contact us first.

11. Security and automated decisions

We use appropriate technical and organizational safeguards and restrict access to authorized personnel. No system can guarantee absolute security.

12. Children

Our store is not directed to children under 13, and we do not knowingly collect information directly from children under 13. Please contact us if you believe a child has submitted information. This statement does not replace applicable European protections for children or country-specific consent rules.

13. Changes

We may update this policy to reflect changes in our practices or applicable requirements. We will update the effective date and provide additional notice where required. Where a change requires consent, we will obtain that consent rather than treating continued website use as permission.