Privacy Policy

1. Information we collect

We collect only what we need to respond to you and run our small business:

• Information you give us: name, email, phone, and message details when you fill out our contact or custom order form, or email us directly.
• Automatically collected: basic browser and device information, pages visited, and approximate location (country/city level), through our website analytics.
• Cookies: see our Cookie Policy for details.

2. How we use your information

We use your information only to: respond to your inquiry, fulfill custom orders, ship products, send you order updates, send our monthly newsletter (only if you signed up), and improve the website. We do not sell, rent, or trade your personal information to anyone, ever.

3. Legal basis (GDPR)

If you are in the European Economic Area or UK, our legal basis for processing your personal data is: (a) your consent (newsletter, optional cookies); (b) the performance of a contract (fulfilling your order); (c) our legitimate interest in running and improving a small craft business.

4. Your rights (GDPR & CCPA)

You have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; object to processing; request data portability; and lodge a complaint with a supervisory authority. California residents have the right to know what personal information is collected, request deletion, and opt out of any sale (we don't sell). To exercise any right, email bing@kashmiradesign.com.

5. Data retention

We keep contact form messages for up to 24 months. Order records are kept for 7 years for tax purposes. Newsletter subscribers are kept until you unsubscribe.

6. Sharing with third parties

We share information only with service providers we need to run the business: USPS for shipping, Stripe or PayPal for payment processing on custom invoices, our email host. Each provider only receives the minimum data needed.

7. Security

We use industry-standard security measures, including HTTPS encryption on all pages and limited access to personal data. No system is perfectly secure, but we work hard to protect your information.

8. Children

Our website is not intended for children under 16. We do not knowingly collect data from children.

9. Changes to this policy

We'll post any updates here with a new "Last updated" date. Material changes will be announced via our newsletter.