What we collect
- Orders: your name, delivery email, the items you bought, amounts, your order reference and delivery status.
- Payments: Stripe handles your card details on its own secure page. We receive the payment result and Stripe’s payment references, never your full card number.
- Chats and messages: what you send in a service chat or through the Contact page, including your name and email.
- Reviews: the name or handle, rating and text you submit. Approved reviews are shown publicly on the site.
- Security data: to stop abuse we record request counts against a scrambled (one-way, keyed) version of your IP address or email, not the address itself. These records are deleted after about two days.
- Site analytics: a random visitor ID stored in your browser and the general area of the site you viewed (for example “a product page”). We use this only for visit counts. We do not use advertising trackers or third-party analytics.
Cookies and browser storage
We only use storage the site needs to work:
- Chat access cookies keep you signed in to My Service after you verify your email, and can remember chats on this device for up to 30 days if you choose.
- Browser storage keeps your cart, your light or dark mode choice, your visitor ID, saved chat links and any checkout you have in progress.
- Staff sign-in cookies are used only in the staff area.
We do not use advertising or cross-site tracking cookies. Clearing your browser data removes everything stored on your device.
How we use it
- to deliver your codes and services and send order emails;
- to answer your messages and give support;
- to prevent fraud, abuse and stock hoarding;
- to keep the records we need for accounting, tax and disputes;
- to understand overall site traffic.
Who helps us
We do not sell your personal information. We share it only with the providers that run parts of the store for us:
- Stripe processes payments and refunds.
- Supabase hosts our database and file storage.
- Resend sends our emails.
- Vercel hosts the website.
- Cloudflare may run a bot check at checkout.
Each provider handles data under its own terms and privacy policy. We may also share information when the law requires it, or to protect customers and the store from fraud.
How long we keep it
We keep order and payment records for as long as we need them for accounting, tax, disputes and fraud prevention. Chats and contact requests are kept while they are useful for support and order history and may be removed sooner. Security records are deleted after about two days, and remembered-device access ends after 30 days.
Your choices
You can ask us for a copy of your information, ask us to correct it, or ask us to delete it by contacting us. We may need to keep some records, such as payment history, where the law requires it. You can also clear your browser data at any time.
Security
The site uses HTTPS, digital codes are encrypted before they are stored, and only authorized staff can see order and chat details. No system is perfectly secure, so please keep your order emails and private links to yourself.
Children
BirdShop is not meant for children under 13, and we do not knowingly collect their information. If you think a child has sent us personal information, contact us and we will remove it.
Changes to this policy
We may update this policy as the store changes. The date at the top shows the latest version.