Privacy Policy
Last updated 23 August 2026
Introduction
Hearthsweep ("we", "us") operates hearthsweep.store. This policy explains what personal information we collect, why, who we share it with, and the rights you have over it. It applies to residents of the United States, the only market we sell to.
1. What we collect
Directly from you
- Identifiers: name, shipping address, billing address, email, phone number
- Order data: items purchased, order number, order history, RMA and support tickets
- Communications: emails, contact-form messages, product reviews, survey answers
- Account credentials: your email and a hashed password. Log-in credentials are "sensitive personal information" under California law, as is anything sensitive you choose to put in a support message. We use both only to run your account and to answer you — never to infer characteristics about you, and never for advertising
Automatically
- Device and network data: IP address, browser, operating system, device identifiers
- Usage data: pages viewed, referring URL, search terms, items viewed, session length
- Cookies and similar technologies — see Section 6
From third parties
- Stripe: card brand, last four digits, authorization result, billing ZIP
- Shipping carriers: delivery status, address corrections
- Fraud-prevention and address-verification services
- Analytics and advertising partners
We never see or store your full card number. Checkout is processed by Stripe, a PCI-DSS Level 1 provider. Card details go straight to Stripe and never touch our servers.
We do not knowingly collect information from children under 13. If we learn that we have, we delete it — email support@hearthsweep.store. We also do not knowingly sell or share the personal information of anyone under 16, as Cal. Civ. Code §1798.120(c) requires.
2. Why we use it
| Purpose | Examples |
|---|---|
| Fulfil your order | Payment, dispatch, tracking, returns, warranty claims |
| Customer service | Answering questions, resolving disputes |
| Fraud prevention and security | Address verification, chargeback defense, account protection |
| Legal compliance | Tax and accounting records, sales tax remittance, lawful requests |
| Improving the store | Analytics, merchandising, inventory decisions |
| Marketing | Email campaigns, advertising and retargeting — with the opt-outs in Section 5 |
We rely on your consent for marketing, and on the necessity of performing our contract with you for everything required to deliver your order.
3. Who we share it with
We share personal information with service providers who act only on our instructions: Stripe (payments), shipping carriers and fulfilment partners, email and marketing platforms, analytics and advertising providers, customer-support tools, hosting and IT vendors, and fraud-prevention services.
We also disclose information when required by law — subpoena, court order, or lawful government request — to enforce our Terms & Conditions, to protect rights and safety, and in connection with a merger, acquisition, or sale of assets, in which case we will notify you.
We do not sell your personal information for money. We do, however, share personal information for cross-context behavioral advertising, and under California and several other state laws our use of advertising and analytics cookies is treated as a "sale" as well as "sharing".
In the preceding 12 months we sold or shared these categories: identifiers (device and cookie identifiers, IP address) and internet or network activity (pages viewed, products viewed, search terms), disclosed to advertising networks and analytics providers for cross-context behavioral advertising. We have not sold or shared sensitive personal information, and we do not sell or share the personal information of anyone we know to be under 16. You can opt out at any time — see our Your Privacy Choices page.
4. How long we keep it
| Data | Retention |
|---|---|
| Order and transaction records | 7 years (tax and accounting) |
| Support tickets and RMAs | 3 years |
| Marketing contacts | Until you unsubscribe, plus a suppression record so we do not re-contact you |
| Server and security logs | 12 months |
| Analytics data | 26 months |
5. Your rights and choices
Everyone can:
- Unsubscribe from marketing email using the link in any message, or by emailing support@hearthsweep.store
- Reply STOP to any marketing SMS to opt out, or HELP for help. You may also withdraw consent by any reasonable means — including replying with any other word that reasonably signals you want them to stop, emailing us, or telling us by phone. We honor a withdrawal within 10 business days. Message and data rates may apply. Consent to marketing texts is never a condition of purchase
- Opt out of sale, sharing, and targeted advertising on our Your Privacy Choices page, or by sending a Global Privacy Control (GPC) signal, which we honor automatically
Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws also have the right to:
- Know and access the personal information we collect, use, and disclose
- Correct inaccurate information
- Delete your personal information, subject to legal exceptions — we must retain completed order records for tax purposes
- Portability — receive your data in a portable, machine-readable format
- Opt out of sale, sharing, targeted advertising, and profiling that produces legal or similarly significant effects
- Limit the use of sensitive personal information
- Non-discrimination — exercising a right never costs you a worse price or worse service
How to exercise a right. Use our Your Privacy Choices page, which collects every option in one place, or email support@hearthsweep.store with "Privacy Request" in the subject line. We verify your identity by matching the details you give against our records; for deletion of order history we may ask you to confirm from the email address on the order. We confirm receipt within 10 business days and tell you how we will handle the request. We then respond substantively within 45 days, and may extend once by a further 45 days with notice to you. An opt-out of sale or sharing is actioned within 15 business days. An authorized agent may submit a request with your written permission and proof of your identity.
Appeals. If we decline, reply to our decision with "Privacy Appeal". We respond within 45 days (60 days in Virginia and Connecticut). If we deny the appeal, you may contact your state Attorney General.
California Shine the Light (Civ. Code §1798.83): California residents may request, once a year and free of charge, both the categories of personal information we disclosed for third parties' own direct marketing in the prior calendar year and the names and addresses of those third parties. We respond within 30 days of a request sent to the address below, or within 150 days if it reaches us by another route.
6. Cookies and tracking
We use four categories:
- Strictly necessary — cart, checkout, login, security. These cannot be switched off; blocking them breaks checkout.
- Functional — remembers preferences such as your region and recently viewed products.
- Analytics — how the store is used, so we can improve it.
- Advertising — measuring campaigns and showing relevant ads on other sites.
Manage your choices on our Your Privacy Choices page, at https://hearthsweep.store/cookies, or in your browser settings. We honor GPC signals as a valid opt-out of sale and sharing. We do not respond to legacy "Do Not Track" headers, which have no agreed standard.
7. Security
We protect personal information with TLS encryption in transit, encryption at rest, hashed passwords, role-based access limiting staff to what their job requires, and regular reviews. No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities within the timeframes your state's breach-notification law requires.
8. Third-party links
Our site links to manufacturer sites and carriers, and Stripe. Their privacy practices are their own — read their policies before providing information.
9. Changes to this policy
Changes are posted here with a new "Last updated" date. Material changes will be announced by email or a site notice at least 14 days before they take effect.
10. Contact
Hearthsweep — Attn: Privacy
1812 Roanoke Ave, 40205 Louisville, Kentucky, United States
support@hearthsweep.store · +1 (970) 666-8417 · Monday–Friday, 9:00 AM – 6:00 PM