Privacy Policy

Shuttlebrook Woolen Mill (“Shuttlebrook,” “we,” “us”) operates shuttlebrookwoolenmill.shop, with its office at 196 Bermuda Lakes Dr, Meridianville, AL 35759. This policy explains what personal information we collect when you visit the site, place an order or contact us, why we collect it, who it is shared with, and the choices you have. It applies to the website and to orders placed by telephone.

1. Who we are

The business responsible for your information is Shuttlebrook Woolen Mill LLC, 196 Bermuda Lakes Dr, Meridianville, AL 35759, United States. Our privacy contact is support@shuttlebrookwoolenmill.shop or (256) 323-5103.

2. Information we collect

Information you give us

• Order information — name, shipping address, billing address, email address and telephone number.
• Payment information — card details are entered on our checkout page and transmitted directly to our payment processor. We receive only the card brand, the last four digits, the expiry month and year, the authorisation result and a token that lets us issue refunds. We never receive or store the full card number or the security code.
• Account and marketing information — an email address if you join the mill letter, and any preferences you set.
• Correspondence — the content of emails, contact-form messages and telephone notes, including anything you tell us about a return, a repair or a gift.

Information collected automatically

• IP address, browser type and version, operating system, device type and screen size.
• Pages viewed, referring URL, search terms used on the site, and the time and duration of each visit.
• Cart contents stored in your browser, and identifiers set by cookies and similar technologies (see section 6).

Information from others

Our payment processor and fraud-prevention tools return risk scores and address-verification results. Shipping carriers return delivery status. Analytics partners may provide aggregated audience information. We do not buy personal information from data brokers.

3. How we use it

• To take, authorise, process, ship and invoice your order, and to handle returns, exchanges and repairs.
• To communicate with you about an order, answer a question, or resolve a problem.
• To detect, investigate and prevent fraud, chargebacks and abuse, and to comply with legal obligations including tax and customs rules.
• To send marketing email if you asked for it, and to measure how those messages perform. Every marketing email carries an unsubscribe link.
• To understand how the site is used, fix faults, and improve the catalogue, navigation and checkout.
• To establish, exercise or defend legal claims.

Where the law requires a legal basis, we rely on performance of a contract for order processing, legitimate interests for security, fraud prevention and site improvement, consent for marketing email and non-essential cookies, and legal obligation for tax and accounting records.

4. Payments and Stripe

Card payments on this site are processed by Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, California 94080, United States, which acts as an independent controller of the payment data it collects. When you pay:

• Card data is collected in fields hosted and served by Stripe and transmitted to Stripe over TLS. It does not pass through our servers in readable form.
• Stripe receives your card number, expiry date, security code, billing address, purchase amount, IP address and device information in order to authorise the payment and run its own fraud checks.
• We receive from Stripe a payment identifier, the card brand, the last four digits, the expiry, the authorisation result, and the billing name and postal code used for address verification. We use those to reconcile the order, issue refunds and answer disputes.
• Stripe may use the data it collects for its own purposes as described in the Stripe Privacy Policy, including fraud prevention and meeting its obligations as a regulated payment institution.

Our checkout is built so that we never handle primary account numbers directly, which keeps us within the scope of PCI DSS SAQ A. If you pay by wire or cheque for a trade order, we hold only the banking reference needed to match the payment.

5. Who we share it with

We do not sell your personal information. We share it only with the parties below, and only with what they need:

• Payment processing — Stripe, Inc., and the card networks and issuing banks involved in your transaction.
• Shipping and fulfilment — UPS, FedEx and the United States Postal Service, for the name, address, telephone number and parcel contents needed to deliver your order.
• Technology providers — our website host, email delivery service, support desk and backup provider, each under a written agreement limiting them to processing on our instructions.
• Analytics and advertising — only where you have accepted the relevant cookies.
• Professional advisers and authorities — accountants, auditors, insurers and lawyers, and any court, regulator or law-enforcement body where we are legally required to respond.
• A successor — if the mill is sold or merged, customer records may transfer with the business. We would notify you before your information became subject to a materially different policy.

6. Cookies and tracking

We use three kinds of storage in your browser:

• Strictly necessary — your cart contents, session, security tokens and fraud signals. The site cannot work without these and they are set without asking.
• Preference — remembering filters, the department you last browsed and notices you dismissed.
• Analytics and advertising — measuring traffic and campaign performance. These are set only with your consent, which you can withdraw at any time from the cookie link in the footer.

Most browsers let you refuse or delete cookies in their settings. Blocking the strictly necessary ones will break the cart and checkout. We honour Global Privacy Control signals as an opt-out of sharing for targeted advertising wherever applicable law recognises them.

7. How long we keep it

• Order and payment records: seven years, to satisfy tax, accounting and chargeback rules.
• Customer-service correspondence: three years from the last message.
• Marketing subscriptions: until you unsubscribe, then a suppression record so we do not contact you again.
• Website analytics: twenty-six months in identifiable form.
• Server and security logs: twelve months.

8. Your privacy rights

Subject to your location and to verification of your identity, you may ask us to:

• confirm what personal information we hold about you and give you a copy;
• correct information that is inaccurate or incomplete;
• delete information we no longer have a lawful reason to keep;
• restrict or object to a particular use, including profiling for marketing;
• receive your information in a portable, machine-readable format;
• withdraw consent you previously gave, without affecting what we did before.

Write to support@shuttlebrookwoolenmill.shop. We answer within 30 days, or tell you why we need up to 60. We will not treat you differently for exercising a right. You may use an authorised agent; we will ask for proof of their authority.

9. California residents

Under the California Consumer Privacy Act as amended by the CPRA you have the rights listed in section 8, plus the right to know the categories of personal information collected, the sources, the business purpose, and the categories of third parties they were disclosed to. In the last twelve months we collected identifiers, customer records, commercial information, internet activity and coarse location inferred from IP address, for the business purposes in section 3, and disclosed them to the categories of recipients in section 5.

We do not sell personal information and we do not share it for cross-context behavioural advertising in the sense the CPRA gives those terms. We do not use or disclose sensitive personal information for purposes that would require a limitation notice. To submit a request, email support@shuttlebrookwoolenmill.shop with “California privacy request” in the subject line, or call (256) 323-5103.

10. EEA, UK and Swiss visitors

We ship to the United States and Canada, but the site can be reached from anywhere. If you are in the European Economic Area, the United Kingdom or Switzerland, your information is transferred to and stored in the United States. For those transfers we rely on the European Commission's Standard Contractual Clauses and the UK Addendum with our processors, together with supplementary measures including encryption in transit and at rest. You may lodge a complaint with your national supervisory authority.

11. Children

The site is intended for adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to support@shuttlebrookwoolenmill.shop and we will delete it.

12. Security

The site runs over TLS. Access to order records is limited to the staff who need it, protected by unique accounts and multi-factor authentication. Backups are encrypted. Card data never reaches our systems. No method of transmission or storage is perfectly secure, so if we learn of a breach affecting your information we will notify you and the relevant regulators as the law requires.

13. Changes to this policy

When this policy changes we update the date at the top of the page. If a change materially affects how we use information we already hold, we will notify you by email or with a notice on the site before it takes effect.

14. How to reach us

Shuttlebrook Woolen Mill LLC
196 Bermuda Lakes Dr
Meridianville, AL 35759
United States
Email: support@shuttlebrookwoolenmill.shop
Telephone: (256) 323-5103
Hours: Monday to Friday, 8 a.m. to 5 p.m. Central