Legal
Privacy policy
This policy explains how Rooted Branch Workshop, LLC (referred to here as “Rooted Branch Workshop,” “we,” “us,” or “our”) handles personal information when you browse the site, create an account, place an order, download a file, request a quote, subscribe to promotional email, or contact the workshop. It is effective August 15, 2026.
Information you provide
We receive information you choose to provide, including your name, email address, account details, promotional-email request and preference, order and shipping information, the policy versions and acceptance timestamps associated with an order or accepted quote, support messages, quote-request details, and files, links, or references you include in a request. Stripe processes payment-card details; Rooted Branch Workshop does not receive or store your complete card number or security code.
Google sign-in data
If you choose Google sign-in, Google and our authentication provider, Clerk, may provide the basic identity information you authorize, such as your name, email address, profile image, and account identifiers. We use that information only to authenticate and secure your account, display account details, prefill forms, and match eligible orders and downloads to your verified email. We do not request access to Gmail, Google Drive, Google Contacts, or Google Calendar.
Information collected automatically
When you use the site, our hosting and security systems may receive network and request information such as your IP address, browser or device details, request headers, requested pages, timestamps, and error or security events. Public support and quote requests use the IP address to derive a keyed one-way rate-limit identifier; the raw IP address is not intentionally stored in that rate-limit record. We use this information to deliver the site, prevent abuse, investigate failures, and protect customers and the service.
How information is used
We use personal information to operate and secure accounts, process and fulfill orders, verify shipping addresses, deliver digital files, send transactional messages, provide support, prepare custom-service quotes, prevent fraud and abuse, troubleshoot errors, maintain required business records, and improve the reliability of the service. When you explicitly request and then confirm promotional email, we also use your email address to send occasional workshop news, new-product announcements, seasonal sales, and special offers.
Shipping-address verification
For an order that will be shipped, the completed name, United States shipping address, and phone number are sent to EasyPost before payment so the address can be checked and, when appropriate, a correction can be suggested. A correction is never applied silently. We do not store an incomplete address draft or an EasyPost address object in our order database. After checkout, we keep the customer-selected shipping address and limited verification evidence with the order. If EasyPost is temporarily unavailable and the customer explicitly continues with the entered address, the order is flagged for address verification before a shipping label can be rated or purchased.
Cookies and local storage
The site uses cookies and browser storage that are necessary for authentication, customer-support sessions, guest-checkout confirmation, cart and checkout continuity, and security. We do not currently use third-party advertising cookies or behavioral advertising trackers.
Service providers
We use service providers to run the site: Clerk and Google for optional account authentication; Stripe for checkout, payment, refunds, and eligible promotion codes; EasyPost for shipping-address verification, rates, labels, and carrier tracking; Supabase for orders, download entitlements, file metadata, support records, promotional-email consent and suppression records, and operational data; Cloudflare R2 for private customer and quote file storage; Resend and the workshop mailbox provider for transactional, support, and confirmed promotional email; Vercel for application hosting; and Sanity for catalog content and images. They process information only as needed to provide their services and under their own applicable terms and privacy commitments.
When information is shared
We share information with the service providers above, when needed to complete a transaction or respond to you, when required by law or a valid legal process, to protect customers or the service, or as part of a business transfer. We do not sell personal information or share it for cross-context behavioral advertising.
Retention
We keep information for as long as reasonably needed to provide the service, maintain financial and transaction records, preserve the policy version and acceptance evidence for an order or accepted quote, resolve disputes, enforce agreements, meet legal obligations, and protect the service. Promotional-email consent and withdrawal evidence and suppression records are retained as needed to prove and honor your preference; unsubscribing does not erase transaction or support records. An uploaded file that is never submitted is deleted after 7 days. Files attached to open quotes, active conversations, and active custom projects are not automatically deleted. File bytes for declined or closed quotes and closed non-quote conversations are deleted after 12 months; file bytes for completed or cancelled custom projects are deleted after 24 months. The timeline keeps a metadata tombstone after file deletion so the business record remains understandable. Short-lived session, email-delivery, and operational records expire or are purged on bounded schedules. Some transaction and security records may need to remain after an account or conversation is closed.
Your choices
You may update supported account details through the account interface or contact us to ask about access, correction, or deletion of personal information. Promotional email is optional, uses double opt-in, and can be turned off from an email unsubscribe link or your account profile without affecting receipts, fulfillment, account-security, or support messages. We will honor applicable rights after verifying the request, subject to records we must keep for legal, transaction, fraud-prevention, preference-suppression, or security reasons. You may choose another available sign-in method instead of Google sign-in.
Security and children
We use access controls, private storage, signed links, scoped sessions, forced downloads, and other safeguards designed to protect personal information, but no system is completely secure. Allowed file types receive format and header validation but are not represented as malware-scanned or malware-free; use normal care when downloading files. The shop is intended for adults and is not directed to children under 13. If you believe a child provided personal information, contact us so we can review and remove it when appropriate.
Policy changes
We may update this policy when the service or our data practices change. The effective date above will be revised, and material changes will be communicated when required. Continued use after an update is subject to the revised policy.
Questions are welcome. Use the site chat, or email info@rootedbranchworkshop.com.