Privacy Policy

• Contact and order details: name, email, phone, company, billing and shipping addresses, and the sizes, quantities, and colors you ask for.
• Artwork files: logos, designs, and reference images you upload through our quote and order forms.
• Account sign-in: your email address. Sign-in is a one-time link, so there is no password to store.
• Payment records: the amount, date, status, and last four digits of the card. See Payments.
• Usage data: IP address, browser and device type, pages visited, and the site you came from.
• Product analytics, if you accept tracking: which pages and features you use, clicks, and session recordings. See Cookies and tracking.

• Produce, ship, and follow up on what you ordered.
• Send order updates, invoices, and customer service messages.
• Send marketing email only to people who opted in. Every one of those has an unsubscribe link.
• Understand how the site performs and where visitors come from.
• Measure which ads bring customers in, and show our ads on Google, Facebook, and Instagram to people who already know us. See Advertising with our customer list.
• Detect and prevent fraud, abuse, and violations of our Terms.
• Meet legal and tax obligations, and enforce our agreements.

Card numbers are never stored on our servers and never pass through them. Online payments are entered on a page hosted by PAYARC, our payment processor, who is responsible for handling and securing card data.

What we keep is the record of the transaction: amount, date, status, and the last four digits, tied to your order so both sides have the same history.

We do not sell your personal information. We share the minimum needed with the vendors that let us run the business. All of them store data in the United States.

• Printavo: order management, quotes, invoices, and production records.
• PAYARC: card payment processing.
• OrderMyGear: team and group pop-up stores, when you order through one.
• InkSoft: apparel product catalog.
• Cloudflare: content delivery, security, and storage of the artwork files you upload.
• Railway: application and database hosting.
• Resend: sending order confirmations, sign-in links, and opted-in marketing email.
• Klaviyo: marketing email to people who opted in, and a record of quote requests so follow-up emails reach the right people.
• Sanity: editable site content and the staff allowlist.
• PostHog: product analytics and session recording, only if you accept tracking. It also receives a record of each quote and contact form submission, so we can see which pages lead to a request.
• Sentry: error monitoring, so we find crashes. Error reports can include your browser, page, and IP address.
• Google and Meta: website analytics, advertising measurement, and ad audiences. What they receive, and when, is described in Cookies and tracking and Advertising with our customer list.
• Anthropic: powers the website chat assistant if you use it. Only what you type is sent. We do not pass your account or order records into it.

We may also disclose information when the law requires it (subpoena, court order, government request), or when it is necessary to protect the rights, property, or safety of our company, our customers, or others.

We share customer contact details with Google and Meta so our ads can be measured and shown to the right people. They process it to provide these advertising services to us. In practice that means:

• Quote and contact forms. When you submit one, we may send Google and Meta your email address and phone number so they can tell us whether an ad led to the request.
• Customer lists. We may upload the email addresses and phone numbers of existing customers to Google Customer Match and Meta Custom Audiences. That lets us show our ads to people who already know us, or leave them out of ads meant for new customers.

Before any of it leaves our systems, email addresses and phone numbers are converted into a one-way code (a SHA-256 hash), so Google and Meta receive a scrambled version, not the address itself. They use it only to find a match among their own users.

Leaving it out. Pressing Reject on our cookie banner, or browsing with Global Privacy Control turned on, stops form submissions from being shared this way. To be left out of customer list uploads, use our data request page and choose “Opt out of marketing email and ad matching,” or email [email protected]. We remove you from the next upload.

A banner asks on your first visit. What happens before you answer depends on where you are:

• In the European Economic Area, the UK, and Switzerland, all analytics and advertising tracking stays off until you accept.
• Everywhere else, including the United States, Google Analytics and Google’s advertising tag are on until you press Reject. The Meta Pixel and PostHog stay off until you accept.

The three kinds of cookies and tracking on the site:

• Strictly necessary: sign-in and security cookies. These always run, because the site cannot work without them, and they are not used to track you across other sites.
• Product analytics via PostHog: which pages and features get used, clicks, and session recordings, which replay how a page was used so we can find what is broken or confusing. Recordings capture interaction with the page, not the contents of password fields or payment forms, and card entry happens on PAYARC’s site rather than ours.
• Advertising and site analytics via Google Analytics, Google’s advertising tag, and the Meta Pixel: measures which ads and sources bring people here, and lets us show ads on Google, Facebook, and Instagram.

Changing your mind. Use the “Cookie Preferences” link at the bottom of any page to bring the banner back and change your answer. You can also opt out of Meta’s targeting at facebook.com/adpreferences, and out of Google Analytics with the opt-out browser add-on.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as Reject: Google’s tag is turned off, the Meta Pixel and PostHog stay off, and form submissions are not shared with Google or Meta. If you then choose Accept through Cookie Preferences, we follow that instead.

We keep order records and customer information as long as we need them to serve you, handle reorders, meet tax and accounting requirements, and resolve disputes. Artwork is kept on file so a reorder does not require you to send it again. Analytics data is kept in aggregate, and session recordings are retained for a limited period and then deleted automatically. You can ask us to delete your information at any time (see Your rights).

• HTTPS on every page and API call.
• Data encrypted at rest with our hosting and storage providers.
• Sign-in by one-time link, so there are no customer passwords to steal.
• Role-based access for staff, scoped to the minimum each role needs.
• Rate limiting and abuse protection on public endpoints.

More detail is in our Security Overview. Security researchers can report an issue through security.txt.

No system is perfectly secure, and we cannot guarantee otherwise.

• Know what information we hold about you.
• Correct anything inaccurate.
• Delete your personal information, except records we are legally required to keep, such as tax documents.
• Opt out of marketing email, through the unsubscribe link or by contacting us, and of having your contact details used for ad matching (see Advertising with our customer list).
• Not be treated differently for exercising any of these rights.

Use our data request page, or email [email protected] with “Data Request” in the subject. We respond to verified requests within 45 days.

California residents. This covers your rights under the CCPA and CPRA. We do not sell your personal information for money. We do share it for cross-context behavioral advertising, through the tracking described in Cookies and tracking and the matching described in Advertising with our customer list. You can opt out of that sharing at any time by pressing Reject, by turning on Global Privacy Control, or through our data request page.

Our services are not directed to children under 13 and we do not knowingly collect their information. If we learn that we have, we delete it.

We update this policy as our services or the applicable laws change. The date at the top shows the last revision. For material changes we will give notice on the site, or by email if we have your address.

Questions about this policy, or to exercise the rights above:

Area Advertising
824 Winchester Avenue
Ashland, KY 41101
[email protected]
(606) 329-8055