Privacy Policy
Last updated: September 4, 2026
This policy explains what Hearthfell LLC collects about you when you visit hearthfell.com, buy from us or get in touch; what we do with it; who else sees it; how long we keep it; and how you can control it.
Three things to know before you read the rest
- We collect what's needed to take your order, deliver it and support you afterwards, and not much else.
- We don't sell your personal information for money. Advertising cookies do pass browsing data to ad partners, which some state laws call "sharing" or a "sale," and you can turn that off in one click (section 7).
- You can ask to see, correct or delete what we hold, and we'll respond within 45 days at no charge (section 10).
1. Who is responsible
| Store | Hearthfell, at hearthfell.com |
| Legal entity | Hearthfell LLC |
| Business address | 4663 River City Drive, Jacksonville, FL 32246, United States |
| support@hearthfell.com | |
| Phone | +1 (904) 998-7156 |
| Customer service hours | Monday–Friday, 9:00 AM–5:00 PM ET |
| Response time | Within one business day |
Privacy questions and requests go to the email above with "Privacy" in the subject line.
2. What we collect
When you order: name, email, phone number, billing and shipping address, what you bought, payment confirmation, and what happens to the order afterwards: delivery, returns, refunds.
When you pay: card details are entered directly into the payment processor's secure form. They never reach our servers and aren't kept on file after the transaction. We receive a confirmation, the card type and the last four digits.
When you create an account: email, encrypted password, saved addresses and order history. Accounts are optional.
When you contact us: whatever you write, your email address, and any photos you attach.
When you browse: IP address, browser and device type, operating system, connection details, the pages and products you view, what you add to your cart, and whether you open our emails or click our ads. Most of this depends on the cookie choices you make (section 6).
From other companies: the payment processor sends the result of its fraud screening, carriers send delivery status, and Shopify sends technical logs about the store. If you interact with us on social media, we can see what your own privacy settings make public.
We don't ask for Social Security numbers, government ID, health information or biometric data, and we don't use what we hold to infer race, religion, health or sexual orientation. Please don't include such information in messages to us.
3. What we use it for
| Purpose | What it involves |
|---|---|
| Fulfilling your order | Payment, shipping, delivery updates, returns and refunds |
| Customer support | Answering questions, resolving problems |
| Your account | Creating and maintaining it |
| Fraud prevention | Verifying transactions, screening suspicious orders |
| Improving the store | Understanding how the site is used and where it fails |
| Marketing | Email and advertising, where you've opted in or the law permits |
| Legal obligations | Tax, accounting, recordkeeping, responding to claims |
We don't make fully automated decisions about you with legal or similarly significant effects. If the payment processor's fraud screening declines a transaction, a person will review it if you contact us.
4. Email and advertising
Order email (confirmation, shipping, delivery, refund) is sent because we need it to complete your purchase. It isn't marketing and unsubscribing doesn't stop it.
Marketing email goes only to people who opted in, or after a purchase where the law allows it. Entering your email at checkout doesn't sign you up for marketing on its own. Every marketing email has an unsubscribe link that works immediately, and we comply with the CAN-SPAM Act.
Advertising audiences. With your consent, we may use a hashed version of your email address to show you relevant ads on platforms such as Meta (Facebook and Instagram) and Google. This is a separate consent from the newsletter: you can accept one and decline the other, and withdraw either at any time by emailing us.
5. Text messages
If you enter your mobile number and check the SMS box at checkout or on a sign-up form, you agree to receive texts from us, which may include order and delivery updates, cart reminders and offers. Consent to marketing texts is never a condition of purchase. Message frequency varies; message and data rates may apply. Reply STOP to end marketing texts or HELP for help. Order and delivery texts continue because they're part of fulfilling your order.
6. Cookies and similar technologies
| Type | What it does | Optional? |
|---|---|---|
| Essential | Cart, checkout, login, security, remembering your cookie choice | No; the store can't work without them |
| Functional | Remembers preferences such as region and currency | Yes |
| Analytics | Traffic, page performance and errors | Yes |
| Advertising | Interest-based advertising, ad measurement, limiting how often you see the same ad | Yes |
Advertising cookies collect information about your activity over time on our site and others, so ads are more relevant and don't repeat endlessly. We never store personally identifiable information inside a cookie.
Choose what you allow in the cookie banner on your first visit, and change it any time through the "Cookie preferences" link in the footer or in your browser. Blocking essential cookies stops checkout from working. Blocking a cookie doesn't delete one already set; you clear those through your browser.
Global Privacy Control. If your browser sends a GPC signal, we treat it as an opt-out from the sale or sharing of your data for targeted advertising on that browser and device. We don't act on "Do Not Track," which has no agreed meaning.
7. Who receives your information, and the "sale or share" opt-out
Only the companies that help us run the store, and only what each needs:
- Shopify, which hosts the store. For services that run across many stores, such as Shop Pay and Shopify's fraud protection, Shopify is responsible for the data under its own consumer privacy policy.
- Payment processors, for payment and fraud screening; see section 8 for where they process it
- Carriers and fulfillment partners, who get your name, address, phone and email to deliver the package and send updates
- Email, SMS and analytics providers
- Advertising partners, such as Meta and Google, when your cookie settings or your consent allow it
- Accountants, lawyers and IT providers, for the records and systems the business needs
We also disclose information when required by law, subpoena or court order, in response to a lawful government request, or to respond to claims, protect our rights and customers, or investigate suspected unlawful activity. If the business is sold, merged, restructured or enters bankruptcy, customer records may transfer as part of that, on the condition that the recipient handles them in line with this policy. We'd tell you.
Categories disclosed in the past 12 months, for the purposes above: identifiers (name, email, phone, address, IP address), customer records (order and payment confirmation), commercial information (purchase and support history), internet activity (browsing data on our site), and approximate location derived from IP address.
Selling and sharing
We don't sell your personal information for money and never have. When advertising cookies are enabled, browsing data from our site reaches advertising partners so we can measure and target ads, and California and several other states treat that as "sharing" or a "sale." To opt out:
- click "Do Not Sell or Share My Personal Information" in the footer of any page
- change your cookie preferences on this site
- turn on Global Privacy Control in your browser
- email support@hearthfell.com
You can also opt out of interest-based advertising across the industry at optout.aboutads.info. Opting out affects browsing data only and doesn't stop us from processing your order. We don't knowingly sell or share the personal information of anyone under 16.
8. Where your information is processed
We're based in the United States. Some of our service providers, including fulfillment partners, operate in other countries, and order information is transferred to them so your order can be picked, packed and shipped. Privacy law in those countries may differ from the law where you live.
Payments are processed in the United States by Shopify Payments and, where you choose it, PayPal.
9. How long we keep it
| Information | Kept for |
|---|---|
| Orders, invoices, payment confirmations | 7 years, for tax and accounting |
| Return and dispute records | Until closed, then as long as a claim could be brought |
| Account | Until you delete it, or after 3 years without a login |
| Marketing list | Until you unsubscribe; we keep the unsubscribe itself so we don't email you by mistake |
| Support emails | 2 years after the last message |
| Analytics and advertising data | Up to 26 months, less where the tool allows |
| Fraud screening records | 3 years |
While a dispute or legal claim is open, the relevant records stay. After the retention period, information is deleted or stripped of anything that identifies you.
One practical note: routine backups mean a copy of deleted data can persist briefly. It's held securely and disappears when the backup is overwritten in the normal cycle.
10. Your rights
Depending on where you live, you may have the right to:
- access what we hold about you and learn how we've used and shared it
- correct anything inaccurate
- delete it, except records we're legally required to keep
- receive a copy in a portable format
- opt out of the sale or sharing of your information and of targeted advertising (section 7)
- limit the use of sensitive information, where that right applies
- withdraw consent to marketing at any time
- appeal if we decline a request, by replying to our decision
- be treated the same whether or not you exercise these rights
California residents have these rights under the CCPA/CPRA, including the right to know the categories of information collected, used and disclosed in the past 12 months (sections 2 and 7).
Residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Minnesota, Delaware, New Jersey, Maryland and other states with comprehensive privacy laws have substantially similar rights. Florida's Digital Bill of Rights applies only to very large businesses, but Florida residents can exercise every right on this list with us regardless.
To make a request, email support@hearthfell.com with "Privacy Request" in the subject line. We'll confirm it's you, usually by matching details from a recent order, and respond within 45 days. For complex requests we may take up to 45 more days and will tell you why. An authorized agent may act for you with written proof of authorization. There's no charge.
11. Security and breaches
All traffic to and from the store is encrypted with TLS. Card numbers never reach our systems, because payment is handled by a PCI DSS-compliant gateway, and no financial information is kept on file after a transaction. Access to customer data is limited to people who need it for their work and is protected by two-factor authentication.
No system is completely secure, and we won't claim otherwise. If a breach affects your personal information, we'll notify you without unreasonable delay and within the time required by the Florida Information Protection Act and the breach notification law of your own state.
12. Children
The store is for adults. We don't knowingly collect personal information from children under 13, in line with COPPA, and we delete it if we learn we have. If you believe a child has given us information, contact us.
13. Links to other sites
Links on our site, including carrier tracking pages and payment providers, lead to sites we don't control. This policy ends at our site; read theirs before you share anything with them.
14. Complaints
Contact us first; most things are resolved directly. If our answer doesn't satisfy you, you can appeal by replying to it, or contact the Florida Attorney General's office or the attorney general of your own state.
15. Changes to this policy
We update this policy when our practices or the law change. The current version is always here, with the date at the top. If a change materially affects you, we'll announce it on the site or by email before it takes effect.
16. Contact
Hearthfell LLC 4663 River City Drive, Jacksonville, FL 32246, United States support@hearthfell.com · +1 (904) 998-7156 Monday–Friday, 9:00 AM–5:00 PM ET · Replies within one business day