We collect the information you give us. When you place an order, we get your name, email, shipping address, billing address, and payment details. Payment data is processed by Stripe or PayPal and is not stored on our servers.
When you apply for the Trade Program, we get your business name, contact info, and the details you put on the application. When you contact us, we keep the message.
We also collect basic technical data when you visit this site: your IP address, browser type, the pages you viewed, and the time you spent on each one. This comes through Plausible Analytics. We do not use Google Analytics. We do not sell your data. We do not run retargeting pixels.
We use your information to ship your order, process your payment, respond to your inquiry, and operate the Trade Program. We use the technical data to understand which pages are working and which are not. That is the full list.
We do not market to your customers. If you are a Trade Program customer, we do not use the email addresses of people who buy from you for any purpose. The relationship is yours. We honor that.
Payment processors (Stripe, PayPal) see your billing information to charge your card. Shipping carriers (USPS, UPS, FedEx, DHL) see your shipping address to deliver your package. Email service providers see your email address to send you order confirmations and shipping updates. That is the full list of third parties.
We do not share your information with advertising networks. We do not sell it. We do not trade it. We do not rent it.
Order records are kept for 7 years for tax purposes. After 7 years, they are deleted. Trade Program applications are kept for the duration of your account and 3 years after closure. Support messages are kept for 2 years. Technical analytics are kept for 30 days.
You can ask us to delete your information at any time, subject to the 7-year tax retention requirement. See the contact section below.
This site uses one cookie: a shopping cart token stored in your browser so your cart persists if you close the tab and come back. We do not use tracking cookies. We do not use advertising cookies. We do not use third-party cookies. Plausible Analytics is cookieless by design.
You have the right to know what we have about you. You have the right to get a copy of it. You have the right to correct it. You have the right to delete it (subject to the tax retention requirement). You have the right to object to processing. You have the right to lodge a complaint with your local data protection authority.
To exercise any of these rights, email atelier@thespiritualsurplus.com. We respond within 30 days.
Under the California Consumer Privacy Act, you have the right to request what personal information we have collected, the categories of sources, the business purpose, and the categories of third parties. We have disclosed all of this above. To make a formal CCPA request, email atelier@thespiritualsurplus.com with the subject line "CCPA Request."
Under the General Data Protection Regulation, the data controller is Spiritual Surplus, reachable at atelier@thespiritualsurplus.com. Our legal basis for processing is contract performance (your order), legitimate interest (site analytics), and consent (newsletter signup). You have the right to lodge a complaint with your supervisory authority.
This site is not directed at children under 13. We do not knowingly collect information from children. If you believe a child has provided us information, email atelier@thespiritualsurplus.com and we will delete it.
If we change this policy, we will update the effective date at the top. If the changes are material, we will email active customers and Trade Program accounts.
Questions, requests, complaints: atelier@thespiritualsurplus.com