Privacy policy

What this covers

This policy explains what Vices x Virtues collects when you use vicesxvirtues.com, why, who it goes to, and the choices you have. It applies to this site and the emails we send. It is written for people in the United States, which is the only place we ship.

What we collect

When you order: your name, shipping address, email, and phone if you give one, plus what you bought. Card details go straight to Stripe; we never see or store your card number.

When you browse: a first-party session cookie, your cart, and events such as page views, adds to cart, checkouts and purchases. We use these to see which products and layouts work.

When you sign up or write to us: your email, your message, and the product you asked about.

From your device: browser and device type, approximate location (country, region and city) from your IP address, and the page you asked for. We store these in our own database so we can see how the store is used. We do not store your IP address itself: it is turned into a one-way code that changes every day, which cannot be turned back into an address or matched to you from one day to the next. Our host also keeps its own ordinary server logs.

How we use it

To take payment, ship your order, send the confirmation, shipping and delivery emails, and answer your messages.

To run the store: fraud checks through Stripe, spotting abuse, keeping the site up.

To improve the store: which products sell, which page versions convert. This is done on our own data, product by product.

To send the drop email you asked for. One email when something new lands, and every one has an unsubscribe link.

Who it goes to

Stripe processes payments and holds your card details. Supabase hosts our database, including orders, events and the page-view records described above. Resend delivers our emails. Netlify hosts the site and keeps standard server logs. Our supplier partners receive your name and shipping address so they can send the package; they do not get your email or payment details. Each of these works for us under contract and may use the data only to provide that service.

If the Meta pixel is switched on, Meta receives product-view, add-to-cart, checkout and purchase signals so we can measure and improve our ads. They come from two places: the pixel in your browser, and our own server, which sends Meta a copy of the same events (Meta's Conversions API) so a purchase is still counted when a browser blocks the pixel. The server copy includes your browser type, Meta's own cookie ids, and your IP address as it reaches our server, which is passed to Meta and not stored by us. For a purchase it also includes your email, phone, name, zip code and country, each turned into a one-way code (hashed) before it leaves our server, which Meta can match against its own accounts but which we never send in readable form. Under California law this can count as "sharing" personal information for cross-context behavioral advertising. You can opt out with the Privacy choices control at the bottom of this page, and we treat a Global Privacy Control signal from your browser as the same opt-out: when you opt out, neither your browser nor our server sends Meta anything about you.

We do not sell your personal information, and we do not give it to anyone for their own direct marketing. We hand data to authorities only when the law requires it.

Cookies

scout_sid: a random session id so a purchase can be matched to the visit that led to it. 30 days.

scout_cart: your cart. 30 days.

scout_consent: remembers your privacy choice below. One year.

Stripe sets its own cookies during checkout for fraud prevention. If the Meta pixel is on, Meta sets its own cookies too.

Do Not Track and Global Privacy Control

Do Not Track is a browser setting with no agreed standard for what a site should do when it sees it, so this site does not change its behavior in response to it.

Global Privacy Control is different, and we honor it. If your browser sends it, the Meta pixel does not load on this device and our server sends Meta nothing about you either, with no need to touch the control below.

Apart from Meta when the pixel is on, no third party collects information about your activity on this site over time and across other sites.

Your choices

Marketing pixels: use the control below to turn them off. The choice is stored on this device only.

Emails: every marketing email has an unsubscribe link. Order emails still arrive because they are part of the purchase.

Access, correction and deletion: email hello@vicesxvirtues.com from the address you used, or use the contact form, and we will show you what we hold, fix it, or delete it within 45 days. We keep order records for as long as tax law requires, currently seven years, and delete the rest.

Notice to California residents

Categories we collect, from the sections above: identifiers (name, email, postal address, phone, the daily-changing code made from your IP address, cookie ids); commercial information (what you bought and returned); internet activity (pages viewed, carts, checkouts on this site); and approximate location (city and region, never precise). We do not collect sensitive personal information as the law defines it; card numbers stay with Stripe.

Sources: you, your browser and device, and Stripe for payment status.

Purposes: the ones listed under How we use it. Disclosed for business purposes to the service providers listed under Who it goes to. Shared for cross-context behavioral advertising, only when the Meta pixel is on and you have not opted out: identifiers (cookie ids, your IP address, and for a purchase your email, phone, name and zip code in hashed form), commercial information (what you bought and its value) and internet activity, to Meta, from your browser and from our server. Sold: none, to anyone. We have no actual knowledge of selling or sharing the data of anyone under 16.

How long we keep it: order and payment records for seven years for tax; email list entries until you unsubscribe or ask us to delete them; page-view and event records for as long as they help us run and improve the store, and never beyond what that needs; contact messages until the question is settled.

Your rights: to know what we collect and hold about you, to get a copy, to have it corrected, to have it deleted, and to opt out of sharing. We will not charge you more, give you worse service, or treat you differently for using any of them.

How to use them: email hello@vicesxvirtues.com or use the contact form. We confirm it is you by matching the email address and, for order data, the order number. Someone you authorize can ask on your behalf with your signed permission. We answer within 45 days. California's Shine the Light law also lets you ask whether we give personal information to others for their direct marketing; we do not.

Keeping it safe

Traffic is encrypted, database access is limited to what each part of the site needs, and card data never touches our servers. No system is flawless; if we learn of a breach affecting you, we will tell you.

Children

This store is for adults. We do not knowingly collect data from anyone under 13, and if we learn we have, we delete it.

Changes

When this policy changes, the date at the top moves and, for anything material, we email the list. Continued use after that is acceptance.

Contact

Vices x Virtues, 8880 Cal Center Dr Ste 400, Sacramento, CA 95826, United States.

hello@vicesxvirtues.com, or the contact form on this site.