Privacy Policy

This Privacy Policy describes how Vanilla and Cinnamon Store LLC ("Vanilla and Cinnamon", "we", "us", or "our") collects, uses, discloses, protects, retains and deletes personal information. It applies to our website, to orders placed with us directly, and to orders we receive and fulfil through online marketplaces on which we sell, including the Amazon marketplace.

We are a limited liability company organized in the United States, with a business address at 1996 J Lawson Blvd, Orlando, FL 32824, United States. For the purposes of this Policy, Vanilla and Cinnamon Store LLC is the controller of the personal information described below. Questions may be directed to hello@vanillaandcinnamon.com.

1. Information we collect

1.1 Information you provide to us

• Contact and identity information — name, email address, telephone number where you supply one.
• Order and delivery information — shipping address, billing address, order contents, order number.
• Customer images — photographs or other artwork you send us so that we can produce a personalized diamond painting kit.
• Correspondence — the content of messages you send us about an order, a return, or a support question.

We do not collect or store full payment card numbers. Payments are processed by the marketplace or by a third-party payment processor, and we receive only a confirmation of payment and, in some cases, the last four digits of the instrument used.

1.2 Information we receive from the Amazon marketplace

We are an Amazon selling partner. When you place an order with us on Amazon, Amazon provides us with the information we need to fulfil that order. We access this information through the Amazon Selling Partner API (SP-API) and through Amazon Seller Central. It may include:

• buyer name and encrypted or anonymized buyer email address;
• shipping address and delivery instructions;
• order identifiers, items purchased, quantities, prices and order status;
• customization or personalization details supplied with the order;
• returns, refunds and A-to-z claim information;
• aggregate seller performance, inventory, settlement and traffic reports that relate to our own account.

1.3 Information collected automatically

When you visit this website, our web server records standard technical information such as your IP address, browser type, requested page and timestamp. These server logs are used to keep the site available and secure. This website does not use advertising cookies, analytics cookies, or third-party trackers. See Section 9.

2. How we use information

We use personal information only for the purposes listed above and for purposes compatible with them. Where we analyse our sales performance, we work with aggregated or de-identified data rather than individual customer records wherever it is practicable to do so.

3. Handling of Amazon marketplace data

Personal information we receive from Amazon is subject to additional restrictions, which we apply in addition to everything else in this Policy. Specifically:

• We use Amazon buyer information solely to fulfil orders, provide customer service for those orders, and meet our legal and tax obligations.
• We do not sell Amazon buyer information, and we do not share it with any third party for that party's own purposes.
• We do not use Amazon buyer information for marketing, retargeting, mailing lists, or to divert customers away from the Amazon marketplace.
• We do not combine Amazon buyer information with data from other sources to build customer profiles.
• Access is restricted to the specific personnel and service accounts that require it, each with unique credentials and multi-factor authentication.
• Applications we operate against the SP-API request only the minimum data scopes required for the functions described in this Policy.

4. How we share information

We share personal information only in the following circumstances:

• Shipping carriers — name and delivery address, so that your order can be delivered.
• Production partners — the image and canvas specification required to manufacture your kit, under written confidentiality obligations.
• Service providers — hosting, storage and email providers acting on our instructions and bound to protect the information.
• Marketplaces and payment processors — as required to complete the transaction you initiated.
• Legal and regulatory — where we are required by law, subpoena, or a valid governmental request, or to establish or defend legal claims.
• Business transfer — in connection with a merger, acquisition, or sale of assets, subject to this Policy continuing to apply.

We do not sell personal information, and we have not sold personal information in the preceding twelve months.

5. Data retention

We retain personal information only for as long as it is needed for the purpose for which it was collected.

When a retention period ends, records are deleted or irreversibly de-identified. See our Data Deletion & Retention page for how to make a deletion request.

6. How we protect information

• All data in transit is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted using AES-256 or an equivalent industry-standard algorithm.
• API credentials and secrets are held in a dedicated secret store, never in source code, and are rotated periodically.
• Access follows the principle of least privilege; each person and service has unique credentials, and multi-factor authentication is required for administrative access.
• Administrative access is logged, and logs are reviewed for anomalous activity.
• We maintain an incident response procedure covering detection, containment, notification and remediation.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do commit to the controls described above and to notifying affected parties as required by law.

7. Your privacy rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and how we use it;
• request a copy of that information;
• request correction of inaccurate information;
• request deletion of your information;
• opt out of the sale or sharing of your information (note that we do not sell or share personal information);
• not be discriminated against for exercising any of these rights.

Residents of California have these rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act. Residents of other U.S. states with comprehensive privacy laws have comparable rights. Individuals in the European Economic Area and the United Kingdom additionally have the right to object to processing, to request restriction of processing, to data portability, and to lodge a complaint with their supervisory authority.

To exercise any of these rights, email hello@vanillaandcinnamon.com or use the process described on our Data Deletion & Retention page. We will respond within 45 days, and will tell you if we need an extension. We may ask for information sufficient to verify your identity and to locate your order before acting on a request.

If your order was placed on the Amazon marketplace, note that Amazon is a separate controller of the information it holds about you. Requests concerning your Amazon account should be directed to Amazon.

8. Children's privacy

Our products and website are intended for adults. We do not knowingly collect personal information from children under 13 years of age. If we learn that we have collected such information, we will delete it promptly. A parent or guardian who believes we hold information about a child may contact us at the address below.

9. Cookies

This website uses no advertising cookies, no analytics cookies, and no third-party tracking technologies. Any cookie set is strictly necessary for the site to function. Marketplaces on which we sell operate their own cookies under their own policies.

10. International transfers

We are based in the United States and our infrastructure is operated in the United States and the European Economic Area. If you access our services from another country, your information may be transferred to and processed in those locations. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

11. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top of the page will change when we do. If a change materially affects how we handle your personal information, we will provide a more prominent notice.

12. How to contact us

Vanilla and Cinnamon Store LLC
1996 J Lawson Blvd
Orlando, FL 32824
United States
hello@vanillaandcinnamon.com

We aim to acknowledge every privacy enquiry within five business days.