Privacy Policy

1. Summary (quick read)

We collect the personal information needed to process orders and provide customer service (name, email, shipping address, order history). Payments are processed by Stripe; transaction and marketing emails are sent via SendGrid. We do not sell personal information. If you are a California resident, see the "California Privacy Rights" section for additional rights.

2. Information We Collect

Important note: We minimize the personal information we store. Certain information (such as shipping address, billing address, and full payment details) is collected temporarily during checkout and processed directly by our service providers, but is not stored by us on our own servers.

Categories:

• Contact & account: name and email address (used for order confirmation, customer support, and account access, if applicable).
• Transactional (limited): order items, order number, order status, timestamps, and fulfillment metadata. We do not store customer shipping addresses or billing addresses in our systems.
• Payment: payment processing is handled entirely by Stripe. We do not collect or store credit card numbers, bank details, or CVV codes.
• Marketing: email preferences, opt-in status, and campaign engagement data (e.g., opens and clicks) tracked by SendGrid.
• Usage & device: IP address, browser type, device identifiers, pages viewed, and cookies or similar technologies.

How information is collected:

• Directly from you (email entry, checkout initiation, customer support requests)
• Automatically via cookies and server logs
• From third parties (such as Google OAuth when you choose to sign in with Google)

3. How We Use Your Information

We use data to:

• Process and fulfill orders, communicate about orders and shipping.
• Process payments via Stripe.
• Send transactional emails (order confirmations, shipping notices) via SendGrid.
• Send marketing emails if you opt in; you may unsubscribe at any time.
• Improve site functionality, prevent fraud, and for security purposes.

4. Cookies & Tracking

We use cookies and similar technologies to operate our website and support our marketing efforts.

Essential cookies are required for the site to function properly and are always enabled. These include cookies necessary for security, checkout, and basic site functionality.

With your permission, we may also use non-essential cookies, such as analytics and marketing cookies, to understand how our site is used and to support advertising and email campaigns.

You can manage your cookie preferences at any time by clicking the Cookie Preferences link in the footer of our website. Through this control, you may:

• Review the categories of cookies we use
• Accept non-essential cookies
• Decline non-essential cookies

Third-party tools that may set cookies or similar technologies include analytics and advertising partners, as well as email service providers. Your choices will be respected until you update your preferences.

5. Third-Party Processors

We rely on the following third-party services to operate the site (this is not an exhaustive list):

• Stripe — payment processing. (Payments and card data are handled by Stripe.)
• SendGrid — transactional and marketing email delivery.
• Google — OAuth / social login (when you choose to sign in with Google).
• Meta (Facebook & Instagram) — marketing and advertising tools (e.g., pixels, campaign measurement).
• Vercel — hosting and infrastructure.
• Squarespace — domain registration / DNS (if applicable).

Links to each provider's privacy/DPA should be added here (replace placeholders with real links).

6. Security & Data Processing Notes

We implement reasonable administrative, technical, and physical safeguards to protect personal information (TLS/HTTPS, access controls, environment variable secrets for API keys). Although we take steps to protect your data, no system is completely secure; in the event of a breach we will follow applicable law and notify affected parties as required.

Data retention: We retain order and transactional records for as long as necessary to comply with legal, tax, and accounting obligations (typically 3–7 years). Marketing preference data is retained until you unsubscribe or request deletion. Other personal information is retained only as long as reasonably necessary for the purposes described in this policy.

7. Children

Our services are not intended for children under 13. We do not knowingly collect personal information from children under 13.

8. California Privacy Rights (CCPA / CPRA) — short form

If you are a California resident, you may have rights to access, delete, and opt out of the sale of your personal information. We do not sell personal information. To exercise your rights, contact us at support@wonderscenes.co or use the form at /contact.

9. How to Exercise Your Rights

To request access, correction, or deletion of your personal information, contact:

• Email: support@wonderscenes.co
• Mailing address:
  Wonder Scenes
  101 Marketside Ave Ste 404-116
  Ponte Vedra, FL 32081

We will verify requests to the extent required by applicable law before taking action.

10. CAN-SPAM / Email Legal Notice

All marketing emails include an easy unsubscribe link and our mailing address as required by law. Example footer for marketing emails:

11. Updates to this Policy

We may update this policy periodically. The "Effective Date" at the top will be updated. Material changes will be posted prominently.

12. Contact

Questions about this policy: support@wonderscenes.co