Privacy policy
Effective date: September 23, 2026
This policy explains what Kennebec Handsewn LLC (“Kennebec Handsewn”, “we”, “us”) collects when you visit kennebechandsewn.shop or buy from us, why we collect it, who else sees it, and what you can ask us to do about it. We sell footwear direct to customers; we are not in the business of selling data, and we never have been.
Who we are
Kennebec Handsewn LLC, 605 Ouida St, Grand Prairie, TX 75051, United States. Questions about this policy go to hello@kennebechandsewn.shop or (469) 516-6539. For the purposes of the UK and EU GDPR we are the data controller for the information described here.
Information we collect
Information you give us
- Order information — name, shipping address, billing address, email address, telephone number, and the contents of your order.
- Payment information — your card details are entered on our checkout page and transmitted directly to our payment processor. We receive only a token, the card brand, the last four digits, the expiry month and year, and the authorisation result. We never store your full card number, magnetic stripe data or security code on our own systems.
- Correspondence — what you write to us about fitting, repairs, returns or anything else, and our replies.
- Marketing preferences — the email address you give us if you sign up for bench notes, and whether you have unsubscribed.
- Fit notes — if you ask for fitting help, the foot measurements and sizes you choose to tell us, kept against your customer record so we do not ask twice.
Information collected automatically
- Device and log data — IP address, browser and operating system, referring page, the pages you viewed and when. This is written to server logs and used for security, fraud prevention and fixing broken pages.
- Storage on your own device — your shopping bag is kept in your browser's local storage so it survives a reload. It stays on your device, it is not transmitted to us until you check out, and you can clear it by clearing site data.
- Analytics — aggregate counts of page views and referrers, so we know which styles people look at. We do not build advertising profiles and we do not run third-party ad pixels.
What we do not collect
We do not ask for, and have no use for, your Social Security number, government identification numbers, bank login credentials, precise geolocation or biometric data. We do not knowingly collect anything from children under 13.
Why we use it, and on what legal basis
| Purpose | Information used | Legal basis (UK/EU) |
|---|---|---|
| Taking payment, making and shipping your order, handling returns and repairs | Order, payment token, correspondence | Performance of a contract |
| Fraud screening and chargeback defence | Order, device and log data, payment result | Legitimate interests; legal obligation |
| Customer service and fitting advice | Correspondence, fit notes, order history | Performance of a contract; legitimate interests |
| Accounting, tax and sales-tax reporting | Order and invoice records | Legal obligation |
| Marketing email, if you asked for it | Email address, what you clicked | Consent (withdrawable at any time) |
| Improving the shop | Aggregate analytics | Legitimate interests |
Payment processing
Card payments are processed by Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080. When you pay, the card details you type go to Stripe over an encrypted connection; Stripe acts as an independent controller of that data and handles it under its own privacy policy, published at stripe.com/privacy. Stripe may use device and transaction signals to prevent fraud. We keep the token and the last four digits so we can issue refunds and answer questions about a charge; that is all we can see.
Who else receives your information
We share the minimum necessary with service providers who work on our instructions, under contract, and who may not use it for their own purposes:
- Payment processing — Stripe, Inc.
- Carriers — the United States Postal Service, UPS and FedEx receive the name, address, telephone number and parcel weight needed to deliver your order.
- Web hosting and email — our hosting and email providers, who necessarily process data in transit and at rest.
- Email delivery — the service that sends order confirmations and, if you subscribed, bench notes.
- Accountants and, if it ever comes to it, lawyers — bound by professional confidentiality.
We also disclose information where the law requires it: a valid subpoena, court order or lawful request from a public authority, or to establish or defend legal claims. If we were ever sold or merged, customer records would transfer with the business, and we would say so here before that took effect.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months.
Cookies and similar technologies
We use a small number of first-party cookies and equivalent browser storage that are strictly necessary: keeping your bag, remembering that you dismissed a notice, and protecting the checkout form against abuse. We do not set advertising cookies. You can block or delete cookies in your browser settings; if you block the necessary ones, the bag and the checkout will stop working.
How long we keep things
- Order and invoice records — seven years, because tax law requires it.
- Customer service correspondence — three years.
- Marketing list — until you unsubscribe, then a suppression record so we do not email you again by accident.
- Server logs — 90 days.
- Fit notes — until you ask us to delete them.
How we protect it
The whole site is served over TLS. Card data does not touch our servers. Access to customer records is limited to the people who need it, protected by individual accounts and two-factor authentication, and reviewed when someone leaves. No system is perfect; if a breach ever affects your information, we will notify you and the relevant regulator as required by law.
Your rights
Wherever you live, you may ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct anything inaccurate;
- delete it, where we are not required to keep it;
- stop using it for marketing, at any time;
- restrict or object to a particular use;
- receive it in a portable, machine-readable format.
Write to hello@kennebechandsewn.shop. We will verify your request against our order records — usually by emailing the address on the order — and answer within 45 days, or 30 days where the UK or EU GDPR applies. You may use an authorised agent. Exercising any of these rights costs nothing and we will not treat you differently for it.
If you are in California
Under the CCPA as amended by the CPRA you have the rights listed above, including the right to know the categories of personal information we collected (identifiers, commercial information, internet activity, geolocation inferred from IP at city level, and the contents of your correspondence with us), the categories of sources (you, your browser, our processors), our purposes for collecting it, and the categories of third parties to whom we disclose it — all set out above. We do not sell personal information or share it for cross-context behavioural advertising, so there is no “Do Not Sell or Share” mechanism to offer. We do not use or disclose sensitive personal information for purposes other than providing the goods you ordered.
If you are in the UK, the EU or Switzerland
Your information is processed in the United States. Where we transfer data out of the UK or EEA we rely on the European Commission's Standard Contractual Clauses, or the UK Addendum, together with the transfer risk assessment our processors provide. You may lodge a complaint with your national supervisory authority, or with the Information Commissioner's Office in the United Kingdom, though we would rather you wrote to us first.
Other US states
Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws have equivalent rights of access, correction, deletion, portability and appeal. To appeal a decision we have made about a request, reply to our answer with the word “appeal” and a different person here will review it within 45 days.
Children
This shop is intended for adults. We do not knowingly collect personal information from anyone under 13, and if we learn that we have, we delete it.
Automated decisions
We do not make decisions about you by automated means alone, other than routine fraud scoring at the payment stage, which can decline a card. If a legitimate order is declined, write to us and a person will look at it.
Changes to this policy
If we change this policy we will post the new version here with a new effective date. Material changes affecting how we use information you have already given us will be emailed to customers on file at least 14 days before they take effect. The current version is always the one on this page.
Contact
Kennebec Handsewn LLC
605 Ouida St
Grand Prairie, TX 75051
United
States
hello@kennebechandsewn.shop
(469) 516-6539