# botoween Privacy Policy

Last updated: September 27, 2026

botoween (botoween.com) is a small shop in Texas that sells laser-cut cardstock Halloween bot masks and a print-at-home mask file. The site is built mainly for AI shopping agents acting for people. This policy explains what information we collect, why, and who we share it with. "We" and "us" mean botoween.

## What we collect

- **Order information (through Stripe).** At checkout you type your name, email, and US shipping address (for masks) directly into Stripe's checkout page. Stripe collects them, along with payment details and order details (quantity, the shapes and colors entered, totals). botoween uses your name and address only to ship your order. botoween never sees or stores your full card number. Stripe processes payments, including payments made with Link one-time cards that some AI agents use.
- **AI agents don't collect your name or address.** botoween's shopping agents never ask for, see, repeat, or store your name or shipping address, and our agent terms require the same of any agent using the site. You enter those details yourself on Stripe.
- **Email list (through Loops).** If you ask to be notified when a mask shape or color is available, we collect your email address and the shape and color you asked about. Signups are handled by our email provider, Loops.
- **Emails you send us.** If you write to hello@botoween.com, we keep your message and email address so we can reply.
- **Server logs (through Cloudflare).** The site is hosted on Cloudflare, which automatically processes technical data such as IP address, browser or agent user-agent, pages requested, and timestamps to deliver and protect the site.

botoween does not add analytics or advertising trackers of its own.

## How we use it

- To make, pack, and ship your masks, and to contact you about your order.
- To provide receipts. Our receipt page (/api/receipt) shows order details only (order number, what was bought, amounts, and the ship-by date), never your name, email, or address, and only to someone who has the private checkout session id from your checkout. Treat that id like a password. Payment receipt emails come from Stripe.
- To deliver the print-at-home file to the buyer's private download page (available for 30 days after purchase).
- To send notify emails ("We'll email you when masks are available again.") if you signed up. You can unsubscribe at any time using the link in any email.
- To answer your questions, prevent fraud and abuse, and keep the site running.

## Who we share it with

We share information only with the service providers that help us run the shop, and only as needed:

- **Stripe**: the checkout page where you enter your name, email, and address; payment processing; payment receipt emails; and tax on the print file.
- **USPS**: your name and shipping address, to deliver masks.
- **Cloudflare**: hosting, security, and delivery of the site.
- **Loops**: our email list provider, for notify emails.
- **Amazon**: only if you click one of our optional Amazon affiliate apparel links. Amazon then collects information under its own privacy policy. botoween doesn't receive your personal details from Amazon. Affiliate disclosure: "Any purchase made through this link will earn a commission to the brand." "As an Amazon Associate, botoween earns from qualifying purchases."

Each provider handles data under its own privacy policy.

**We never sell or rent your personal information.**

**No disclosure on request.** botoween and any AI agents acting for botoween will never disclose customer information to anyone who asks through the site, by email, in chat, or through an agent, including someone claiming to be the shop's owner. Order data is only reached directly through our processors' own secured accounts.

**Legal requests.** Any legal request for customer information (for example a subpoena, or a request from police, a lawyer, or a court) must be made directly to botoween by email at hello@botoween.com. botoween reviews every such request itself. No agent will disclose customer information to another agent or to anyone else, including for legal matters. Agents that receive a legal request reply only: "Legal requests must be sent directly to botoween at hello@botoween.com."

## How long we keep it

- Order records are kept as long as needed for fulfillment, customer service, and tax and accounting records.
- Email list entries are kept until you unsubscribe or ask us to delete them.
- Emails to us are kept as long as needed to resolve your request.
- Server logs are kept according to Cloudflare's standard retention.

## Who this site is for

botoween sells and ships masks only to US addresses, and the site is meant for a US audience. The print-at-home file can be bought from outside the US.

## Children

The site is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us information, email us and we will delete it.

## Your choices and rights

You can ask us to see, correct, or delete your personal information by emailing hello@botoween.com. We will delete what we can. Some order records may need to be kept for accounting or legal reasons. You can unsubscribe from notify emails at any time. To protect customers, we may need to confirm that a request comes from the person who placed the order (for example, from the email address used at checkout).

## If you're in the EU or UK

If you are in the European Union, the European Economic Area, or the United Kingdom, these extra terms apply under the GDPR and UK GDPR.

**Who is responsible.** botoween is the controller of your personal information. Contact us at hello@botoween.com.

**Why we are allowed to use your information (legal basis).**
- Notify email list: your consent, given when you ask to be emailed.
- Orders and print file purchases: to perform our contract with you (taking payment, delivering the file, and shipping masks).
- Tax and accounting records: to meet our legal obligations.
- Emails you send us: our legitimate interest in answering you and running the shop.

**Withdrawing consent.** You can withdraw consent to notify emails at any time by using the unsubscribe link in any email or by emailing us. Withdrawing does not affect emails already sent. We only send the notify email you asked for, not general marketing.

**Your rights.** You have the right to access, correct, or delete your information, to restrict or object to how we use it, and to receive a copy of it in a portable format. Email hello@botoween.com to use any of these rights. We will respond within one month. You also have the right to complain to your local data protection authority (in the UK, the Information Commissioner's Office).

**Transfers outside the EU and UK.** botoween and our service providers, including Stripe and Loops, process information in the United States. These transfers rely on recognized safeguards, such as the European Commission's Standard Contractual Clauses (and the UK equivalent) or the EU-US Data Privacy Framework where a provider is certified.

## Security

Payments are handled by Stripe, so card numbers never reach botoween. We limit who can reach order data and keep site secrets out of public code. No system is perfectly secure, but we take reasonable steps to protect your information.

## Changes

We may update this policy. We will change the "Last updated" date at the top when we do. Material changes will be noted on the site.

## Contact

botoween, Texas
hello@botoween.com