Privacy
This is what we collect when you use the site, why we collect it, who else sees it, and how you can see, change or delete it.
Effective date
This notice is effective August 31, 2026. It applies to enchantedearthtx.com and to any email we send you.
Who we are
Enchanted Earth is a small retail business in Texas, United States. Our legal business name, mailing address and contact email are shown at checkout and at the bottom of every email we send. For anything about this notice, email us at the address on the contact page.
What we collect
Identifiers and contact details: your name, email address, shipping address, and anything else you type into a form on the site.
Account and profile records, if you create an account: an account ID, your saved addresses, your role, and authentication records such as a scrambled (hashed) password, a Google sign-in identifier if you use it, verification status, login sessions and login history.
Order, cart, payment and fulfilment records: the items you bought or put in a cart, quantities, prices, discounts, sales tax, shipping and delivery address, order status, tracking numbers, the type of payment method and the card brand and last four digits, our payment processor's reference numbers, the policies you agreed to when you ordered, and any refunds or disputes. Your full card number is entered directly with our payment processor and never reaches our servers.
Preferences and personalization: favorites, recently viewed items, and any favorite color, star sign or note you give us to guide a Scoop.
Device, browser and network records: your IP address, browser type (user agent), the pages requested, and security records such as failed sign-in attempts, fraud checks and rate-limit events.
Support and customer service records: your name, email address, order number, and the messages and correspondence you send us. Messages sent through the contact form are forwarded to our support mailbox, which is run by an email provider, so a copy also lives there.
Why we use it
To provide and operate the site, your account, your cart, search and recently viewed items. To authenticate you when you log in and to protect account security. To process orders, take payments, arrange fulfilment and delivery, and issue refunds. To personalize the items you asked us to personalize. To communicate with you about your orders and to provide support when you contact us. For security, to prevent fraud and abuse, to apply rate limits, and to respond to payment disputes. And to keep the accounting, tax and other records the law requires and to establish or defend legal claims.
We do not sell your personal information and we do not use it for advertising. We do not send marketing email. If we ever start a newsletter it will be opt-in only, and this notice will be updated first.
Cookies, browser storage and tracking signals
We use a small number of functional cookies: one to keep you signed in, one to keep track of your cart if you are not signed in, one for the checkout details you are typing, and short-lived ones for sign-in security and for showing you your order confirmation. Some hold a random or signed token; the checkout one holds the address you typed. Session records on our server may include your IP address and browser type.
We use your browser's local storage to remember a short list of recently viewed items. Clearing cookies or local storage in your browser may sign you out, empty a guest cart or clear that list, and nothing else happens.
We do not use advertising trackers, cross-site tracking or targeted advertising, and we do not share your activity across other websites. Because there is no cross-site tracking to switch off, the site does not change its behavior in response to a browser Do Not Track (DNT) or Global Privacy Control signal. Our hosting, content delivery, payment and email providers receive ordinary request and transaction data in order to provide their services.
Who we share it with
We share personal information only with the service providers and processors we need to run the shop: our payment processor (Stripe) and, through it, banks and card issuers; Google, if you choose to sign in with Google; our email provider (Resend) and the support mailbox provider; our hosting, content delivery, database, storage and security infrastructure; shipping carriers and delivery providers, who receive your name and address to deliver your order; and, when needed, professional advisers such as an accountant, auditors or insurers.
We may also disclose information to government authorities, courts or other parties when required by law or legal process, such as a court order or subpoena, or when it is necessary to protect someone's safety or to establish or defend legal claims. If the business is ever sold or merged, customer records may transfer to the new owner under this same notice.
Your choices and requests
If you have an account you can review your orders and update your name, email address, password and saved addresses from your account page at any time. You can also delete your account from the same page. To cancel an order that has not shipped, email us with the order number.
Whether or not you have an account, you can contact us to access a copy of the personal information we hold about you, to correct it, or to ask us to delete it. Send the request by email or through the contact form. To protect you, we may need to verify your identity before we act, usually by confirming the request from the email address on the account or order.
Deleting your account removes your login, saved addresses, favorites and cart. Order, payment, support, security and backup records may be kept for the reasons in the next section, with the account detached from them. Account deletion does not clear cookies or local storage on your devices, and it does not delete messages already sitting in our support mailbox; ask us if you want those handled too.
Residents of some states have additional rights under state privacy law. Where a law applies to us, we will honor it; use the same contact details to make a request and tell us which state you live in.
How long we keep it
How long we keep a record depends on the type of record, the purpose we need it for, and the legal obligation that applies to it. Sign-in sessions and temporary security records are deleted within days or weeks. Order, payment, refund, support and dispute records are kept for as long as we need them to complete your order, handle returns and disputes, and meet accounting and tax rules, which is generally up to 7 years, and for the limitation period for legal claims.
If a record is subject to a legal hold or litigation hold, an active dispute or an investigation, we keep it until that matter is finished. When no purpose or requirement remains, we delete the record or strip it of anything that identifies you.
Children
The site is not directed at children and you must be 18 or older to place an order or hold an account. We do not knowingly collect personal information from anyone under 18. If you think a child has given us personal information, email us and we will delete it.
Security
We use HTTPS everywhere, store passwords only as salted hashes, keep card numbers off our servers entirely, and limit who can reach customer records. No system is perfectly secure, but we take this seriously and we will tell you if a breach affects your information, as the law requires.
Contact
Questions or requests about privacy: use the contact form or the email address on the contact page. Please do not email us passwords or full card numbers.