Privacy Policy

1.1What we collect

Passive Apparel LLC, a Wyoming LLC that runs the shop in Manistique, Michigan, is responsible for everything this policy covers: the shop, this website, and our email. We collect only what you hand us:

• Mailing list: your email address, if you join (the restock signup on the home page).
• Quote requests: name, email, phone if you give one, how you'd like us to reply, organization, garment, colorway, quantity, decoration, the date you need it, pickup or your shipping state and ZIP code, budget range, how you heard about us, and notes.
• Confirmed orders: the delivery address and, for wholesale, your resale certificate.
• Messages: what you write when you email us or tell us on the phone, including any photos you send.
• In the shop: whatever's needed to ring up a sale at the register.

To answer a quote we need your name, email, garment, colorway, and quantity. We also need a phone number if you ask us to call, and your state and ZIP code if you want the order shipped. Everything else is optional. That's the inventory.

1.2What this website collects on its own

The pages themselves do not run advertising or analytics pixels. Fonts and photos are served from this site. Cloudflare (hosting) handles your IP address and browser details to deliver each page and keeps standard request logs for security. Termly's consent manager receives the same kind of request details when its banner loads, and records the cookie choice you make. To limit repeated form submissions, we keep short-lived counters keyed to a one-way hash of your network address, never the address itself. No live chat is installed. Quote requests and mailing-list signups go to our Worker, are stored in our database, and are emailed to the shop through Resend. Resend then tells us whether that email arrived; we keep the delivery record, which holds no message content. We do not sell or share any of it for advertising.

1.3What we use it for

Replying to you, filling your order, keeping the site and its forms safe from abuse, checking that your message actually reached us, and — if you joined the list — telling you when a new lot lands. In legal terms: we process your details to take the steps you've asked for (quotes, orders) and with your consent (the mailing list). We also rely on our legitimate interest in a site that is secure and works (request logs, submission counters, delivery records), and on obligations we can't dodge (tax records). That's the whole list of purposes.

1.4What we never do

We don't sell, rent, trade, or “share” your information for advertising, we don't run trackers, and we don't buy data about you from anyone else. We don't make automated decisions about you or build a profile of you either. Nobody needs a data broker to sell sweatshirts in Manistique.

1.5Who else touches it

Do not submit card details through this site. Online, when checkout is switched on, Stripe's hosted page is intended to take the card — not this website. Cloudflare hosts the site and stores quote requests and mailing-list signups (Cloudflare D1). Resend delivers the email that tells the shop about each one. Migadu hosts the shop's mailboxes and forwards shop mail to the inbox where we read it, at Fastmail. Termly runs the consent banner. Those five process your details on our behalf. If we ship your order, the carrier gets the name and address on the label and handles the delivery under its own terms. Beyond them, we disclose your information only when the law requires it, such as under a court order. Cloudflare, Resend, and Termly are based in the United States, so a message sent from abroad lands there. For a transfer from the EEA, UK, or Switzerland we rely on the tools those vendors publish: Cloudflare's EU–U.S. Data Privacy Framework certification and Standard Contractual Clauses in its customer DPA; Termly's DPF certification and SCCs; Resend's DPA with SCCs; and, when checkout is live, Stripe's customer DPA (SCCs and, where certified, DPF). We do not claim those frameworks ourselves. Mail held by Migadu and Fastmail may be stored outside your country; their own terms say where and how they protect it.

1.6How we protect it

The site runs over HTTPS, we collect as little as possible, and the forms refuse anything that looks like a card number before saving or sending it. The longer story — including what happens if something ever goes wrong — is posted in Trust & Security.

1.7How long we keep it

Order records as long as tax law requires; the mailing list until you unsubscribe; quote requests for one year, then deleted; server logs roll off after about thirty days. The counters that limit repeated submissions stop counting within ten minutes and are deleted in routine cleanup. Termly keeps the record of your cookie choice under its own terms.

1.8Your rights

See it, fix it, take it, delete it — your call. Email shop@passiveapparel.com or call +1 (906) 978-8381 and we'll send a copy of what we hold, correct it, hand it over in a portable file, or erase it (minus the records tax law makes us keep, or that an open order or dispute still needs). We answer within a week — not the thirty or forty-five days the statutes would allow us. To protect you, we may ask you to confirm it's you, usually by writing from the email address we have; someone you authorize can ask for you. If we can't do something you ask, we'll tell you why, and you can ask us to look at it again. You can object to any use of your details, or ask us to pause using them while we sort something out — and every mailing-list email carries a one-click unsubscribe and our mailing address. This site does not collect California “sensitive personal information” (things like a Social Security number, precise geolocation, or health data), so there is no sensitive-PI use to limit; if that ever changes, this page changes first. If you tell us something sensitive yourself — say, about a disability when you report an accessibility problem — we use it only to help you.

1.9California, Europe, and everywhere else

California's privacy law is written for businesses far bigger than this one, and Europe's GDPR for businesses that market to or track people in the EU — we do neither. Other U.S. states' privacy laws are also written for bigger businesses. But the rights read the same either way, so we extend them to everyone: know, correct, delete, take your data with you, and no worse treatment for asking. There's no “Do Not Sell or Share” link here because there's no selling or sharing to opt out of. Nothing on these pages tracks you across other websites, and no one else collects your browsing history through them. So what we collect is the same whether or not your browser sends a Do Not Track or Global Privacy Control signal. EU and UK readers can also complain to their local data-protection authority — though we'd rather you call us first.

1.10Kids

The shop and this site are for a general audience. We don't knowingly collect information from anyone under 13 (or under 16 where that's the line). If we learn we have — a kid's email on our list, say — we delete it the day we learn about it.

1.11Changes & questions

If this policy changes, the new version is posted here with a fresh date, and material changes go to the mailing list before they take effect. Cookies and Termly are described on the cookie page. Questions and requests: shop@passiveapparel.com or +1 (906) 978-8381. By post, write to Passive Apparel LLC at the address in Returns clause 3.5.