Privacy Policy & Payment Security

1. Overview and Scope

This Privacy Policy explains how Canyon Loom Clothiers LLC collects, uses, protects, and discloses personal information when you visit our website (https://canyonloom.shop), purchase handcrafted selvedge denim or heritage apparel, or communicate with our San Juan Capistrano workshop.

2. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically during site navigation, and payment transaction metadata from third-party partners.

A. Information You Provide to Us

• Contact and Order Details: Name, billing address, shipping address, email address, phone number.
• Account & Inquiries: Size preferences, custom tailoring notes, communications with our support team, and feedback.
• Marketing Preferences: Email address provided for newsletter and limited-edition selvedge release alerts.

B. Payment Information & Stripe Processing

When you make a purchase on Canyon Loom, your financial data is handled directly by our certified Level 1 PCI-DSS compliant payment processor: Stripe, Inc. (354 Oyster Point Blvd, South San Francisco, CA 94080).

• Your payment card details (card number, expiration date, and CVC) are encrypted using 256-bit Transport Layer Security (TLS/SSL) and transmitted directly to Stripe's secure tokenization servers.
• Canyon Loom only receives and retains a secure payment token, the last 4 digits of your card for identification, and billing confirmation.
• We support secure Express Checkouts including Apple Pay, Google Pay, and major credit cards (Visa, MasterCard, American Express, Discover).

C. Automatically Collected Device & Usage Information

When you browse our catalog, our servers and analytics tools may automatically log IP addresses, browser types, operating systems, referring URLs, pages viewed, and timestamps to ensure website stability and prevent fraudulent transactions.

3. How We Use Your Information

We utilize the collected information strictly for legitimate commercial and operational purposes, including:

• Fulfilling and dispatching your orders via UPS or DHL Express with tracking updates.
• Processing returns, size exchanges, and workshop lifetime stitch repairs.
• Screening transactions for fraud prevention and credit card chargeback protection.
• Providing dedicated customer service and sizing consultations.
• Complying with California state tax, federal accounting, and international customs regulations.

4. Third-Party Disclosures

We do not sell, rent, or trade your personal data to data brokers or third-party marketers. We only share necessary data with trusted service providers who adhere to strict data security standards:

• Payment Infrastructure: Stripe, Inc. for payment processing and fraud risk assessment.
• Fulfillment & Couriers: United Parcel Service (UPS), United States Postal Service (USPS), and DHL Express for delivery logistics.
• Legal Compliance: When required by lawful subpoenas, court orders, or applicable state and federal laws.

5. Cookies and Tracking Technologies

We use essential cookies to maintain your active Workshop Bag session, remember selected currencies and sizes, and secure checkout navigation. You can adjust your browser settings to decline non-essential cookies; however, some shopping bag functionalities may be impaired.

6. California Consumer Privacy Rights (CCPA/CPRA)

If you are a resident of California, you have specific privacy rights under the California Consumer Privacy Act:

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you over the past 12 months.
• Right to Delete: You may request the deletion of your personal information, subject to legal record retention requirements for past financial transactions.
• Right to Non-Discrimination: We will never deny services, charge different prices, or provide a different quality of goods for exercising your statutory privacy rights.
• No Sale of Data: We do not sell personal information as defined by California law.

7. Data Retention and Security

We implement administrative, technical, and physical safeguards to protect your personal data against unauthorized access, loss, or alteration. Order records are retained for a minimum period required by California commercial law and IRS tax record-keeping standards (typically 7 years).

8. Contact Our Privacy Officer

If you have questions regarding this Privacy Policy, wish to exercise your CCPA/GDPR rights, or need assistance with your data, please contact our workshop directly: