Privacy Policy

Last updated: August 2, 2026

Information we collect

Chapter applications and accounts. If you apply for a drop or use a chapter or operator account, we collect the contact and organization details you submit, such as your name, email, chapter, school, role, and group-shipping address. Supabase processes account sign-in and security records.

Pendant orders. We receive your name, email, chapter, quantity, charge amount, tax, payment status, and Stripe transaction identifiers. Stripe collects your card and billing details. Campus Carats does not store card numbers.

Supporter gifts. If you send a gift without buying a pendant, we receive your name, email, selected chapter, stated gift amount, total card charge, payment status, refund status, and Stripe transaction identifiers. Supporter gifts do not require a buyer shipping address and are not tax-deductible.

Site and security records. Netlify and our other infrastructure providers process IP address, browser/device information, request times, and security logs when you use the site. Cloudflare Turnstile processes security, device, and network signals when checkout opens to distinguish real shoppers from automated abuse. We use these records to deliver the site, protect limited inventory, investigate errors, and protect payment and account activity.

How we use and share information

We use personal information to review applications, manage chapter accounts, process pendant orders and supporter gifts, issue refunds, fulfill group shipments, calculate chapter payouts, prevent fraud, provide support, and meet tax, accounting, dispute, and legal obligations.

We do not sell personal information or use it for targeted advertising. A chapter's private dashboard shows a buyer or supporter as a first name and last initial in its activity feed; it does not show an email address or gift amount. Operators with individual authorized accounts can access the records needed to support orders, refunds, fulfillment, and payouts.

Our service providers process information for us: Stripe handles checkout, billing details, payments, and refunds; Cloudflare Turnstile checks checkout traffic for automated abuse using security, device, and network signals; Supabase hosts the database and account authentication; Netlify hosts the site and server functions; Formspree processes chapter applications; our approved email provider delivers account messages; and Google Fonts serves the typefaces used on these pages. These providers apply their own privacy and retention terms. We may also disclose records to professional advisers or authorities when the law requires it or when we need to protect users, chapters, or Campus Carats.

Retention & deletion

Campus Carats keeps buyer and supporter names and email addresses for 24 months by default. A reviewed production setting may extend that period, but never beyond 84 months, when tax, accounting, fraud, dispute, or legal requirements call for more time. After the selected period and after the related order and drop reach a terminal state, a scheduled process removes those contact fields. We keep non-contact financial records, order status, refund history, timestamps, and Stripe identifiers as needed for accounting, fraud prevention, disputes, and chapter payout records.

We clear successful Stripe webhook bodies after processing. We may keep an unsuccessful webhook body for up to 14 days so we can complete payment reconciliation. We retain a limited event record for up to 400 days. We remove terminal group-shipping addresses on the same reviewed 24-to-84-month schedule. Application, account, provider, and security records remain only for the business, contractual, security, and legal periods that apply to them.

You may ask to access, correct, or delete your information by emailing james@campuscarats.com. We will verify the request before acting. We may retain financial, fraud, dispute, tax, payout, or legal records when those obligations prevent deletion.

Cookies & tracking

We use essential cookies or browser storage for account sessions, checkout, and security. We do not run third-party advertising, advertising pixels, or marketing analytics at this time. We will update this policy before adding them.

Children

We do not knowingly collect data from anyone under 18.

Updates

We may update this policy. Changes will be posted here with a new "last updated" date. Questions? Email james@campuscarats.com.