Privacy Policy

This website is operated by Mulberry Empire (“Mulberry,” “we,” “us”), which decides how your personal information is used. You can reach us about anything in this policy at info@mulberryempire.com.

Information you give us:

• Account: your email address, and the date you created the account.
• Orders: your name, email, shipping and billing address, and what you bought. Payment cards are entered directly into Stripe's secure checkout. We never see or store your full card number.
• Waitlist and newsletter: your email address, your consent and when you gave it, and (for the waitlist) the color and size you're interested in.
• Messages: your name, email and anything you write to us through the contact form or by email.

Information collected automatically:

• Standard server logs kept by our hosting provider (such as IP address, browser type and the page requested), used for security and to keep the site running.
• Your bag is saved in your browser's local storage so it's still there when you return.
• If you sign in, one essential cookie keeps you signed in (see Cookies).

Information from others: Stripe tells us whether a payment succeeded and gives us the order details we need to fulfil it (for example, card brand and last four digits, and billing and shipping address).

We do not collect sensitive personal information, and we do not use analytics, advertising or social media tracking tools.

• To fulfil your order: processing payment, shipping, sending order and shipping updates, and handling returns and refunds. (Legal basis where applicable: performance of a contract.)
• To run your account: signing you in, saving your bag across devices and showing your order history. (Contract.)
• To answer you: replying to messages and support requests. (Legitimate interests.)
• To send marketing emails, only if you've opted in. Every marketing email has an unsubscribe link. (Consent.)
• To keep the site secure: preventing fraud, abuse and unauthorized access. (Legitimate interests.)
• To meet legal obligations: such as tax and accounting records. (Legal obligation.)

We do not use your information for automated decision-making or profiling that has legal or similarly significant effects on you.

We share personal information only with service providers that help us run the store. They may use it only to provide their service to us:

• Stripe: payment processing and fraud prevention.
• Resend: sending account, order and (if you opt in) marketing emails.
• Vercel: website hosting.
• Upstash: secure storage for accounts and saved bags.
• Shipping carriers: your name and address, to deliver your order.

We may also disclose information if required by law, to protect our rights or the safety of others, or as part of a sale or reorganization of the business (in which case this policy will continue to apply).

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months.

We keep this deliberately minimal:

• Session cookie (__Host-mb_session): set only when you sign in, so you stay signed in. It is strictly necessary, cannot be read by scripts, and expires after 30 days or when you sign out.
• Local storage (mulberry-cart): remembers the items in your bag on this device. It never leaves your browser unless you are signed in.

We do not use analytics, advertising or third-party tracking cookies, so there is nothing to consent to or opt out of. If that ever changes, we will update this policy and ask for your consent first where the law requires it.

• Sign-in codes: 10 minutes, and single-use.
• Sign-in sessions: up to 30 days, or until you sign out.
• Account and saved bag: until you delete your account. Saved bags are cleared after 180 days without activity.
• Order and payment records: as long as tax and accounting laws require (generally up to 7 years).
• Newsletter and waitlist: until you unsubscribe. We keep a record of your consent or unsubscribe as proof.
• Messages: as long as needed to resolve your request, and no longer than 3 years.

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it;
• correct inaccurate information;
• delete your information;
• receive your information in a portable format;
• opt out of marketing at any time;
• opt out of the sale or sharing of your information, or of targeted advertising (we do none of these);
• withdraw consent, and object to or restrict certain processing; and
• not be treated differently for exercising any of these rights.

Do it yourself: signed-in customers can download their data, change email preferences and delete their account from the Account page.

Or ask us: email info@mulberryempire.com with “Privacy Request” in the subject. We'll confirm the request comes from you (usually by replying to the email address on file) and respond within 30 days, or 45 days where state law allows. An authorized agent may make a request for you with your signed permission.

Appeals: if we decline your request, you can appeal by replying with “Appeal” in the subject. We'll respond within 45 days. If you're still not satisfied, you may contact your state Attorney General or your local data protection authority.

Global Privacy Control: we honor GPC browser signals as a request to opt out of the sale or sharing of personal information.

This section supplements the policy for residents of California and other states with comprehensive privacy laws (including Colorado, Connecticut, Oregon, Texas, Utah and Virginia). In the past 12 months we have collected these categories of personal information, from the sources and for the purposes described above:

• Identifiers such as name, email address, postal address and IP address;
• Customer records such as billing and shipping details (card details are held only by Stripe);
• Commercial information such as products purchased or added to your waitlist; and
• Internet activity limited to the server logs described above.

We disclose these categories to the service providers listed above for business purposes only. We do not sell or share personal information, we do not collect sensitive personal information, and we have no actual knowledge of selling or sharing information of anyone under 16. California's “Shine the Light” law: we do not disclose personal information to third parties for their own direct marketing.

The site is served only over encrypted HTTPS. Accounts are passwordless: you sign in with a single-use code sent to your email, so there is no password that could be leaked or reused. Session tokens are stored only in hashed form. Card payments are handled entirely by Stripe, which is certified to PCI DSS Level 1. No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.

This site is not intended for children under 16 and we do not knowingly collect their personal information. If you believe a child has given us information, contact info@mulberryempire.com and we will delete it.

We are based in the United States and our service providers process data in the United States. If you visit from elsewhere, your information will be transferred to and processed in the United States, with safeguards provided by our providers' data protection terms.

We'll post any changes here and update the date at the top. If a change materially affects how we use information we already hold, we'll notify you by email or on the site before it takes effect.