Policy
Privacy Policy
Loom and Hearth Studio LLC
Effective date: March 29, 2026
Last updated: September 27, 2026
1. Who we are
This website is operated by Loom and Hearth Studio LLC, a company registered in the state of Wyoming, United States. We sell handcrafted Moroccan rugs, poufs, pillows, and home décor, shipping all orders directly from Morocco.
For any privacy-related questions or requests, contact us at:
[email protected]
2. What personal data we collect and why
We collect only what is necessary to operate this store and communicate with you. The table below lists every category of personal data we collect, what we use it for, and the legal basis that permits us to process it.
| Data | Purpose | Legal basis |
|---|---|---|
| Full name | Creating your account; processing and fulfilling orders | Contract performance |
| Email address | Account registration; order confirmations; password reset emails; newsletter (if you opted in) | Contract performance / Legitimate interest / Consent (newsletter only) |
| Password (stored as a one-way hash — never the raw password) | Authenticating your account | Contract performance |
| Shipping address — street, city, state, postal code, country | Delivering your order; customs documentation | Contract performance |
| Phone number (only if you choose to provide one during order handling) | Carrier delivery coordination if required | Contract performance |
| Order details — items ordered, prices, quantities, Stripe session and payment intent identifiers, order status | Fulfilling your order; resolving disputes; financial record-keeping | Contract performance / Legal obligation |
| Session token | Keeping you logged in during your visit | Legitimate interest (security) |
| Hashed login identifier (a one-way SHA-256 hash derived from your email address, IP address, and the login surface — the raw IP and raw email are never stored in this record) | Preventing automated login abuse and brute-force attacks | Legitimate interest (security) |
We may run analytics tools (Google Analytics and Microsoft Clarity) and advertising tags (Meta Pixel and Pinterest tag). Microsoft Clarity records how pages are used — clicks, scrolling and mouse movement — so we can find and fix problems with the site. Whether these tools run depends on where you are browsing from and on the choices you make; see section 3.
3. Cookies and local storage
Strictly necessary — no consent required
| Name | Type | Purpose | Expiry |
|---|---|---|---|
loom_hearth_cookie_consent | First-party cookie | Stores your cookie consent preference so we do not ask again | 180 days |
NextAuth session cookies (next-auth.session-token and related) | First-party cookies | Keeps you authenticated while browsing account areas of the site | Session / rolling |
Local storage (not cookies)
Your shopping cart and temporary checkout state are saved in your browser's local storage, not in cookies. This data remains on your device unless and until you proceed with an order after direct confirmation with us.
Analytics cookies — depends on your region
To decide which rule applies, our site looks up the country of your connection from the country code our hosting and network providers attach to each request. We do not store that country code.
- European Union, European Economic Area (Iceland, Liechtenstein, Norway), United Kingdom and Switzerland — opt-in. Google Analytics and Microsoft Clarity stay off unless you choose Accept in the cookie banner. If we cannot tell where you are browsing from, we apply this rule.
- Everywhere else, including the United States, Canada and Australia — opt-out. Google Analytics and Microsoft Clarity run by default, and a notice at the bottom of the page lets you opt out. Opting out switches them off and we remember your choice.
Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of analytics wherever you are, unless you later choose to accept analytics yourself.
When they run, Google Analytics and Microsoft Clarity may set cookies or similar identifiers to measure visits and see how the site is used.
Marketing cookies — opt-in everywhere
Meta Pixel and Pinterest tag stay off in every region unless you choose to allow them. If allowed, they may set third-party cookies or similar identifiers for attribution and advertising audience functions.
Changing your choice
Your choice is stored in the loom_hearth_cookie_consent cookie for 180 days. To change it, clear this site's cookies in your browser and the banner or notice will appear again.
4. Third parties who receive your data
We share your data with the following third parties only to the extent necessary to operate the store. We do not sell your personal data to anyone.
Stripe — payment processing. If you proceed with an order after direct confirmation with us, your email address, order line items, and order metadata are transmitted to Stripe so payment can be authorised and, if approved after verification, captured. Your payment card details are entered directly on Stripe's servers and are never seen or stored by us. Stripe's privacy policy is available at stripe.com/privacy.
Postmark — transactional email delivery. When you proceed with an order after direct confirmation with us, or request a password reset, we transmit your email address, name, order details, and shipping address to Postmark to deliver your confirmation or reset email. Postmark's privacy policy is available at postmarkapp.com/privacy-policy.
Vercel — website hosting. This site is hosted on Vercel's infrastructure. As with any web host, Vercel's servers process requests from your browser and may retain standard server access logs including IP addresses for a limited period as part of normal hosting operations. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.
Shipping carriers (DHL Express, FedEx International, Aramex) — order fulfilment. When your order is dispatched, we share your full name, shipping address, and where required by the carrier and provided during order handling, your phone number with the carrier responsible for delivering your order. These carriers process your data solely to complete delivery.
Google Analytics and Microsoft Clarity — site analytics. When analytics is on for you (see section 3), usage data such as pages viewed, device and browser details, approximate location derived from your IP address, and — for Clarity — clicks, scrolling and mouse movement is sent to Google and Microsoft. Their privacy policies are available at policies.google.com/privacy and privacy.microsoft.com.
No other third-party service currently receives your personal data. If we add a tool that requires sharing your data — for example an email marketing platform — we will update this policy before activating that tool.
5. How long we keep your data
| Data category | Retention period | Reason |
|---|---|---|
| Order records (name, email, shipping address, order details, Stripe references) | 7 years from the order date | Tax and financial record-keeping obligations |
| Account data (name, email, password hash) | Until you request deletion, or 3 years of account inactivity | Allowing you to access your order history |
| Session tokens | Until the session expires or you log out | Authentication |
| Password reset tokens | Until used or expired (short-lived) | Security |
| Hashed login rate-limit records | 24 hours from creation | Security — short-term abuse prevention |
| Newsletter subscriber email | Until you unsubscribe or request deletion | Marketing consent |
When a retention period ends, we delete or anonymise the relevant data.
6. International data transfers
Loom and Hearth Studio LLC is operated from Morocco. When you interact with this site, your data is processed in Morocco and on servers operated by our third-party providers located in the United States and European Union.
If you are located in the European Union or United Kingdom, transfers of your personal data to countries outside the EEA and UK are governed by the Standard Contractual Clauses approved by the European Commission, or by an equivalent transfer mechanism applicable under UK data protection law.
7. Your rights — EU and UK residents (GDPR and UK GDPR)
If you are located in the European Union or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:
- Right of access — you may request a copy of all personal data we hold about you.
- Right to erasure — you may request that we delete all personal data we hold about you, subject to our legal retention obligations (for example, we must retain order records for tax purposes).
- Right to portability — you may request your data in a structured, machine-readable format (CSV).
- Right to rectification — you may request that we correct inaccurate data.
- Right to object — you may object to processing based on legitimate interest, including direct marketing.
- Right to restrict processing — you may request that we limit processing while a dispute is resolved.
We will respond to all rights requests within 30 days. To submit a request, email [email protected] with the subject line "Privacy Request" and a description of what you are requesting.
If you are unsatisfied with our response, you have the right to lodge a complaint with the supervisory authority in your country of residence.
8. Your rights — California residents (CCPA)
If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the following rights:
- Right to know — you may request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties with whom we share it.
- Right to deletion — you may request that we delete your personal information, subject to legal retention obligations.
- Right to opt out of sale — we do not sell your personal information to any third party. There is nothing to opt out of.
- Right to non-discrimination — exercising any of these rights will not result in different pricing or service levels.
To submit a request, email [email protected] with the subject line "California Privacy Request." We will respond within 45 days.
9. Newsletter and marketing emails
If you subscribed to our newsletter, we will send you updates about new arrivals, lookbook releases, and early access to new pieces. You can unsubscribe at any time by clicking the unsubscribe link in any email we send, or by emailing [email protected].
We do not send marketing emails to anyone who has not explicitly opted in.
10. Security
We take reasonable technical and organisational measures to protect your personal data, including:
- All connections to this site are encrypted via HTTPS.
- Passwords are stored as one-way hashes — we cannot read your password.
- Login attempts are rate-limited to reduce the risk of unauthorised access.
- Payment card data is processed entirely by Stripe and never stored on our servers.
No system is entirely secure. If you have reason to believe your account has been compromised, contact us immediately at [email protected].
11. Children
This site is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us and we will delete it promptly.
12. Changes to this policy
When we make material changes to this policy, we will update the "Last updated" date at the top of this page. If the changes are significant, we will notify registered account holders by email.
We encourage you to review this policy periodically.
13. Contact
For any question, request, or concern about this Privacy Policy or how we handle your data:
Loom and Hearth Studio LLC
Address: 5830 E 2ND ST, STE 7000 #34442, CASPER, WY 82609
Email: [email protected]
Complaints are handled by email only at [email protected].
We aim to respond to all inquiries within 5 business days.