At The Humiovi, we value your privacy and are committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, and safeguard your data when you visit our website or make a purchase.
1. Information We Collect
Checkout Verification Data
When you place an order, we record the IP address and the browser and device information your order was placed from, together with the results of the checks our payment processor runs on the payment — the address and security-code checks, the cardholder verification (3-D Secure) outcome, and its risk assessment. We use this information to prevent fraud and to respond to payment disputes. It is retained with the order record for the period described under Data Retention and is not used for marketing.
Hallmark Photo Submissions
When you send photos of a maker's mark through our "Identify my mark" form, we collect the photos, your email address and, if you give them, your name, what you know about the piece and an optional name to credit. Your email address is used only to reply to you; we do not add it to any mailing list.
The form asks for your consent before you send. If a photo meets our standards, you consent to us publishing it in our hallmark reference, credited with the name you give or anonymously. We do not publish your email address. Photos we do not publish stay in private storage that only our staff can open. We remove location and camera details from photos where we can; an iPhone HEIC photo we cannot convert is kept as you sent it, in the same private storage.
You can ask for a published photo to be removed at any time by emailing info@humiovisedona.com.
Browsing Data
We automatically collect certain information when you visit our website, including:
- IP address
- Browser type and version
- Pages visited and time spent on each page
- Referring website
- Device type and operating system
3. Service Providers
We use these companies to run the shop. Each receives only what it needs for its job:
- Square — card and wallet payments, our in-store point of sale and our customer records; receives your payment details, billing address and order.
- PayPal (including Venmo) — PayPal and Venmo payments; receives your order total and the details PayPal needs to take the payment.
- Shippo and the shipping carriers (such as USPS and UPS) — shipping labels and tracking; receives your name, shipping address and parcel details.
- Supabase — our database and sign-in; stores your account, orders and preferences.
- Resend — email delivery; receives your name and email address to send order emails and, if you subscribed, our letters.
- Vercel — website hosting; processes your IP address and the pages you request in order to serve them.
- Sentry — error monitoring; receives technical details of errors (browser, device, the page) so we can fix them.
- Google Customer Reviews — after a purchase, offers you an optional Google survey about your order; to show the offer, Google receives your email address, order number, delivery country and estimated delivery date.
- Google Analytics — counts visits and how pages are used (pages viewed, referring site, device and browser, approximate location); sets analytics cookies.
- Vercel Web Analytics and Speed Insights — counts page views and measures how fast pages load, without cookies.
- Google Ads — measures which of our Google ads lead to visits and purchases and lets us show our pieces to past visitors (remarketing); sets advertising cookies, and for a purchase receives the order value and a hashed (scrambled) email address and phone number.
- Meta (the Meta Pixel and Conversions API) — measures which of our Facebook and Instagram ads lead to visits and purchases and lets us show our pieces to past visitors; sets advertising cookies, and for a purchase we send Meta the order value and items, your IP address and browser, and hashed (scrambled) contact details: email, phone, name, city, state, ZIP code and country.
We have no other analytics or advertising tags on the site.
5. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Account data — Retained while your account is active and for 3 years after account closure.
- Order and transaction data — Retained for 7 years to comply with tax and accounting obligations.
- Marketing preferences — Retained until you withdraw consent or unsubscribe.
- Analytics data — Kept by Google Analytics for the period set in our Google Analytics account, at most 14 months.
- Customer support communications — Retained for 3 years after the last interaction.
- Layaway payment authorization — If you buy on layaway, the authorization you signed for the plan's card charges (the billing address, IP address and browser it was given from, with the payment schedule you agreed to) is kept even after you delete your account, for as long as we need it to evidence the plan's charges and to handle any payment dispute or legal claim about them, and no longer.
6. Cookies and Your Choices
We use three kinds of cookies and similar browser storage:
- Necessary — keep your bag, your sign-in and checkout security working. Always on.
- Analytics — tell us how the site is used (Google Analytics, and Vercel's cookie-free page counts).
- Advertising — measure our ads and show our pieces to past visitors on Google, Facebook and Instagram (Google Ads, the Meta Pixel).
In the United States, analytics and advertising are on by default, and you can turn either off at any time.
In the European Economic Area, the United Kingdom, Switzerland and Canada, no analytics or advertising tools load until you choose: the banner offers Accept all, Reject all, or Choose (separate Analytics and Advertising switches).
You can change your choice at any time with the Cookie settings link at the foot of every page. Your choice is kept in this browser, so it applies to this browser and device only.
Our in-store iPad loads no advertising tools and no Google Analytics.
Your Privacy Choices
- Opt out of targeted advertising — use the Your privacy choices link at the foot of every page and press Opt out of targeted ads. Advertising cookies stop on this browser at once, and we stop sending your purchases to Google Ads and Meta from this browser.
- Global Privacy Control — if your browser sends the Global Privacy Control signal, we treat it as that same opt-out automatically, and an earlier choice to allow advertising does not override it.
- Do Not Track — if your browser sends Do Not Track, we turn off both analytics and advertising.
- Cookie settings — switch Analytics and Advertising on or off separately.
Because these choices are stored in your browser, clearing your browser data or using another browser or device starts fresh, except that Global Privacy Control and Do Not Track are read on every visit.
7. Data Security
We implement industry-standard security measures to protect your personal information:
- All data is transmitted over encrypted SSL/TLS connections.
- Payment processing is handled by PCI-DSS compliant third-party processors.
- Access to personal data is restricted to authorized personnel only.
- We regularly review and update our security practices.
8. Your General Rights
Regardless of your location, you have the following rights regarding your personal data:
- Access — Request a copy of the personal information we hold about you.
- Correction — Request corrections to any inaccurate personal information.
- Deletion — Request deletion of your personal data, subject to legal retention requirements.
- Opt-out of marketing — Unsubscribe from marketing emails at any time using the unsubscribe link in any email or by contacting us directly.
9. Children's Privacy
Our website is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will take steps to delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page with a revised "Last updated" date. We encourage you to review this policy periodically. Continued use of our website after changes constitutes acceptance of the updated policy.
11. California and Other US State Privacy Rights
If you live in California, or in another US state with a consumer privacy law, you may have these rights, depending on the state:
- Know and access — ask what personal information we hold about you, where it came from, why we use it and who receives it, and get a copy.
- Correct — ask us to correct inaccurate information.
- Delete — ask us to delete your information, subject to exceptions (for example, records the law requires us to keep).
- Opt out of selling, sharing and targeted advertising — see Selling and Sharing and Your Privacy Choices above. We honour the Global Privacy Control signal as a valid opt-out.
- Limit the use of sensitive personal information — we do not use sensitive personal information for anything beyond providing what you ask for.
- Non-discrimination — we will not deny you service, charge you a different price or give you a different quality of service because you used these rights.
Categories we collect: identifiers and contact details (name, email, phone, addresses), commercial information (orders), internet activity (pages viewed, device and browser), and approximate location from your IP address. Advertising companies receive internet activity and, for a purchase, the order value and hashed contact details, as described under Service Providers.
We do not knowingly sell or share the personal information of anyone under 16.
To use any of these rights other than the opt-out, email info@humiovisedona.com. We will confirm your identity before acting and reply within 45 days. You may use an authorised agent. If we decline a request, we will explain why, and you may appeal by replying to that email.
12. Browser Privacy Signals
If your browser sends the Global Privacy Control (GPC) signal, we turn off advertising cookies and stop sending your purchases to advertising companies from that browser; analytics may stay on in the United States. If your browser sends Do Not Track (DNT), we turn off both analytics and advertising. You do not need to do anything else.
