Privacy Policy

Marin Threadworks ("Marin Threadworks," "we," "us") is a branded apparel and custom goods studio based in San Rafael, California. This Privacy Policy explains what information we collect through marinthreadworks.com and the Marin Threadworks Client Studio (the "Studio"), why we collect it, who processes it on our behalf, and the choices you have.

We collect only what we need to quote, produce, and reorder your branded goods.

• Contact information: your name, business name, email address, phone number, and mailing or delivery address.
• Business and account information: company profile, trade, crew size, login credentials managed by our authentication provider, and role (customer or administrator).
• Quote and order information: project type, business package selection, item quantities, decoration methods and placements, preferred deadlines, notes you send us, quote numbers, deposit and payment status, and order history.
• Employee and crew roster information: crew member names, job titles, fit preference (unisex, men's, women's), and garment sizes that you enter so we can personalize and reorder apparel.
• Uploaded artwork: logos, artwork files, and production files (including PNG, JPG, SVG, PDF, AI, EPS, DST, PES, and ZIP), stored in a private bucket accessible to your account and our production staff.
• Device and usage information: IP address, browser and device type, pages viewed, referring URL (including links from our Squarespace site), and timestamps.
• Communications: emails and messages you send us, contact form submissions, and any attachments you include.

We use a small number of cookies and similar browser storage technologies. Strictly necessary cookies keep you signed in, maintain your session, and secure form submissions; the Studio will not work correctly without them.

We may use privacy-conscious analytics to understand aggregate traffic, which pages convert, and where visitors arrive from. Analytics data is used in aggregate to improve the site — we do not use it to build advertising profiles.

Our hosting and platform providers automatically log device and connection information (such as IP address and user agent) for security, abuse prevention, and reliability.

You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will prevent sign-in, quote submission, and account features from working.

We use the information above for the following purposes:

• To prepare estimates and final quotes and to communicate about them.
• To produce, personalize, decorate, and deliver your order.
• To create and secure your account and to enable reordering from a saved crew roster.
• To process deposits and balances through our payment providers.
• To send transactional messages: quote confirmations with your quote number, deposit and payment links, proof approvals, production status, and delivery notices.
• To provide customer support and keep records of what we produced for you.
• To detect, prevent, and investigate fraud, abuse, and security incidents.
• To meet legal, tax, and accounting obligations.
• To send occasional marketing about our services, only where permitted and always with an unsubscribe link.

We do not run every system ourselves. The following categories of service providers process information on our behalf under contract, only for the purposes we specify:

• Application platform and database (Lovable, built on Supabase infrastructure): hosts the Studio, stores your account, quotes, crew rosters, and uploaded artwork, and provides authentication and private file storage.
• Email delivery (Brevo, and our transactional sending domain): sends quote confirmations, deposit and payment links, production updates, and internal notifications to our team. Delivery metadata such as sends, opens, and bounces may be logged.
• Google Sign-In: if you choose to sign in with Google, Google authenticates you and shares your name, email address, and profile image with us. Google's handling of your Google account data is governed by Google's own privacy policy.
• Payment providers: deposits and balances are collected through a hosted payment link. The payment provider collects and processes your card or bank details directly — we never receive or store full payment card numbers. We receive only the amount, status, and reference for your order.
• Production and fulfillment partners: garment suppliers, decorators, and shipping carriers receive the minimum information needed to produce and deliver your order (for example, names and sizes for personalization, and a delivery address).
• Professional advisors: accountants, insurers, and attorneys, where reasonably necessary.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act. We have not done so in the preceding twelve months.

We do not sell or share the personal information of employees or crew members that you enter into a roster. That information is used solely to produce and reorder your goods.

There is no industry-standard response to browser "Do Not Track" (DNT) or Global Privacy Control signals for the type of processing we perform. Because we do not track you across third-party websites for advertising, we do not alter our practices in response to DNT signals; we honor opt-out preference signals where the law requires us to.

Third parties whose code may run when you use the Studio (our platform host, authentication provider, payment provider's hosted checkout, and font hosting) may set their own cookies or log requests under their own policies. We do not permit advertising networks or third-party ad trackers on the Studio.

Our marketing site may link out to third-party sites; their privacy practices are their own.

We keep information only as long as needed for the purpose it was collected, then delete or anonymize it. In general:

• Quote requests that never become orders: retained up to 24 months, so we can honor pricing and follow up, then deleted.
• Order, invoice, and payment records: retained at least 7 years, as required for tax and accounting purposes.
• Account profile, company profile, and crew roster: retained while your account is active and for 24 months after your last order, so reordering stays effortless — or until you ask us to delete it.
• Uploaded artwork and digitized production files: retained while your account is active and for 3 years after your last order, so reorders match previous runs exactly.
• Email delivery logs and support correspondence: retained up to 24 months.
• Server, security, and access logs: typically retained up to 12 months.

You can review and update most of your information — company profile, crew roster, sizes, and contact details — directly in your account.

You may request a copy of the personal information we hold about you, correction of inaccurate information, or deletion of your account and associated data by emailing marinthreadworks@gmail.com with the subject line "Privacy Request." We will verify your identity, usually by confirming control of the email address on file, and respond within 45 days.

When you request deletion we remove your account, company profile, crew roster, and uploaded artwork. We may retain order, invoice, and payment records where we are legally required to, and we may retain a minimal suppression record so we do not email you again.

California residents may exercise the rights described above (know, delete, correct, and opt out of sale/sharing) without discriminatory treatment. You may use an authorized agent; we will ask for proof of authorization.

You can unsubscribe from marketing email at any time using the link in any marketing message. Transactional messages about an active quote or order will continue.

We protect your information with measures appropriate to its sensitivity, including encryption in transit (HTTPS/TLS), encryption at rest with our platform provider, row-level security rules so each account can access only its own records, role-based administrator access, private (non-public) storage buckets for uploaded artwork with time-limited access links, and least-privilege service credentials that are never exposed to the browser.

We review access periodically and log administrative activity. No method of transmission or storage is perfectly secure; if we become aware of a breach affecting your personal information, we will notify you and any regulator as required by California law.

Please use a strong, unique password and keep your login credentials confidential.

The Studio is a business-to-business service and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy as our services or vendors change. We will update the effective date above and, for material changes, notify account holders by email.

Privacy questions and requests: marinthreadworks@gmail.com — Marin Threadworks, San Rafael, California. We aim to respond within five business days.