Privacy policy

This policy explains what the Columbus Saints store collects when you shop at shop.columbussaints.org, why, and who it's shared with. The store is run by Saints Performing Arts Inc. (the Columbus Saints), a 501(c)(3) nonprofit in Central Ohio.

We never sell your personal information.

What we collect

When you place an order:

• your email address, name and shipping address, and your phone number if you give it;
• if you choose to pick up at a Saints event instead of shipping: your name, your phone number (so our table can reach you on the day) and which event;
• what you ordered, what you paid, and any promo code you used;
• whether you ticked "Email me about new merch and pre-orders".

Your card details go straight to Square, our payment processor. They never reach our store's systems, and we never see or keep your card number.

While you browse:

• a cart cookie, so your cart is still there when you come back;
• an order cookie, when you open your order confirmation link, so the page can show your order without the link's private code staying in your browser's address bar;
• a source cookie for 30 days, noting whether you arrived from a link such as Facebook, Instagram, Google or an email. It tells us which posts bring shoppers, not who you are;
• to stop fraud, we keep a scrambled code made from your internet address when you try to pay. We can't turn it back into your address.

There are no customer accounts or passwords.

Our chat and email assistants

The chat assistant on the store's pages is an automated assistant, not a person. It answers from a list of answers the Saints have approved, using an AI model (Anthropic's Claude) provided through Bright Foundry Designs, who build and run the store. What you type is sent to them to write the reply.

• We don't keep your conversation. We keep only totals of what shoppers ask about, for example "12 sizing questions this month, mostly about hoodies", to improve the store and the answers.
• If the assistant can't answer something, the question itself (not who asked it) is emailed to the store and kept for up to 90 days, so we can add a clear answer.
• It can't see orders or anything about you, and it isn't on the cart, checkout or order pages.
• Please don't type card numbers or personal details into the chat.

Email to shop@columbussaints.org is sorted, and replies are drafted, by an email assistant from Bright Foundry Designs that uses the same AI model. It may look up your own order, only when you email from the address on that order. A person at the Saints reads and approves every reply before it's sent.

When an email doesn't get a drafted reply (for example a return request that goes straight to a person, or a delivery notice), the store keeps the sender's address, the subject and a one-line summary so our volunteers can see it. The email itself stays in our Google Workspace mailbox.

How we use it

• To take payment, pack and ship your order, and send your order confirmation and shipping emails.
• To answer your questions and handle returns and exchanges, and to email you about your order: for example, a reminder before an event where you're picking up, or, if you couldn't pick up, a link to pay for shipping so we can mail it. A person at the Saints reviews every one of these emails before it's sent.
• To prevent fraud, such as bots testing stolen cards.
• To understand what sells, through store reports.
• To email you about new merch and pre-orders, only if you ticked the box. Every one of those emails lets you unsubscribe.

Who we share it with

Only the services that run the store, and only what each one needs:

• Square: takes your payment, and, if you couldn't pick up your order, hosts the link where you pay for shipping and give your address.
• EasyPost, USPS and FedEx: your name and shipping address, to make the shipping label and deliver your package.
• Google (Google Workspace): our email, including shop@columbussaints.org. Order and shipping emails are sent through it.
• Bright Foundry Designs: builds and runs the store, the chat assistant and the email assistant.
• Anthropic: provides the AI model the chat and email assistants use. It receives the chat messages and emails those assistants work on, to write a reply.
• Railway and Supabase: host the store and store its data securely.
• Meta (Facebook and Instagram): our store uses the Meta Pixel. It tells Meta when someone views a product, adds to their cart or buys, and what it was and cost, so we can see which posts and ads lead to sales. The Pixel isn't used on the checkout page where you enter your payment details. Meta may use its own cookies and link this to your Facebook or Instagram account under Meta's own policy. You can control this in your Meta ad preferences.
• Google Maps: what you type in the street address box at checkout, to suggest matching addresses. It's sent from our store's server, so Google doesn't receive your internet address, and it never gets your name, email or order.

We may also share information when the law requires it.

How long we keep it

• Orders, including what you bought, what you paid, refunds and the emails we sent you about the order, are kept as the nonprofit's accounting and tax records. At the end of each season they're also archived for our books.
• Your email on a cart you didn't finish is removed after 30 days. The cart itself is emptied after 13 months and removed after 25. We keep only totals of what was left in carts (for example "12 shirts in size L"), never who left them.
• The scrambled codes we keep to stop card testing are removed after 90 days.
• Chat: conversations aren't kept. Questions the chat assistant couldn't answer are removed after 90 days. Totals of what was asked about are kept.
• Email summaries: the one-line summaries of emails to shop@ that didn't get a drafted reply are removed after 90 days.
• Backups: a copy of the store's data is saved every night and kept for 30 days, plus one a month for 12 months.

Your choices

• Marketing emails: unsubscribe with the link in any of them, or email us.
• Cookies: you can block or clear cookies in your browser. The store still works, but your cart won't be remembered.
• See, correct or delete your information: email shop@columbussaints.org. We'll help, keeping only what we must for our accounts.

Children

The online store is meant for adults. We don't knowingly collect information from children under 13. If you think a child has given us information, email us and we'll delete it.

Changes and contact

If we change this policy, we'll update it here with the new date.

Questions? Email shop@columbussaints.org.