1. Who we are
Desk Acorn is an independent online store selling keycaps and desk accessories. Our store runs on WordPress with WooCommerce.
- Data controller: Desk Acorn
- Contact: hello@deskacorn.com
- Business address: available on request
2. What we collect
- Order details — your name, email address, shipping address, phone number, and the items you ordered.
- Account details — if you create an account, your email address, name, and order history. Passwords are stored hashed and we never see them.
- Payment details — handled by our payment provider. We receive confirmation that a payment succeeded, the amount, the card brand, and the last four digits. We never receive or store your full card number, security code, or bank credentials.
- Messages — anything you email us, including photos you attach.
- Technical data — IP address, browser and device type, referring page, and the pages you visit on our site.
- Cart and session data — stored in cookies, described in section 8.
We do not ask for sensitive information such as health data or government identification numbers. Please do not send it to us.
3. How we use it
- To take payment, pack and ship your order, and clear customs.
- To send order confirmations and shipping updates.
- To answer your questions and handle returns.
- To prevent fraud and respond to payment disputes.
- To keep tax and accounting records, as the law requires.
- To understand which pages people use, in aggregate.
We do not make automated decisions that affect you, and we do not build advertising profiles.
4. Who we share it with
Only providers who need the data to do a specific job for us, acting on our instructions and bound by confidentiality:
- Hostinger — website hosting
- Cloudflare — network security and email routing
- Brevo — sending order and shipping emails
- Our payment provider — processing your payment
- Shipping carriers and consolidators — delivering your parcel and clearing customs
- Automattic / WooCommerce — store software
We may also disclose information where the law requires it, or to defend a legal claim.
We do not sell your personal information, and we do not share it for advertising.
5. Where your data goes
We and our providers may process your information in countries other than your own. Where data leaves the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses or the UK Addendum with our providers. Email us if you would like more detail.
6. How long we keep it
- Orders and invoices — 7 years, for tax and accounting.
- Support emails and return records — 3 years after the last contact.
- Account data — until you ask us to delete it, or 3 years after your last order.
- Server logs — up to 12 months.
- Cart and session data — until the session expires.
7. Your rights
Depending on where you live, you can ask for a copy of your data, correct it, delete it, receive it in a portable format, object to or restrict certain processing, and withdraw consent. We will not treat you differently for exercising a right.
California residents can also opt out of sale or sharing (we do neither) and appeal a refusal. EEA and UK residents can complain to their local supervisory authority.
To make a request, email hello@deskacorn.com with the subject “Privacy request”. We may ask you to verify your identity, usually with the email address used on the order. We reply within 30 days, or 45 days for California requests where an extension applies.
8. Cookies
We only use the cookies the store needs to work:
- woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* — your cart and checkout (session to 2 days).
- wordpress_logged_in_*, wordpress_sec_* — keeping you signed in (session to 14 days).
- A preference cookie — remembering your language or region (1 day).
- cf_clearance, __cf_bm — security and bot protection (up to 30 days).
We do not set advertising or analytics cookies. If we add them, we will update this policy and ask for your consent where the law requires it.
You can block cookies in your browser settings, but blocking the essential ones will stop the cart and checkout from working.
9. Email
We email you about your order: confirmations, shipping notices, and replies to your questions. We do not send marketing email at the moment. If we start, we will ask for your consent first, and every message will carry a one-click unsubscribe link.
10. Security
HTTPS across the whole site, restricted admin access, two-factor authentication on our own accounts, and order data visible only to those who need it. Card details never touch our servers. If a breach affects your information, we will notify you and any relevant authority as the law requires.
11. Children
Our store is not intended for children. We do not knowingly collect information from anyone under 16, or under 13 in the United States. Email us and we will delete it.
12. Changes
We may update this policy when our tools change. If a change matters to your rights, we will email you before it takes effect.
13. Contact
Questions or requests: hello@deskacorn.com. We reply within 2 business days.