Privacy

Yarns and Buttons, a single-owner studio operating from [business address — required by the Data Privacy Act]TBC (placeholder — to be confirmed before launch). Questions and requests: email hello@yarnsandbuttons.com or use the contact form.

To send you an order: your name, email address, phone number and shipping address. Without these there is nothing to deliver and no way to tell you it is coming.

To quote a custom piece: what you describe, and any reference photographs you upload. Photographs are stored only so the studio can look at them while making your piece.

If you make an account: your email address, a hashed password (never the password itself), and any addresses you choose to save. Accounts are optional — you can buy as a guest.

To keep your cart: a cookie holding an identifier for it. It carries no personal information and is not used to advertise to you.

Your card details. Payment happens on the payment provider's own page, not on this site. Card numbers, wallet credentials and bank logins are never sent to us and never stored here.

Running a store means using services, and each of these sees only the part it needs: the payment provider (order total and contact details, to take payment), the email provider (your email address, to send confirmations), the hosting and database providers (everything, as the store's infrastructure), and file storage for reference photographs.

None of them are permitted to use your information for their own purposes. Nothing here is sold, and there is no advertising or third-party analytics tracking on this site.

We receive your name, email address and whether Google has verified that address — nothing else, and never your Google password. A verified address is also what lets us attach orders you placed as a guest to your new account.

Order records are kept for 5 yearsTBC (placeholder — to be confirmed before launch), which is the period business records must be retained for. Custom order requests and reference photographs are kept for 2 yearsTBC (placeholder — to be confirmed before launch) unless you ask sooner. Account information is kept until you close the account.

Under the Data Privacy Act of 2012 you can ask what is held about you, have it corrected, have it deleted, or object to how it is used. Use the contact form and you will get an answer within 15 daysTBC (placeholder — to be confirmed before launch). If you are not satisfied you can complain to the National Privacy Commission.

Deleting an account does not erase orders already placed — those are the business records above.

Three, all of them necessary: one identifying your cart, one keeping you signed in if you have an account, and one holding the intermediate step of an admin login. There are no advertising or tracking cookies, which is why this site has no cookie banner.

If this changes materially, the date at the top changes with it. See also terms.