Privacy Policy

This Privacy Policy explains what personal information we collect when you visit brandenbauer.com, use the contact or booking forms, subscribe to the newsletter, or shop at brandenbauer.com/store (together, the “Site”), and what we do with it.

The Site is operated by Ice Dragon Studios, LLC, doing business as Branden Bauer (“we,” “us,” “our”), a company registered in Illinois, United States. For privacy laws that use the term, we are the “controller” (or “business”) responsible for your personal information. Your purchases are also governed by our Store Terms & Conditions — this Policy covers privacy; that document covers the sale.

In short: we collect what we need to answer your messages, run the store, ship your orders, and keep the Site secure. We do not sell your personal information, we do not share it for advertising, and we do not run analytics or advertising trackers on the Site.

1. Information We Collect

Information you give us

• Contact and identity: your name, email address, and — if you provide it — your phone number.
• Order information: the products you buy, your shipping and billing address, and any order notes. Payment card details are entered directly with our payment processor — we do not receive or store your full card number.
• Account information: if you create a store account, your username and password (stored in hashed form), saved addresses, and order history.
• Messages: the content of enquiries you send through the contact form, including any project details you choose to share.
• Newsletter: your email address and subscription status if you opt in.
• Bookings: if you schedule a consultation, the information you enter into the booking tool (name, email, chosen time, and any notes).

Information collected automatically

• Device and connection: your IP address, browser type and version, operating system, screen size, language, and the referring page.
• Approximate location: a city or ZIP-level estimate derived from your IP address, used to pre-fill a shipping estimate at checkout. This lookup runs against a database stored on our own server; your IP address is not transmitted to the database provider (MaxMind). The estimate is cached briefly and is never a precise location.
• Usage: pages viewed, links clicked, items added to cart, and timestamps.
• Security logs: our firewall records request metadata (including IP address and user agent) to detect and block malicious traffic.
• Cookies and similar technologies: see Section 3.

Information from third parties

• Payment and fraud results from our payment processors (authorization status, risk signals, the last four digits and card brand).
• Fulfilment and delivery status from our print-on-demand partner and shipping carriers (production status, tracking numbers, delivery scans).

2. How We Use Your Information

We use personal information to:

• Fulfil your order — take payment, produce and ship your items, send confirmations and shipping updates, and handle returns or replacements.
• Calculate tax and shipping — including the IP-based ZIP estimate that gives you a shipping quote before you finish typing your address.
• Provide customer support — answer your emails and resolve problems with an order.
• Prevent fraud and secure the Site — screen orders and payments, block malicious traffic, and investigate abuse.
• Send messages you asked for — newsletters and marketing email, only if you opted in, with an unsubscribe link every time.
• Respond to enquiries and bookings — follow up on contact-form messages and scheduled consultations.
• Meet legal and tax obligations — keep the sales and financial records the law requires, and respond to lawful requests.
• Operate and improve the Site — understand what is working, fix errors, and maintain the service.
• Establish or defend legal claims where necessary.

We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not build advertising profiles about you.

3. Cookies & Tracking Technologies

We use a small number of cookies and similar technologies:

• Strictly necessary: keep you logged in, remember your cart and checkout progress, apply security checks, and balance server load. The Site cannot work properly without these.
• Functional: remember preferences such as your chosen currency or a dismissed notice.

We do not use analytics cookies, advertising cookies, or any third-party tracking technology, and we do not allow third parties to track you across other websites through our Site. Because the only cookies we set are strictly necessary or functional, we do not display a cookie-consent banner.

Do Not Track / Global Privacy Control. Where your browser sends a “Do Not Track” or Global Privacy Control (GPC) signal, we honor it: the IP-based location estimate above is skipped, and we treat the signal as a valid request to opt out of any “sale” or “sharing” of personal information (which, as explained below, we do not do in any case).

You can also block or delete cookies in your browser settings; some store features may then not work.

4. When We Share Information

We share personal information only in these situations.

Service providers who work on our behalf

These companies process personal information only to provide a service to us, under contract, and may not use it for their own purposes:

• WooPayments (Stripe) — card payment processing, fraud screening, and sales-tax calculation. Receives your name, billing address, email, order amount, and the card details you enter directly with them.
• PayPal — payment processing when you choose PayPal or Pay Later, under PayPal's own privacy policy once you are redirected.
• Printful — print-on-demand production and shipping of made-to-order items. Receives the recipient name, shipping address, and item and artwork details.
• Shipping carriers (for example USPS) — delivery and tracking. Receive the recipient name and shipping address.
• MailPoet — sending newsletters and transactional email. Receives your email address, name, and subscription status.
• Wordfence — firewall, malware scanning, and blocklist. Processes IP addresses and request metadata.
• MaxMind GeoLite2 — the IP-to-location database used for shipping estimates. Nothing is transmitted to MaxMind; the database file runs on our server.
• Our web host — server infrastructure, backups, and server logs.
• Cal.com — scheduling consultations on the booking pages. Receives the name, email, chosen time, and notes you enter.

Legal, safety, and business transfers

• To comply with a law, subpoena, or lawful government request, or to enforce our Terms.
• To protect the rights, property, or safety of us, our customers, or the public, including fraud prevention.
• To professional advisors (lawyers, accountants) under a duty of confidentiality.
• In connection with a merger, acquisition, financing, or sale of assets — in which case we will require the recipient to honor this Policy or notify you of any material change.

What we do not do

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and similar state laws. We have not sold or shared personal information in the preceding 12 months.

5. How Long We Keep It

• Order and transaction records — for as long as needed to complete the order and handle any return or dispute, and after that for the period tax and accounting law requires (generally up to seven years).
• Account information — until you ask us to close the account, then deleted or anonymized except records we must retain.
• Support and enquiry emails — while needed to resolve your matter and for a reasonable period afterward.
• Newsletter data — until you unsubscribe, plus a short suppression record so we do not email you again.
• Security and server logs — a limited retention window, then rotated out.

6. How We Protect It

We use technical and organizational measures appropriate to the size of the operation: HTTPS/TLS encryption across the whole Site, a web application firewall and malware scanning, hardened server configuration, restricted administrative access, and payment handling delegated to PCI-compliant processors so card numbers never touch our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

7. Your Choices & Rights

Wherever you live, you can:

• Unsubscribe from marketing email at any time using the link in any such message, or by emailing us.
• Access or correct the information in your store account by signing in, or by asking us.
• Ask us to delete your information, subject to records we are required to keep.
• Ask a question or make a complaint about how we handle your information.

To make a request, email branden@brandenbauer.com with enough detail to identify your records. We may need to verify your identity before acting. We will respond within the time your local law requires, and otherwise within a reasonable period.

8. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the rights below, and we will not discriminate against you for exercising them:

• Know / access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients.
• Delete personal information we collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of; we also honor the Global Privacy Control signal (Section 3).
• Limit use of sensitive personal information — we do not use sensitive personal information for any purpose that would trigger this right.
• Use an authorized agent to submit requests on your behalf, with proof of authorization.

In the last 12 months we have collected these categories of personal information (as defined in Cal. Civ. Code § 1798.140) and disclosed them to the service providers in Section 4 for business purposes: identifiers (name, email, IP, address); customer records (billing details, payment information); commercial information (orders and purchase history); internet and network activity; and approximate geolocation (city or ZIP level, derived locally). We do not collect sensitive personal information, biometric information, or protected-class characteristics, and we do not use personal information to build a profile about you.

To exercise a California right, email branden@brandenbauer.com with the subject “California Privacy Request.” We will confirm receipt within 10 business days and respond within 45 days, extendable once by another 45 days with notice.

9. Other U.S. State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and a growing number of other states have comparable rights: to confirm whether we process your personal data, to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, or certain profiling. We do not conduct targeted advertising, sell personal data, or profile you, so those opt-outs do not apply to our processing; the access, correction, and deletion rights are handled as described in Sections 7 and 8. If we deny a request, you may appeal by replying to our decision; if the appeal is denied, some states let you contact your Attorney General.

10. EU, UK & EEA Rights

Because we ship internationally, this section applies if you are in the European Economic Area, the United Kingdom, or Switzerland. We rely on these legal bases under the GDPR / UK GDPR: performance of a contract with you (taking and fulfilling your order, providing support); our legitimate interests (fraud prevention, site security, and improving the Site); your consent (sending marketing email, withdrawable at any time); and compliance with a legal obligation (keeping tax and accounting records).

You have the right to access, rectify, erase, restrict, or port your personal data, to object to processing based on legitimate interests, and to withdraw consent for marketing. You may also lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office).

International transfers. We operate from the United States, and our service providers are mainly in the United States, so your data will be transferred there. Where required, transfers rely on the recipient's Data Privacy Framework certification or on Standard Contractual Clauses.

11. Children's Privacy

The Site is intended for adults. You must be at least 18 to place an order (see the Store Terms). We do not knowingly collect personal information from children under 13, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

12. Third-Party Links & Services

The Site links to and embeds third-party services — for example the payment processors' checkout pages, the booking tool, and our social media profiles. Once you leave our Site or interact with an embedded service, that third party's own privacy policy governs. We are not responsible for their practices, and we encourage you to read their policies.

13. International Users

The Site is operated from the United States and hosted there. If you access it from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those in your country. Section 10 describes the additional rights and safeguards that apply to EU, UK, and EEA users.

14. Changes to This Policy

We may update this Policy from time to time. When we do, we will change the “Last Updated” date above and post the new version here. If the changes are material, we will provide a more prominent notice — for example a banner on the Site or an email to subscribers. Your continued use of the Site after an update takes effect means you accept the updated Policy.

15. How to Contact Us

For any question about this Policy or to exercise a privacy right:

Email: branden@brandenbauer.com
Mail: Ice Dragon Studios, LLC, d/b/a Branden Bauer — c/o Erik Carlson, Registered Agent, 6833 Stalter Drive, Rockford, IL 61108