Privacy.
We collect as little as we can. Here's exactly what that is, what it's for, and how to change your mind.
This policy covers lasted.studio and the emails we send. It's written to be read, not skimmed, but if anything is unclear, ask us: team@lasted.studio.
Who's responsible
LASTED is run by Lasted LLC, a Pennsylvania limited liability company based in Philadelphia. Our mailing address is on every email we send and available on request. We're the "controller" of your information under privacy laws that use that word.
What we collect, and why
- When you join the list: your email address, the date you signed up, and where on the site you did it. Used to send you the email you asked for and to know which page brought you.
- When you place an order: your name, email, shipping and billing address, phone number if you give one, what you bought, and your order history with us. Used to charge you, ship to you, send order updates, handle exchanges and returns, and answer your questions.
- Payment details: handled entirely by our payment processor. We see the last four digits of your card and the card type — never the full number.
- When you write to us: whatever you send and our replies, kept so we can follow up.
- When you visit the site: your IP address, browser and device type, pages viewed, how you got here, and rough location derived from your IP. Used to keep the site running, spot abuse, and understand in aggregate what people look at.
- If you submit a reflection or story to us: what you write and whether you chose to make it public. Used only as you chose.
We don't collect anything you don't give us or that isn't a by-product of using a website, and we don't buy information about you from anyone.
Who handles it for us
We're a very small company and rely on a few services to run the shop. Each one sees only what it needs for its job, under its own privacy terms:
- Shopify — runs the store, checkout, and order records, and processes payments through Shopify Payments.
- Klaviyo — stores the email list and sends our emails.
- Shipping carriers (USPS, UPS) — receive your name and address to deliver your order.
- Our print and fulfilment partner — receives your name and shipping address for orders it packs on our behalf.
- Vercel — hosts this website and logs standard technical data.
Beyond these, nobody else gets your details, except if the law requires it (a court order, for example), or if LASTED is ever sold, in which case your information would transfer with it and you'd be told.
How long we keep it
- Email list: until you unsubscribe or ask us to delete you.
- Order records: 7 years, because tax law requires it.
- Correspondence: 2 years after the last message.
- Site logs: 90 days.
- Reflections you submit: until you ask us to remove them.
Cookies and tracking
The site uses a small number of cookies: ones the shop needs to work (your cart, your session, fraud checks at checkout) and analytics that tell us, in aggregate, what people look at. We don't run advertising pixels today. If that ever changes, this policy will say so and you'll be able to opt out.
You can block or clear cookies in your browser at any time; the site will still work, though your cart won't be remembered. We don't currently respond to browser "Do Not Track" signals because there's no agreed standard for them.
Your choices and rights
- Unsubscribe: every email has an unsubscribe link. It takes effect immediately, and always within 10 business days.
- See what we hold: ask and we'll send you a copy of the personal information we have about you.
- Correct it: if something's wrong, tell us and we'll fix it.
- Delete it: ask and we'll delete what we can. We have to keep order records for tax purposes, but everything else goes.
- Take it with you: ask and we'll give you your information in a common file format.
- Object or restrict: you can ask us to stop using your information for a particular purpose.
To exercise any of these, email team@lasted.studio from the address you used with us. We'll respond within 30 days, we'll never charge you, and we'll never treat you differently for asking. If you live in a state with its own privacy law and think we haven't handled a request properly, you can also contact your state attorney general.
Security
The site runs over HTTPS. Checkout and payments are handled on Shopify's PCI-compliant systems. Access to customer records is limited to the people who need it to fulfil orders — at the moment, that's one person. No system is perfect; if a breach ever affects you, we'll tell you as soon as we know.
Where your information lives
We're in the United States and so are the services we use. If you're visiting from outside the US, your information is processed here.
Children
The site isn't directed at anyone under 16, and we don't knowingly collect information from anyone under 13. If you think we have, tell us and we'll delete it.
Changes
If we change this policy in a way that matters, we'll update the date at the top and, if you're on the list, tell you by email. We review it at least once a year.