Legal

Privacy Policy

Knotty Stitches Couture LLC, Utah. This Privacy Policy describes how we collect, use, and protect personal information when you visit this website or submit an inquiry. By using the site you agree to the practices described here.

1. Who we are. Knotty Stitches Couture LLC is a Utah-based custom couture, costume, and kilt-making studio. Inquiries can be sent through the Contact page. If the studio offers online appointment booking, the booking page will be linked from the site navigation while it is available.

2. What we collect.

Contact form submissions: name, email, phone number, message text, and the timestamp of submission.
Newsletter signups: email address, optional first name, marketing consent timestamp, and an unsubscribe token used to honor opt-out requests.
Appointment booking (only when online booking is offered): the service and appointment time you choose (including any listed price), your first and last name, any other intake answers you give (such as measurements, fitting notes, garment or design details), your e-signature and the time you signed, and a snapshot of the completed intake form. If the studio asks to keep a card on file, the card is entered directly into a secure form provided by our payment processor, Stripe. The studio keeps only Stripe's customer and payment-method reference numbers, the card brand, last-four digits, expiration date, the Name on Card, and whether the card was Validated or Failed (with a short message and timestamp). Your full card number and security code go straight to Stripe and are never stored or seen by the studio. Same-day or cardless scheduling is handled through the Contact page.
Spam protection: forms use a simple built-in "verify you're human" check that runs on this site. It does not use a third-party captcha service or track you.
Site usage: standard server logs (IP address, browser user-agent, pages visited) used for security, debugging, and abuse prevention. These are not used for marketing profiling.
Admin accounts: if you are an authorized administrator, we store your login email, hashed password, role assignments, session metadata, and an admin activity log.

3. How we use the information. We use submitted personal information to respond to your inquiry, to fulfill custom orders and lessons, to schedule and prepare for appointments, to send transactional confirmations and updates by email, and to keep records for the studio's books. Card-on-file details (Stripe reference numbers, last-four digits, brand, expiration, and Name on Card) let the studio confirm that a card on file is valid and, only if the studio has turned on in-app payments, charge fees or service amounts you have agreed to. Booking an appointment does not charge your card by itself; any charge is a separate step taken by the studio. If you opt in to the newsletter, we use your email to send occasional studio updates and may include links to portfolio work, classes, or available pieces. We do not sell or rent personal information. We do not use contact-form or booking data for unrelated marketing without your separate opt-in.

4. Third-party service providers. We use a small number of vendors that process information on our behalf as part of running the site and studio. Each operates under its own privacy policy:

Mailgun — outbound transactional email delivery.
Microsoft Azure Blob Storage — file and content storage (including booking records and intake snapshots).
Cloudflare — website security, bot and abuse protection, static asset delivery, and caching. Every visit to the site passes through Cloudflare, which may set a short-lived security cookie. See Cloudflare's Privacy Policy.
SmarterASP.NET — web application hosting.
Stripe — secure card entry, card-on-file, and (only if the studio turns it on) card payments. The studio stores only the card brand, last-four digits, expiration date, and Stripe reference numbers. See Stripe's Privacy Policy.
Google Analytics (GA4) — aggregated public-site traffic measurement when enabled by the studio (page path, referrer, device/browser type). See Google's Privacy Policy.

5. Cookies & session data. The public site may load Google Analytics 4 (gtag) when the studio has configured a Measurement ID. When the optional cookie consent banner is enabled, analytics scripts load only after you Accept; Decline keeps GA4 off in that browser. When the banner is disabled, a configured Measurement ID may load gtag without a prompt. GA4 helps us understand aggregate traffic (pages viewed, approximate geography, referral sources, and device category). It is not used for advertising remarketing on this site. You can limit Google advertising personalization via Google Ads Settings and review browser controls that block third-party scripts. The admin portal sets a session cookie when an administrator signs in; that cookie is required for the portal to function and is separate from public analytics. Consent preferences are stored in local browser storage (not as a server cookie) when the banner is used.

6. Email open and click tracking. Transactional emails sent from the admin tools may include a tiny tracking pixel and wrapped links so the studio can confirm that confirmation emails were delivered and read. These are used for delivery diagnostics, not advertising.

7. Data retention. Contact inquiries and related email history are retained for as long as needed to service the inquiry and meet recordkeeping needs. Booking records, intake answers, e-signatures, Stripe reference numbers and last-four card details, and intake snapshots are kept for studio operations and recordkeeping unless you request earlier deletion where applicable. Standard server logs are retained per the configured retention window (90 days by default) and then deleted. You may request earlier deletion at any time (see Section 10).

8. Security. We use industry-standard measures including TLS in transit, hashed passwords, role-based access controls, and audit logging. Card numbers and security codes are entered into Stripe's secure form and stored by Stripe; the studio never stores full card numbers or security codes and cannot see them. Confirmation emails and CSV exports include card last-four digits only (never the full card number or CVC). No system is perfectly secure; we cannot guarantee that information will never be intercepted or compromised.

9. Newsletter unsubscribe. Marketing emails include a one-click unsubscribe link. You may also opt out through our email opt-out page or by requesting removal through the Contact page. We honor unsubscribe requests promptly and stop sending marketing messages to that address.

10. Your rights. Consistent with the Utah Consumer Privacy Act (UCPA) and other applicable Utah privacy laws, Utah residents may request to (a) confirm whether the studio is processing personal information about you, (b) access the personal information we hold about you, (c) correct inaccurate information, (d) delete personal information you provided, and (e) opt out of any sale or targeted advertising (the studio does not engage in either). Send requests through the Contact page and we will respond within the time required by Utah law.

11. Children. This site is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has submitted information through the site, please notify us and we will delete it.

12. International visitors. The site is operated in the United States. By using the site you understand that your information will be processed in the United States, which may have different privacy laws than your country of residence.

13. Changes to this policy. We may update this policy from time to time. Changes take effect when posted with a revised effective date below.

14. Contact for privacy requests. Privacy questions and rights requests can be sent through the Contact page or by email to [email protected].

Effective date: October 23, 2026.

This default privacy policy is a starter template, not legal advice. Knotty Stitches Couture LLC should have it reviewed by qualified Utah legal counsel before relying on it in any regulatory matter or dispute.