Skip to content
Poppy & Stone
Menu

Poppy & Stone

Privacy policy

Effective 2026-10-12

This notice explains information used by the Poppy & Stone website, customer care and available order services.

Information and purpose

Technical requests can include network address, browser information and security logs used to serve the site and investigate abuse. Cloudflare provides hosting, D1 database storage, content delivery and security.

The contact form prepares a draft containing your name, email, selected topic and message in your own email app. It does not send that information to this website. When you send the email, customer care uses it to answer your request. Include only what the question needs; do not send payment credentials or unnecessary identity documents.

An available checkout requires contact, delivery and order information to process and support the purchase. Whop provides the physical-goods checkout and handles payment details through its own interface when checkout is available. A stored bag or failed payment attempt is not a paid order. Secure order references and access checks protect order information.

Services and disclosure

Service providers process information needed for the features they deliver. Cloudflare stores website and order records in D1 and protects access. Whop processes information needed for available payment services. An unavailable payment service cannot confirm a purchase.

We use Shopify through a linked order-management hub to organize orders and fulfillment. Order references, purchased items, quantities, the recipient’s name, delivery address and relevant contact details are processed there to arrange and support your order.

Dianxiaomi processes order and delivery information through that linked hub to coordinate supplier fulfillment. Suppliers, fulfillment partners and carriers receive the details needed to prepare, ship and track parcels or resolve delivery issues. An order record does not mean a parcel has shipped; shipment updates depend on the actual fulfillment and carrier records.

We may use records to resolve returns, payment disputes, security incidents or legal obligations. A product question does not subscribe you to marketing. Follow a provider link only if you wish to use that external service.

Resend delivers order confirmations, shipment updates and requested secure order-access links for Poppy & Stone. It receives the destination email address and the content of each message, which can include order references, purchased items and totals, shipment status, carrier and tracking details, or a private access link. It also processes technical delivery records needed to send and troubleshoot those messages. These service emails do not subscribe you to marketing. Keep private order links to yourself.

Browser storage and measurement

The bag stores product references and quantities in your browser. Checkout and secure order access may retain references needed to recover a request or verify access. Clearing browser data can empty the bag or end an access session.

Optional product-interest analytics are disabled in this store configuration. Any separately enabled optional measurement requires the displayed privacy choice. Declining optional measurement does not prevent necessary shopping or security features.

Retention, access and requests

We keep information for as long as needed to fulfill and support orders, resolve returns or disputes, protect the service and meet applicable recordkeeping duties.

Depending on applicable law, you may request access, correction, deletion or a copy of information, or object to a use. Contact customer care with the nature of your request. We may need proportionate verification and may retain records required for an unresolved dispute or legal duty.

Clearing your browser does not remove a message already sent or a provider record. Information may be processed outside your location. The service and relevant provider notice describe its processing.

Security and changes

HTTPS and access controls support the website and order tools, but no service can promise perfect security. Keep private order links to yourself. Adults should make purchases; do not submit children’s personal details.

The effective date identifies this notice. We will update it when the operator, active services or data uses change. Any consent needed for a new optional use must be obtained separately.

Contact

Nya Labs LLC

2010 O Street NW, Washington, DC 20036, United States

support@poppyandstone.com

Monday to Friday, 8:00 a.m. to 5:00 p.m. Eastern Time (America/New_York). We usually reply within one business day.

Order cutoff: 3:00 p.m. Eastern Time, Monday through Friday (America/New_York).

Explore the collection

Optional product interest measurement

With your permission, we count product views and successful additions to the bag by product and UTC date. These are action counts, not unique shoppers or conversion rates. Each event contains only a product ID, event type and a random event ID used to prevent duplicates; it contains no customer name, email, address or payment details. Cloudflare stores the aggregate totals and temporary event IDs. Temporary IDs expire from duplicate checking after 24 hours and are removed in bounded cleanup batches when new events arrive; aggregate totals remain until deleted. No analytics cookie or persistent visitor ID is used for this counter. Optional measurement stays off until you accept, and Global Privacy Control or Do Not Track keeps it off. You can withdraw permission on the Cookie & privacy choices page. Your choice is stored in this browser with its version and timestamp and expires after 180 days. Necessary bag and checkout storage works independently. Any separately configured Google Analytics or advertising measurement uses its own disclosed settings.

Server purchase measurement

With Analytics permission, we save Google client and session identifiers in a first-party cookie for up to 24 hours and attach them to your checkout. Our server uses this link to report confirmed purchases, order references, items and amounts to Google Analytics, even if you close the confirmation page. We schedule these server-side identifiers for removal after 30 days. Advertising use follows your separate advertising choice. Names, email addresses, delivery addresses and payment-card data are excluded from these events. You can withdraw permission on the privacy choices page.

Google measurement before a choice

Before you choose, configured Google tags may send shopping measurements without analytics or advertising cookies. Before a fresh browser makes a choice, advertising click parameters may pass between pages on this site without optional cookies. Google receives public page details, store, product and order references, prices, and browser and network information. Customer names, email addresses, delivery addresses and payment details are excluded from these events. For cookieless Google measurement before a choice, temporary Google client and session references can be attached to an unpaid checkout without saving these identifiers in a browser cookie. Our server uses this reference to report a confirmed purchase if the confirmation page closes. The server-side identifiers are removed after 30 days. Saved measurement refusals, Global Privacy Control and Do Not Track keep this reporting off. Analytics and advertising cookies require their respective approval.

Cookie-free purchase reporting

Reject optional on the cookie banner turns off optional cookies and keeps cookie-free purchase reporting on. You can also select Allow cookie-free purchase reporting in Cookie & privacy choices. Google Ads receives a confirmed purchase amount and order reference without analytics or advertising cookies. This separate choice allows purchase measurement using the order reference, amount and IP address; it does not allow analytics or advertising cookies or personalized advertising. Google also receives browser and network information. Names, email, delivery addresses and payment details are excluded. You can turn off all optional measurement instead. Existing full refusals, Global Privacy Control and Do Not Track remain in effect.

Cookie & privacy choices