Privacy Policy

1. Who we are

This site is operated by Stew’s Brews & Chews, a small-batch coffee roastery and pound cake bakery based in Goose Creek, South Carolina. When this policy says “we,” “us,” or “Stew’s,” it means us. When it says “you,” it means anyone who visits the site, places an order, subscribes to email, or otherwise interacts with us online.

For privacy questions or requests, email sbandc@proton.me. We answer within a business day.

2. What we collect

2.1 When you place an order

Our online store is powered by Shopify. When you check out, Shopify collects: your name, email address, billing and shipping addresses, phone number (optional), payment card details, and order history. Shopify handles the payment side, we never see your full card number. Card information is processed by Shopify Payments and the card networks under their respective security standards.

We do see and store: your name, your shipping address (so we can ship the order), your email (so we can confirm it), what you ordered, and the order total. We retain this information for as long as required by tax and accounting law, which in South Carolina is typically seven years.

2.2 When you sign up for email

Our email list is managed by Kit (formerly ConvertKit). When you opt in, whether through the newsletter signup, the Slow-Brew Plan landing page, or any other form on the site, Kit collects and stores your first name (if you provided it), email address, the form you signed up through, and your subscription preferences. Kit also records open and click activity on the emails we send you, which we use to gauge what’s working.

You can unsubscribe at any time by clicking the unsubscribe link at the bottom of any email. When you unsubscribe, we stop sending you email and Kit marks you inactive. If you want your record fully deleted rather than just deactivated, email us and we’ll do it.

2.3 When you fill out the contact form

The contact form on our Contact page captures your name, email, the subject you selected, and your message. We use this only to reply to your inquiry. We do not add contact-form submissions to our email list unless you explicitly check the opt-in box.

2.4 When you just browse the site

Like nearly every website, ours collects a small amount of technical information automatically: your IP address, browser type, the pages you visit, the page that referred you to us, and the time of your visit. This is used to detect abuse, fix bugs, and understand which content people find useful. We do not link this information to your identity unless you’ve placed an order or subscribed.

If we run Google Analytics or a comparable tool, it operates under its own privacy policy (see the third-parties section below).

3. How we use what we collect

In every case, we use your data for the reason we collected it, and no other reason. Specifically:

• Orders: to process your purchase, ship your order, send you tracking information, and respond if there’s a problem.
• Email subscriptions: to send you the content you opted in for, the Slow-Brew Plan PDF, our weekly newsletter, or any other list you signed up to receive.
• Contact form submissions: to reply to your message.
• Technical data: to operate the site, fix bugs, and stop fraud.
• Aggregate analysis: we may look at totals (how many orders this week, which products were viewed) but in aggregate form, never tied to an individual.

4. Who we share it with

We do not sell your personal information. We do not rent it. We do not trade it.

We do share specific data with a small number of service providers whose tools we rely on to run the business. Each one has its own privacy policy, we link to all of them at the end of this section.

• Shopify, processes orders, payments, and stores customer accounts. Shopify privacy policy.
• Kit (formerly ConvertKit), manages our email list and sends newsletters. Kit privacy policy.
• USPS, delivers your orders. We share your shipping address with USPS so they can deliver the package. USPS privacy policy.
• Google, we embed Google Maps on our Contact page and may use Google Fonts and Google Analytics. Google privacy policy.
• Our web host, the company hosting this WordPress site stores all data we have. They have access to our database but do not access individual customer records.

We may also disclose information if we are legally required to do so, for example, in response to a valid subpoena or court order, or in connection with a tax audit. If this happens, we’ll tell you about it unless we are legally prohibited from doing so.

If Stew’s Brews is ever sold or merged into another business, customer data may transfer to the new owner. Any new owner would be bound by this privacy policy (or one that gives you equivalent rights) at the time of transfer.

5. Cookies

A cookie is a small text file a website stores on your device to remember things about you between page loads. We use cookies for three purposes:

• Essential cookies: remember what’s in your shopping cart, keep you logged in if you have an account, and let secure pages work. The site cannot function without these.
• Analytics cookies: help us see which pages people visit and how the site performs. These are anonymous unless you’ve already given us identifying information.
• Email tracking pixels: our email tool (Kit) embeds a small invisible image in each newsletter that loads when you open the email, so we can see open and click rates. You can disable image loading in your email client to opt out.

You can clear cookies in your browser at any time. Most modern browsers also let you set per-site preferences or block third-party cookies entirely. If you block essential cookies, parts of the site (like checkout) may not work.

6. Your rights

Depending on where you live, you may have specific legal rights about your personal data. We try to honor these for everyone, regardless of jurisdiction. You may ask us to:

• Tell you what we have, we will send you a copy of the personal data we hold about you.
• Correct what we have, if any of it is wrong, we’ll fix it.
• Delete what we have, we’ll delete your data, with the exception of records we are legally required to keep (typically: tax records of completed orders).
• Stop sending you marketing email, click unsubscribe in any email or email us.
• Object to specific uses, if there’s a use of your data you object to, tell us and we’ll discuss.
• Receive a portable copy, we’ll provide your data in a machine-readable format if you want to move it elsewhere.

To exercise any of these rights, email sbandc@proton.me with the request. We may ask you to verify your identity before processing, that’s to protect you from someone else trying to access your data. We respond within 30 days at the latest, and usually within a few business days.

6.1 California residents

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have additional specific rights, including the right to know the categories of personal information collected, the right to request deletion, and the right to opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under California law. To exercise any CCPA rights, use the contact information above.

6.2 EU/UK residents

If you are in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) and equivalent UK regulations grant you the rights listed above. Our legal basis for processing your data is: (a) performance of a contract when you place an order, (b) your consent when you subscribe to email, and (c) our legitimate interest in operating the site and detecting abuse for technical data. You have the right to lodge a complaint with your local data protection authority if you believe we’ve mishandled your data.

7. Children’s privacy

This site is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe we have collected information from your child, contact us at sbandc@proton.me and we will delete it.

8. How long we keep your data

• Order records: seven years (for tax and accounting compliance).
• Email subscribers: until you unsubscribe or ask us to delete you.
• Contact form submissions: 12 months after our last reply, then deleted.
• Server logs and technical data: 90 days.
• Analytics data: as defined by the analytics provider (Google Analytics default is 14 months).

9. How we keep your data safe

The site uses HTTPS encryption for all pages. Payment data is handled exclusively by Shopify under PCI DSS standards. Email is stored by Kit on encrypted servers. Account passwords (if applicable) are stored as one-way hashes, not in clear text.

No system is perfectly secure. If a data breach affects your personal information, we will notify you as soon as practical and as required by law.

10. Changes to this policy

If we update this policy meaningfully, we’ll change the “last updated” date at the top of the page and, for substantive changes, post a notice on the homepage or send subscribers an email. Continued use of the site after a change means you accept the updated policy. If you don’t accept it, stop using the site and email us to delete your data.

11. Contact

For anything privacy-related, questions, requests, complaints, or just to point out a typo, email sbandc@proton.me. You can also write to us at the address listed on the Contact page.