Privacy policy

This policy explains what personal data Frosty Flamingo Software, LLC (“Frosty Flamingo Apparel,” “we,” “us”) collects when you shop with us, why we collect it, who we share it with, how long we keep it, and the choices you have. It covers this website and the orders placed through it.

Who we are

Frosty Flamingo Software, LLC, 2136 Trailblazer Way, Castle Rock, CO 80109. We are the controller of the personal data described here. For any privacy question or request, contact [email protected].

What we collect

We collect only what an order actually requires:

• Order and contact data — your email address, shipping address, the items and quantities you ordered, order totals, and a phone number if you provide one for delivery purposes.
• Payment data — handled entirely by our payment processor. We receive a confirmation, the last four digits and card brand, and the amount. We never receive or store your full card number, and it never touches our servers.
• Account data (only if you create an account) — your sign-in identity, verified email addresses, saved addresses, and a display name if you set one. You can check out as a guest without creating an account.
• Support data — messages you send us about an order, and our replies.
• Consent records — if and when you agreed to our terms, privacy policy, and return policy, and whether you opted in to marketing email, along with which version of each policy was in effect at that moment.
• Technical data — a cart session cookie, and standard server logs (IP address, timestamps, error diagnostics) used to operate and secure the site.

Cookies and tracking

We do not use advertising cookies. Optional Google Analytics runs only with your permission. We also use Ahrefs Web Analytics on public shopping and editorial pages of our production website. We set a strictly necessary cookie, ffa_cart, which holds a random token so your cart persists between pages. It is HttpOnly, SameSite=Lax, and expires after 30 days. The token reveals nothing about you or your cart’s contents on its own. If you sign in, our identity provider sets its own session cookie for the same strictly necessary purpose.

If you accept optional analytics, Google Analytics receives public page paths, product identifiers, selected options, quantities, prices, browser/device information, approximate location, and verified purchase and refund amounts under a pseudonymous identifier. We do not send your name, email, shipping address, payment details, or secure order-access link. Account, order, checkout and private-preview pages do not load Google Analytics, nor does staging. Tracked URLs omit query strings and fragments. Advertising features and Google signals are disabled.

Your analytics choice is stored in this browser for up to 180 days. Accepting sets a first-party ffa_analytics consent cookie and permits Google’s analytics cookies (normally _ga and _ga_-prefixed cookies), also configured for at most 180 days. Use “Analytics choices” to reject or withdraw at any time. Withdrawal stops future collection from this browser and suppresses unsent server events linked to that consent; it does not recall events already sent. Shopping, payment and order emails work without analytics. Choices apply to this browser, not automatically to your other devices. The analytics notice is separate from marketing email consent and your recorded order-processing policy. Google’s processing is described in its privacy policy.

Ahrefs helps us understand aggregate public-site traffic and interactions. It receives public page paths, referrers, clicked link and form-action URLs, and browser, language, screen and approximate location information. Pageview URLs omit query strings and fragments. Account, order, cart, checkout, private preview and staging pages do not run this tracker. We do not add customer details, order details or form-field values to analytics.

Ahrefs states that its analytics uses no cookies, discards raw IP addresses, and does not track visitors across days. See Ahrefs’ data collection notice for its processing and daily visitor-count method. Browser content blockers may block analytics without preventing shopping. This dated public-browsing notice is separate from the order-processing policy version recorded on orders; existing order records and consent settings are unchanged.

How we use it

We use personal data to:

• take, price, and confirm your order, and calculate applicable tax;
• send your order to the fulfillment partner who makes and ships it;
• send you transactional email — order confirmation, production and shipping updates, refund notices;
• handle returns, replacements, refunds, and support requests;
• detect and prevent fraud and abuse, and keep the site secure and working;
• meet our tax, accounting, and legal record-keeping obligations;
• send marketing email only if you explicitly opted in.

We do not sell your data

We do not sell personal data, we do not share it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects. We do not conduct targeted advertising at all.

Who we share it with

We share the minimum necessary with service providers who process data on our behalf under contract, and who are not permitted to use it for their own purposes:

• Stripe — payment processing and tax calculation.
• Printful and Printify — our made-to-order fulfillment partners. They receive the items ordered and your shipping address, so they can produce and ship your order.
• Clerk — customer account sign-in, if you create an account.
• Resend — delivery of transactional email.
• Cloudflare — DNS, site delivery, and file storage.
• Render — application and database hosting.

Separately, Ahrefs provides the public-site analytics described above. Its collection notice also describes how it uses aggregated analytics to improve its services. We do not send it order or payment records.

We may also disclose data where legally required — valid legal process, or to establish or defend legal claims — and to a successor entity if the business is sold, in which case this policy governs until you are notified of a replacement.

How long we keep it

• Abandoned carts and expired checkouts — deleted 30 days after they expire.
• Order access links — deleted 30 days after they expire, unless the order has an open dispute, refund, or support case.
• Order, payment, and refund records — kept for seven years to satisfy tax and accounting requirements. These are financial records and are not deleted on request.
• Consent records — kept as proof of what you agreed to and when.
• Account convenience data (saved addresses, email associations) — deleted when you close your account.

Your rights

Depending on where you live — including under the Colorado Privacy Act — you may have the right to confirm whether we process your data, access a copy of it, correct it, delete it, obtain it in a portable format, and opt out of sale or targeted advertising (we do neither). We extend these rights to all our customers regardless of state.

To make a request: email [email protected], or use the account page if you have an account. We will verify your identity before acting — usually by confirming control of the email address on the order. We respond within 45 days and may extend once by another 45 days where reasonably necessary, telling you why.

What deletion actually does. We remove your profile and convenience data — saved addresses, email associations, and the link between your account and past orders. We keep the underlying order, payment, and refund records, including the email address captured on the order itself, because those are financial records we are required to retain. We will always tell you plainly what was removed and what was kept.

If we decline a request, we will tell you why and how to appeal. To appeal, reply to our decision or email the same address with “Privacy appeal” in the subject line; we will respond within 45 days. Colorado residents who are unsatisfied with the outcome may contact the Colorado Attorney General.

Children

This store is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

Security

We use encryption in transit, store only hashed session and access tokens, restrict administrative access, and log administrative actions. No system is perfectly secure, but we do not store card numbers, which removes the most sensitive category of data from our systems entirely.

Where your data is processed

We currently sell and ship only within the contiguous United States. The providers listed above process information through their own systems; consult their privacy information for processing locations, including Ahrefs’ separate public-site analytics processing.

Changes to this policy

When we change this policy we update the version label at the top. Every order permanently records the policy version in effect when you placed it, so the terms you agreed to remain answerable from your order record — not from whatever this page says later. See your order status page for the versions attached to a specific order.