Draft for legal review — not yet in effect. Bracketed items are filled in before launch.
The short version: we collect what we need to sell students’ artwork for their organizations. The public sees a Creator’s first name and last initial, never more. We don’t sell data, don’t advertise to anyone, and verify a parent before listing anything by a child under 13. You can delete your account, and parents can withdraw consent and delete their child’s information, at any time.
Craft a Cause is operated by WinWish LLC (“we”, “us”), [MAILING ADDRESS], email hello@craftacause.com. This policy covers the Craft a Cause website, workspace and related emails in the United States. WinWish LLC runs other businesses; personal information collected through Craft a Cause is used only for Craft a Cause and is not shared with or used by those other businesses.
| Who | What | Where it comes from |
|---|---|---|
| Buyers | Name, email, password (held by our sign-in provider, never by us), optional two-factor phone number, order history (including whether you chose to cover card processing, and how each artwork reaches you), and a phone number — plus a shipping address when an artwork is posted rather than collected or sent digitally. | You, when you sign up and check out. Card details go directly to Stripe; we never see or store them. |
| Organization staff | Name, institutional email, role, organization name, type, state, logo, photos and description, and payout details collected by Stripe. | You, and Stripe for identity and bank verification. |
| Creators | First name, last initial, grade or class, birth year (not full date of birth), and photos of their artwork. For Creators 18+, an email address to send their upload link. | The Organization and, for Creators under 18, their parent or guardian. We do not collect information directly from children. |
| Parents and guardians | Email address, name and relationship to the child when consenting, the consent given and how it was verified, and either your electronic signature record (date, time, IP address, browser) or, if you choose the paper form, the form you upload. | The Organization (your email) and you. |
| Everyone | Technical data such as IP address, browser type and timestamps, used for security, fraud prevention and to record that you accepted our terms. | Your browser, automatically. |
| Visitors who allow analytics | Pages viewed and when, the site you came from, browser, device type, screen size and approximate location (city or region), tied to a random ID. Not your name, email, account, what you type or what you click. | Your browser, through PostHog, only after you choose “Allow analytics”. |
| Anyone using “Contact us” | Your name, email address, what your message is about, and the message. We email you a code first to confirm the address is yours. | You, through the contact form. We use it only to answer you. |
Artwork photos are re-encoded when uploaded, which removes location and camera data (EXIF). We do not collect government ID numbers, precise location, biometric data or payment card numbers.
On a public listing we show the artwork, its photos, price, the Organization and campaign, and the Creator’s first name and last initial (and, where the Organization chooses, grade or class). We never show a Creator’s full name, birth year, school address, contact details or guardian’s details. A buyer’s name and address are visible only to the Organization fulfilling their order.
Many Creators are children. Children do not use the Service directly: a Creator under 18 never has an account, and everything about them is provided by their Organization and their parent or guardian. Still, because we know that some Creators are under 13, we follow the Children’s Online Privacy Protection Act for their information.
Analytics never runs on the pages parents, guardians and Creators use (uploading artwork, giving or withdrawing consent), and we do not use analytics to learn anything about a child.
Notice to parents. Before anything about a child under 13 is listed, we email the parent or guardian a notice describing what we collect, how it is shown, and their choices, with a link to this policy.
Verified consent. We list a child’s artwork only after a parent or guardian gives consent and we verify they are the parent or guardian, using one of two methods they choose:
What we do with a child’s information. We use it only to list and sell the artwork for the campaign and to keep records of completed sales. We do not use it for advertising, build profiles, sell it, or share it with third parties except service providers that help us run the Service (listed below). Any other sharing would require a separate, optional consent that is not a condition of taking part.
Parents’ rights. A parent or guardian can, at any time and free of charge, review the information we hold about their child, withdraw consent, stop further collection, and have the information deleted, using the “Manage consent and data” link in our emails or by emailing hello@craftacause.com. We verify the request comes from the parent before acting.
We do not use any student’s information for targeted advertising, do not build profiles of students, and do not sell or rent student information. We collect only what is needed to list and sell artwork for a campaign. We do not ask schools for education records or class rosters; if a school ever shares education records with us, we will use them only as the school directs and as the Family Educational Rights and Privacy Act allows, and delete them at the school’s request. We follow these practices consistent with state student-privacy laws such as California’s SOPIPA and Texas Education Code chapter 32.
| Information | Kept for |
|---|---|
| Account details (buyers, Organization staff) | Until you delete your account, then removed or anonymized within 30 days. |
| Orders and payments | 7 years after the sale, for tax and accounting. When you delete your account, the street address, city and phone on finished orders are removed; the state, ZIP code and country stay for sales-tax records. |
| Unsold artwork photos and Creator details | Until consent is withdrawn, the data is deleted on request, or 24 months after the campaign ends, whichever is first. |
| Parental consent records and signed forms | While the child’s artwork is listed and 3 years after, to show consent was given; then deleted. |
| Analytics data (PostHog, only if you allowed it) | 12 months, then deleted. Switching analytics off deletes the analytics cookie on your device straight away. |
| Contact us messages | Deleted after 24 hours if the email was never confirmed; otherwise 90 days after we receive it. Our reply stays in our email inbox like any other correspondence. |
| Security logs and sign-in records | Up to 3 months, longer only to investigate an incident. |
| Backups | Overwritten within 14 days. |
We keep children’s information only as long as reasonably necessary for the purpose it was collected for, and delete it securely after.
We maintain a written information security program. Data is encrypted in transit and at rest; sign-in tokens live in secure, http-only cookies; passwords are held by our sign-in provider; two-factor authentication is available for accounts and required for our staff; access to personal information is limited to people who need it. No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.
We respond within 45 days and will not discriminate against you for using these rights. We verify requests by matching them to the email on file. California residents: we do not share personal information with third parties for their own direct marketing (“Shine the Light”).
We send service emails you cannot opt out of while you use the Service (receipts, sign-in codes, shipping, consent and payout notices). Any marketing email will include an unsubscribe link, which we honor within 10 business days. We never send marketing to a Creator or to a parent’s or guardian’s email address collected for consent.
We will post any change here with a new effective date. For a material change we will email you before it takes effect, and we will ask parents for new consent before using a child’s information in a materially different way.
Questions, requests or complaints: hello@craftacause.com, or WinWish LLC, [MAILING ADDRESS]. This policy is available in other formats on request — see our accessibility statement.