Privacy Policy

1. Who we are

The Collective at Red Iron LLC, San Diego, California. Text or call (619) 403-8753, or email adam@redironcollective.com.

2. There is no contact form

We do not run a contact form. There is nothing on this site to fill in to reach us, no intake questionnaire, and no chat bot.

You reach us by texting, calling or emailing, and when you do, we hold whatever you chose to send: your phone number or email address, and the contents of your message. We keep it because it is a conversation with a customer, in the same way any business keeps its correspondence. We do not sell it, rent it, or feed it to an advertising network.

3. Analytics

We use Plausible Analytics. It is privacy focused by design: no cookies, no personal data, and no cross site or cross device tracking. It does not fingerprint you, and it cannot identify you.

What we see is aggregate: how many people visited a page, roughly where in the world they came from, and which site sent them. We use it to find out which pages are worth writing and which are broken. There is no advertising pixel on this site.

4. Payments

Payments run through Stripe, which acts as our payment processor.

When you buy a website, you enter your card details on Stripe, not on our site. We never see or store your full card number. We see what Stripe reports back to us: that a payment succeeded, the amount, and enough of a reference to know which order it belongs to.

For league storefronts, Stripe is also how payouts are made. A league connects its own Stripe account, and that connection is between the league and Stripe.

Stripe's own privacy policy governs what Stripe does with your data.

5. If you buy from a storefront we run

When you order from a store we operate, we are the merchant of record and we handle the order end to end. To do that we hold what an order requires: your name, your email address, your shipping address, what you ordered, the variant and size, the price, and the order's status.

We use it to make the thing, ship it to you, answer you if you write in, and handle returns, exchanges and refunds. We also keep what our tax and accounting obligations require us to keep, since we file the sales tax on that order.

Your shipping address goes to the carrier, because otherwise the parcel does not move.

We keep order records for 7 years from the date of the order, which is the window our tax and accounting obligations run to, and then we delete them. If you ask us to delete an order sooner, we will do it as soon as we are no longer required to hold it, and we will tell you when that is.

6. The Ledger email list

If you enter your email address in the footer to sign up for the Ledger, we store that address with Resend, which hosts our mailing list.

Nothing is sent to you on signup. No welcome email, no confirmation link. Signup is capture only, deliberately, until the first Ledger dispatch actually exists. When we do start sending, every message will carry an unsubscribe link, and you can ask us to remove your address at any time by texting or emailing.

We do not use that address for anything except the Ledger.

7. Abuse prevention

The newsletter signup is rate limited by IP address, to stop a script from hammering it. The address is used in memory to count requests in a short window and is not stored in a database or used to identify you.

Our host, Vercel, and our DNS provider, Cloudflare, process requests to this site and keep their own operational logs, which normally include IP addresses. That is ordinary web hosting rather than anything we do with your data.

8. Who else touches your data

The complete list of processors:

Inngest and Anthropic touch only the onboarding builder, which is where a booked client's own brief is turned into a store or a site. Nothing a shopper enters at a storefront checkout goes to either of them.

We do not sell your personal information to anyone, and we do not share it for advertising. If we add a processor, it is added to this table in the same pass.

9. Cookies

This site sets no advertising cookies and no tracking cookies. Plausible sets none at all.

There is one functional cookie, and it is a sign in session. If you sign in at login.collectivebuilt.com, as a client or as staff, a session cookie keeps you signed in. That is the whole of it.

Shopping a storefront sets no cookie. There is no shopper account to sign in to, and your cart is held in your own browser's local storage, on your device, until you check out. Clearing your browser clears it.

We do not show a cookie banner, because we set nothing that requires your consent: strictly functional sign in only, plus cookieless analytics. If that ever changes, the banner ships in the same pass as the cookie.

10. Children

Neither this site nor any storefront we run is directed at children under 13, and we do not knowingly collect personal information from anyone under 13.

Our storefronts sell youth sports spirit wear, so a child often wears what is ordered. The child is not the customer. Orders are placed by parents, coaches and league officers, and the checkout asks for the buyer's name, email address and shipping address and nothing else.

The order flow does not ask for a player's name, age, date of birth, jersey number or team roster, and we will not add a field that does. That is a standing rule for our checkouts rather than a description of the current form.

If you believe a child under 13 has given us personal information, text or email us and we will delete it.

11. Your choices, and California rights

You can ask us what we hold about you, ask for a copy of it, ask us to correct it, or ask us to delete it. Text or email and a person will answer. We will do it unless we are required to keep the record, for example an order we need for a tax filing, and we will tell you which it is and for how long.

California residents. The rights below come from the CCPA and CPRA, and we extend them to everyone, so you do not have to establish that you are a California resident to use them. You have the right to know what we collect and why, the right to a copy of it, the right to correct it, the right to have it deleted, and the right not to be treated any differently for asking. We do not charge for a request and we will not degrade your service because you made one.

We do not sell your personal information, and we do not share it for cross context behavioral advertising. There is nothing to opt out of, which is why this page carries no “Do Not Sell or Share My Personal Information” link. If that ever stops being true, the link goes here and this paragraph is rewritten before it does.

Send a request to (619) 403-8753 or adam@redironcollective.com. There is no form, and you may have an authorized agent make the request for you.

12. Changes

If we change how any of this works, we update this page. The date at the top is when it last changed. See also the terms of service.

13. Contact

The Collective at Red Iron LLC, San Diego, California. Text or call (619) 403-8753, or email adam@redironcollective.com.