Privacy Policy

Last updated: September 12, 2026

HARLOWMCFLYMADE is operated by Julian Tinner, Chressbrunnen, 9200 Gossau, Switzerland (“we,” “us,” or “our”).

We operate this online store and its related products, content, features, and services (the “Services”). Our store is powered by Shopify.

This Privacy Policy explains how we collect, use, and disclose personal information when you visit our store, make a purchase, or communicate with us. If our Terms of Service conflict with this Privacy Policy regarding the processing of personal information, this Privacy Policy takes precedence.

This policy provides information about our practices. Using the Services does not, by itself, constitute consent to processing for which separate consent is required.

1. Personal Information We Process

Depending on how you interact with the Services, we process the following categories of information:

Contact and delivery information: your name, email address, telephone number, billing address, shipping address, and recipient details.
Payment and transaction information: payment details processed through our payment providers, transaction references, payment status, refunds, and information relating to payment disputes.
Account information: login details, preferences, and settings associated with an account you create or use.
Shopping information: products viewed, added to your cart, purchased, returned, exchanged, or cancelled, and your order history.
Customer communications: messages, support requests, and photographs or other information you provide when reporting an issue.
Device information: IP address, browser, device and network information, and identifiers used by the store infrastructure.
Usage information: information about how and when you navigate and interact with the Services.

Payment credentials are processed through the relevant payment services. The payment information available to us as the merchant depends on the payment method and provider; processing payment data does not mean that we personally receive every payment credential you enter.

Please do not send complete payment-card details, passwords, or unnecessary sensitive information by email.

2. Sources of Information

We obtain personal information:

Directly from you when you place an order, use an account, or contact us;
Automatically through the Services, including cookies and similar technologies;
From Shopify and payment providers in connection with store activity and transactions; and
From production, fulfillment, and delivery providers in connection with your order.

3. How We Use Information

We use personal information to operate the store and manage our relationship with you, including to:

Process payments and fulfill orders;
Arrange production, shipping, replacements, and refunds;
Maintain accounts and remember relevant shopping preferences;
Provide customer service and send order-related communications;
Understand and improve store functionality;
Detect and investigate fraud, unauthorized transactions, and security incidents;
Maintain required business and accounting records;
Comply with applicable law and lawful requests; and
Establish, exercise, or defend legal claims.

We need certain information, such as payment and delivery details, to complete your purchase.

4. Our Direct-Marketing Practices

HARLOWMCFLYMADE does not use customer contact details for its own promotional email, SMS, or postal-mail campaigns.

We use those details for order administration, customer service, and other necessary communications, such as delivery updates or important product information.

Our decision not to conduct direct-marketing campaigns does not mean that Shopify or other services you interact with perform no personalization or advertising-related processing. Their relevant roles and your choices are described below.

5. Shopify and Platform Processing

Shopify hosts the Services and processes information about transactions and use of the store.

Shopify processes information on our behalf when providing core store services. It also acts independently for certain consumer services and enhanced platform services.

Its published practices include security, service improvement, personalization, and advertising-related processing, depending on the services involved and applicable privacy choices. This can involve activity across different merchants and interactions with advertising or analytics partners.

If you use Shop, Shop Pay, or other Shopify consumer services, their separate privacy terms also apply.

Learn more or exercise rights concerning Shopify’s independent processing through:

You may contact us about information Shopify processes on our behalf.

6. Stripe and Payments

Stripe processes payment-related information in connection with purchases, refunds, authentication, and payment disputes.

Stripe also processes relevant information for fraud prevention, security, service improvement, and legal or regulatory obligations. Depending on the activity, Stripe acts as a processor or as an independently responsible controller.

Payment processing involves exchanges with banks, payment networks, and other necessary financial-service participants.

If you choose an additional Stripe consumer service, such as Link where offered, its separate terms and privacy information apply.

Stripe may retain certain records after a transaction to satisfy financial, legal, and fraud-prevention requirements.

Further information and privacy-request options are available in Stripe’s Privacy Policy.

7. Printful and Shipping

We use Printful for product production and order fulfillment.

We provide the information necessary to fulfill your order, including ordered products, the recipient’s name and shipping address, and relevant delivery contact details.

Printful and delivery providers process this information to produce, dispatch, track, and deliver your order. We receive information such as shipment status and tracking details to support order administration and customer service.

You can contact HARLOWMCFLYMADE directly regarding your order information or a privacy request concerning processing on our behalf.

8. Other Disclosures

We disclose relevant information to providers supporting store operations, such as hosting, payment processing, customer communications, fulfillment, and delivery.

Information may also be disclosed where necessary to comply with law, respond to valid legal proceedings, obtain professional advice, prevent fraud, or protect legal rights.

In the event of an actual or proposed business transfer or restructuring, relevant information may be disclosed subject to applicable safeguards and legal requirements.

If you request an integration or direct us to share information with another service, we will process that request subject to applicable law.

We do not treat a provider’s separate privacy policy as a release from our own obligations.

9. Cookies and Privacy Choices

The Services use cookies and similar technologies to operate the shopping cart and checkout, maintain security, remember preferences, and support platform functionality.

Platform services can also use these technologies for analytics, personalization, and advertising-related purposes. Where consent is required, these purposes are subject to your consent choices.

You can manage available preferences through the store’s privacy controls. You may also block or delete cookies through your browser, although blocking essential cookies can affect store functionality.

Global Privacy Control and Do Not Track

Where required by applicable law, a recognized Global Privacy Control signal is treated as an opt-out of covered sale or sharing for the browser and device sending it. Where the signal can be associated with an account, the request is applied more broadly as required by law.

Legacy browser “Do Not Track” signals are distinct from Global Privacy Control and are not otherwise recognized by the Services.

Platform and advertising services may collect information about activities over time and across different websites. Shopify’s independent processing and choices are described in its Consumer Privacy Policy and Privacy Portal.

Requests concerning our processing can also be sent to info@harlowmcfly.com. Contacting us is not a substitute for an automated opt-out mechanism where one is legally required.

10. California and Other US Residents

Depending on where you live and whether the applicable privacy law covers our business, you may have rights to:

Know about or access personal information collected about you;
Obtain information about its sources, purposes, and recipients;
Request correction or deletion;
Receive a portable copy;
Opt out of a legally defined sale, sharing for cross-context behavioral advertising, or other covered targeted advertising;
Limit certain uses of sensitive personal information; and
Appeal a decision about a privacy request where applicable.

“Sale” and “sharing” have specific legal meanings. Certain advertising-related disclosures can fall within these definitions even when no money is exchanged. Our statement about not conducting our own direct-marketing campaigns does not override these definitions.

Use the store’s privacy controls for available opt-outs or contact us using the details below.

We will not unlawfully discriminate against you for exercising your rights. Any applicable exceptions, verification requirements, and response deadlines will be applied in accordance with law.

Where permitted, you can appoint an authorized agent. We may request proof of authorization and proportionate identity verification where legally permitted. We do not require verification for opt-out requests where the law prohibits it.

11. Switzerland, the EEA, and the United Kingdom

Where applicable, you may have rights to access, correct, delete, obtain a portable copy of, object to, or restrict processing of your personal information.

Where processing relies on consent, you may withdraw it. Withdrawal does not affect processing lawfully undertaken before withdrawal.

Where the GDPR or UK GDPR applies, the legal bases for our processing include:

Contractual necessity: processing orders, payments, delivery, and related customer requests;
Legal obligations: maintaining required records and responding to binding legal requirements;
Legitimate interests: securing the Services, preventing fraud, improving essential operations, and managing legal claims, subject to the required balancing of interests; and
Consent: processing for which consent is required, including relevant non-essential tracking.

Our legitimate interests do not automatically override your rights.

You can contact us to exercise your rights or raise a complaint with the relevant supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner. EEA residents can find their authority through the European Data Protection Board.

12. International Processing

We operate from Switzerland and use international providers. Information can be processed outside your country of residence.

Shopify identifies international processing locations including Canada and Singapore. Stripe identifies international transfers including to the United States and India. Production and delivery also involve information processing in locations relevant to fulfillment and your destination.

Applicable provider contracts and transfer arrangements determine the safeguards for these transfers. Where required, these include recognized contractual safeguards, such as standard contractual clauses with relevant Swiss or UK adaptations, or applicable adequacy arrangements.

Information about Shopify’s arrangements is available in its Data Processing Addendum. Stripe describes its arrangements in its Privacy Policy.

Contact us for further information about destinations and safeguards relevant to your information, or to request an available copy of applicable safeguards subject to appropriate redactions.

13. Retention

We retain information for as long as necessary for its purpose, taking account of applicable legal obligations.

Order and accounting records are retained for required recordkeeping periods. Customer-service records are retained as needed to resolve requests and address related disputes. Account information is retained as needed to maintain the account, subject to deletion requests and legal exceptions.

Technical and security records are retained according to their operational purpose and any need to investigate incidents. Relevant records may need to be preserved longer for legal proceedings or other binding obligations.

Providers acting independently may have separate lawful retention requirements. Deleting an account or completing a purchase does not automatically require deletion of records that must be retained by law.

14. Security

We take reasonable measures appropriate to our processing to protect personal information. No online service or transmission method can guarantee absolute security.

Please protect your account credentials and avoid sending sensitive information through unsuitable channels.

This section does not exclude any obligation to maintain appropriate security or provide legally required notifications following a data breach.

15. Children

The Services are intended for a general audience and are not directed to children under 13.

If you believe a child has provided information in circumstances requiring parental consent, please contact us so that we can investigate and take appropriate action.

We do not knowingly sell or share personal information of individuals under 16 without authorization required by applicable law.

16. Requests and Complaints

You can exercise applicable rights by contacting info@harlowmcfly.com or using the contact details below.

We may request information reasonably necessary to identify the records concerned, verify your identity where permitted, and protect against unauthorized disclosure.

We will respond within applicable legal deadlines. If a request cannot be fulfilled, we will explain the relevant reason and any available appeal procedure.

You can raise a complaint with us, appeal where applicable, or contact the competent regulator. These options do not limit other rights provided by law.

17. External Websites

The Services may link to independently operated websites. Their operators are responsible for their own processing, and you should review their privacy information before submitting information.

A link does not itself imply endorsement. This section does not remove our responsibilities for disclosures or integrations under our control.

18. Changes to This Policy

We may update this policy to reflect changes in our practices, services, or legal requirements.

We will update the “Last updated” date and provide an appropriate prominent notice of material changes, including direct notification where required by law.

If a new use requires consent, a policy update alone will not replace obtaining that consent.