Privacy policy

WFC, at 115 S Willow St, Soldotna, AK 99611, USA, registered under EIN 32-3456789, is the controller of the personal data collected on this site.

We are a United States company. Because we sell to people in the European Union, the United Kingdom and Switzerland, the GDPR, the UK GDPR and the Swiss FADP apply to what we do with your data, and this page is written to them.

Write to every@withmycompanion.life for anything on this page. A person answers within one business day — there is no form to fill in and no ticket number.

When you order: your name, e-mail address, delivery address, phone number if you give one, and the contents and value of your order. We never see your card number — it is entered on PayPal's own systems and never reaches ours.

When you create an account: the above, plus a password that is stored only as a cryptographic hash, and the personalisation names you ask us to engrave.

When you sign in with Google: your name, e-mail address and Google account identifier. Nothing else from your Google account.

In your browser: your basket, your wishlist and your language, kept in local storage on your device. These never reach our servers until you order.

Automatically: page views and performance timings, collected without cookies and without any identifier that can single you out.

To perform the contract you entered into when ordering: name, address, order contents. Without them there is no parcel.

To meet legal obligations: invoices and accounting records, which tax law requires us to keep.

On our legitimate interest in a working shop: fraud prevention, and audience measurement that does not identify you.

On your consent, which you may withdraw at any time: the Meta advertising pixel described under Cookies below, and nothing else — we still run no marketing e-mails.

PayPal (USA) — takes the payment. It receives your name, e-mail and the amount. PayPal is a controller in its own right for what it does with that.

Meta (USA/Ireland) — only if you accepted the cookie banner. Receives which page you viewed and the value of what you bought, never your name, e-mail or address. Meta is a controller in its own right for what it does with that.

CJ Dropshipping (China) — packs and posts your order. It receives your name, delivery address, phone number and what you bought. Nothing else.

Supabase (USA, Amazon eu/us regions) — stores your account, orders and group buys.

Resend (USA) — sends the receipt and the tracking e-mail.

Vercel (USA) — hosts the site and measures page performance.

We never sell your data, and we never rent it.

We are established in the United States, so ordering from Europe means your data reaches a country outside the European Economic Area from the moment you type it. Our processors sit in the United States and China, and the transfers to them rest on the European Commission's standard contractual clauses signed with each one.

This is not a formality: your delivery address genuinely travels to a warehouse in China, because that is where the parcel is packed. If that is not acceptable to you, please do not order.

Orders and invoices: seven years, as US federal and state record-keeping rules require.

Account and address book: until you delete your account, then thirty days in backups.

Group buys: twelve months after the group closes.

Browser storage: until you clear it, or two years, whichever comes first.

If you are in the EU, the UK or Switzerland: you may ask us for a copy of everything we hold, correct anything wrong, have it erased, restrict what we do with it, receive it in a portable format, or object to processing based on legitimate interest.

If you are in the United States: several states now give residents the right to know what is held, to have it deleted, and to opt out of its sale. We do not sell data to anyone, and we honour access and deletion requests from every US customer regardless of which state they live in — it is simpler than checking, and fairer.

Write to every@withmycompanion.life and say what you want. We reply within one month. We may ask you to confirm who you are, but only if there is real doubt.

If our answer does not satisfy you, you can complain to the data protection authority where you live: your national supervisory authority in the EU, the Information Commissioner's Office in the United Kingdom, or the Federal Data Protection and Information Commissioner in Switzerland.

Signing in stores a session cookie. It is strictly necessary — without it you would be signed out on every page — and it disappears when you sign out.

If enabled, a Meta (Facebook/Instagram) advertising pixel measures which ads led to a sale and lets us show ours to people who resemble past customers. It is off for every visitor by default: the banner shown on your first visit is where you say yes or no, and you can change your answer at any time from “Cookie preferences” in the footer. Declining, or never answering, means the pixel never loads and no such cookie is ever set.

Traffic runs over HTTPS. Passwords are hashed. Access to the database is restricted row by row, so one customer's session cannot read another customer's orders.

If a breach ever puts you at risk, we will tell you and the relevant supervisory authority within 72 hours of finding out.