Legal

privacy policy

Last updated September 22, 2026.

1. introduction

This Privacy Agreement (the "Agreement" or "Policy") is between Harvath Art LLC ("we," "us," or "our") and you. It outlines how we collect, use, and protect your information on harvath.art.

2. regulatory compliance

We comply with applicable data protection laws, including the GDPR, the UK GDPR, the California Privacy Rights Act (CPRA), the FTC Rules, and the CAN-SPAM Act. Communications Notice: we send marketing email only to people who have asked for it, and using the site is not by itself a request. Email needed to run your membership, such as a receipt or a notice that your card was declined, is sent because you hold a membership and is not marketing. You may unsubscribe from marketing at any time using the link in any such email.

3. information we collect

We collect what we need to send you letters and run your membership: your name, your email address, your shipping address, and a record of what you have paid for. If you link a Discord account we store its user id so we can grant you the right role. Our hosting and payment providers see the ordinary technical details of a web request, including your IP address, and keep them in their own server logs for security.

4. information we do not hold

We use secure third-party processors. We do not store full credit card numbers, bank account details, or government tax IDs on our servers. To the extent applicable under the GDPR, we operate as a "Data Controller" rather than a "Data Processor" regarding direct user data.

5. how we use your data

We use your data to deliver and customize our services, process transactions, send promotional emails (which you may opt out of), and conduct internal statistical analysis. We retain this data only as long as necessary to fulfill these purposes or comply with legal obligations.

6. security and third parties

We implement industry-standard electronic and managerial safeguards. However, we utilize third-party payment and email processors; your data handled by them is subject to their respective privacy policies. While we vet our partners, no internet transmission is 100% secure, and you share information at your own risk.

7. data sharing and assent

We will not sell, lease, or rent your personal information to third parties. We only share data if required by law, to enforce our incorporated Terms of Use, or with your consent. You are responsible for keeping your passwords secure.

8. cookies and tracking

We run no third-party analytics, no advertising pixels, and no cross-site tracking of any kind. We do keep our own anonymous page counts: for each page, how many times it was viewed, roughly how long it stayed on screen, and how often visitors moved on from it, along with the label of the ad link, if any, that brought the visit. These are running totals per page, never tied to you, your IP address, or your account, and they use your browser's own storage rather than cookies. If you arrive through one of our ad links and go on to create an account, that link's label is saved on your account so we can tell which ads work. A small number of cookies are set on this site, and every one of them is necessary for something you asked us to do: the cookie that keeps you signed in, a short-lived one that protects the Discord linking step, and, on the checkout pages only, two set by Stripe to detect card fraud. Nothing here builds an advertising profile of you, so there is nothing for a Global Privacy Control signal to switch off.

9. external links

Our site contains links to external websites. We do not control these external sites and are not responsible for their privacy practices or content.

10. managing your information (DSARs) and opting out

You can download a copy of everything we hold about you, and you can delete your account outright, from your data. Neither needs our permission and neither goes through a queue. Deletion is immediate and cannot be undone: it removes your account, your profile and your address, cancels any membership, and takes your email off our mailing lists. To correct something instead, or to ask anything else about your data, email us with “Privacy Request” in the subject, and we will answer within one month. You may unsubscribe from marketing emails at any time without affecting a paid membership.

11. what we keep after you delete

Payments you have already made stay on record with our payment processor, because the law requires a business to keep its transaction records. Once your account is deleted those records no longer carry your name, your email or your address. We also keep a dated note that the deletion happened, holding nothing but an internal account id, so we can show the request was honoured.

12. who is responsible, and how to complain

Harvath Art LLC is the data controller for the information described here, and you can reach us through our contact page. We handle your data on the basis of the contract between us for anything needed to run your membership, on your consent for marketing email, and on legal obligation for our financial records. If you are in the United Kingdom, the European Economic Area or Switzerland and you think we have got this wrong, you are entitled to complain to your national data protection authority, and we would rather you told us first so we can put it right.

13. children's privacy and updates

Our site is not intended for children under 13 (or 16 in certain jurisdictions). We do not knowingly collect data from minors. If you believe a minor has provided us data, please contact us for immediate deletion. We reserve the right to update this Policy dynamically; continued use constitutes acceptance.

Also see our Terms of Use & Member License Agreement. Questions about this policy? Get in touch.