Information we collect automatically. When you visit the Site, we and our service providers may automatically collect:

• IP address and general location

• Device and browser type

• Pages viewed, links clicked, and time spent on the Site

• Referring website

• Information collected through cookies and similar technologies (see Section 5)

Information from third parties. We may receive information from:

• Our payment processor (confirmation of payment; we do not store full card numbers)

• Shipping and fulfillment providers

• Social media platforms, if you interact with us or sign in through them

• Analytics providers

We do not knowingly collect Social Security numbers, government ID numbers, or health information through the Site.

2. How We Use Your Information

We use personal information to:

• Process and fulfill orders and ship your badges

• Create and manage your membership and account

• Process payments

• Send you membership materials, newsletters, and updates you've signed up for

• Respond to your questions and provide customer support

• Feature community submissions

• Operate, maintain, and improve the Site

• Detect, prevent, and address fraud, security issues, and technical problems

• Comply with legal obligations and enforce our terms

We will not use your information for materially different purposes without notifying you.

3. How We Share Your Information

We do not sell your personal information for money. We share information only in these limited circumstances:

• Service providers. We share information with vendors who perform services on our behalf — payment processing, shipping and fulfillment, email and newsletter delivery, website hosting, and analytics. These providers are only permitted to use your information to perform services for us.

• Legal reasons. We may disclose information if required by law, subpoena, or legal process, or to protect the rights, safety, or property of Joy Finders, our members, or others.

• Business transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

• With your consent. We may share information for any other purpose with your permission.

Some privacy laws define "sharing" broadly to include the use of certain advertising or analytics cookies. To the extent any of our cookie practices qualify as "sharing" or "selling" under those laws, you can opt out as described in Sections 5 and 7.

4. Data Retention

We keep personal information for as long as needed to provide our services, maintain your membership, comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we take reasonable steps to delete or de-identify it.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Site, remember your preferences, understand how the Site is used, and improve your experience.

• Essential cookies are necessary for the Site to function (for example, keeping you logged in or maintaining your cart).

• Analytics cookies help us understand how visitors use the Site.

• Marketing cookies [if applicable] may be used to measure and improve our advertising.

You can control cookies through your browser settings and, where offered, through the cookie banner on our Site. We honor browser-based opt-out preference signals, including Global Privacy Control (GPC), where required by law.

6. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect your personal information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account password confidential.

7. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Right to know / access — request the categories and specific pieces of personal information we have collected about you.

• Right to correct — request that we fix inaccurate information.

• Right to delete — request that we delete personal information we've collected from you, subject to legal exceptions.

• Right to data portability — request a copy of your information in a portable format.

• Right to opt out — opt out of the "sale" or "sharing" of personal information and of targeted advertising or certain profiling.

• Right to non-discrimination — we will not discriminate against you for exercising your rights.

To exercise any of these rights, contact us at heysarah@sarahhammill.com or P.O. Box 214209, Sacramento CA 95821. We will verify your request (for example, by confirming details associated with your account) before responding, and we will respond within the timeframes required by applicable law. You may use an authorized agent to submit a request on your behalf with proper authorization.

If we deny your request, you may appeal by contacting us at heysarah@sarahhammill.com. We will respond to appeals as required by applicable law.

California residents (CCPA/CPRA)

In the past 12 months, we have collected the following categories of personal information: identifiers (name, email, address), commercial information (purchase history), internet activity (browsing and interaction data), geolocation (general location from IP), and information you voluntarily submit. We collect this information for the business purposes described in Section 2.

We do not sell personal information, and we do not knowingly sell or share the personal information of consumers under 16. California residents have the rights described above, including the right to know, delete, correct, and opt out, and the right not to receive discriminatory treatment for exercising these rights. California's "Shine the Light" law also lets California residents request information about disclosure of personal information to third parties for their direct marketing purposes; we do not share information for that purpose.

Residents of other states

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others — have the rights described above to the extent those laws apply to us. To exercise them, contact us using the information in Section 11.

8. Children's Privacy

The Site and our services are intended for adults. We do not knowingly collect personal information from children under 13 (or under the minimum age in your jurisdiction). If you believe a child has provided us personal information, contact us and we will delete it.

9. Email and Marketing Communications

If you sign up for our newsletter or membership emails, we'll send you updates, community news, and offers. Every marketing email includes an unsubscribe link, and you can opt out at any time. We will still send you transactional messages related to your account, orders, or membership.

10. International Users

We are based in the United States and process information here. If you access the Site from outside the U.S., you understand your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

11. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at:

Hey Sarah Studio, LLC

P.O. Box 214209

Sacramento, CA 95821

heysarah@sarahhammill.com

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we'll revise the "Last updated" date above and, for material changes, provide additional notice. Your continued use of the Site after changes take effect means you accept the updated policy.