Privacy policy

Last updated: August 6, 2026

The short version. We sell hats. To do that we need your name, address, payment details, and — if you're ordering custom — whatever artwork you send us. We use it to make and ship your order. We don't sell your personal information for money. You can ask us what we hold on you, ask us to fix it, and ask us to delete it. Email hello@hatandpatch.com and we'll sort it out. The rest of this page is the same thing said carefully.

About this policy

Hat & Patch Co. operates this store and website, including all related information, content, features, tools, products and services (the "Services"). Our store is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase through the Services, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

By using the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described here.

1. Personal information we collect

When we say "personal information," we mean information that identifies you or can reasonably be linked to you. It does not include information collected anonymously or stripped of anything that identifies you.

Depending on how you use the Services and where you live, we may collect or process the following categories, including inferences drawn from them:

  • Contact details — name, email address, phone number, shipping address, billing address.
  • Financial information — payment card and financial account details, transaction details, form of payment, and payment confirmations. Full card numbers go to our payment processor, not to us; we see the last four digits and whether the charge succeeded.
  • Account information — username, password, preferences and settings, if you create an account.
  • Transaction information — what you view, add to your cart, buy, return, exchange or cancel, and your order history.
  • Custom design content — artwork, logos, files, text and notes you send us for a custom order, and the design you build in our online customizer.
  • Communications with us — anything you include when you email us, submit a quote or mockup request, book a call, or contact support.
  • Reviews and submissions — product reviews and anything else you post through the Services.
  • Device information — device, browser, operating system, network connection, IP address, and other unique identifiers.
  • Usage information — how and when you interact with the Services, which pages you view, what you click, and what referred you to us.

2. Where we get it

  • Directly from you — when you create an account, place an order, use the customizer, submit a form, or communicate with us.
  • Automatically through the Services — from your device when you visit, and through cookies and similar technologies.
  • From our service providers — when they collect or process information on our behalf.
  • From our partners and other third parties — order and fulfillment status from shipping carriers; fraud and risk signals from our payment processor; aggregate audience data from analytics and advertising providers.
  • From marketplaces — if you buy from us on Etsy, or through Faire wholesale, we receive whatever order information that platform passes to sellers. Their privacy policies govern what happens on their side.

3. How we use it

  • Providing and improving the Services. Performing our contract with you: processing payments, fulfilling and shipping orders, producing mockups, handling returns and exchanges, managing your account, remembering your preferences, sending order notifications, enabling reviews, and improving how the store works.
  • Marketing and advertising. Sending marketing and promotional email where you've opted in, and showing you our advertisements on other websites — including based on items you previously viewed or added to your cart.
  • Security and fraud prevention. Authenticating your account, providing a secure payment experience, and detecting, investigating or acting on fraudulent, unsafe or malicious activity. If you create an account, keeping your credentials safe is your responsibility — don't share them.
  • Communicating with you. Answering questions, providing customer support, and maintaining our business relationship with you.
  • Legal reasons. Complying with applicable law, responding to valid legal process, meeting tax and accounting obligations, and enforcing or investigating potential violations of our terms.

4. How we disclose it

We disclose personal information to third parties for legitimate purposes, subject to this policy. As of the last updated date, that means:

  • Shopify — our ecommerce platform. Hosts the store, processes orders, stores customer and order records, and handles payments through Shopify Payments. See section 5.
  • Payment processors — to authorize and settle payment and screen for fraud.
  • Shipping carriers and fulfillment partners — to deliver your order.
  • Customily — the design tool that powers custom hat ordering. Receives the design you build and the details needed to attach it to your order.
  • Tally — the form we use for mockup and quote requests. Receives whatever you enter into it.
  • Calendly — if you book a call, it receives your name, email address, and the time you selected.
  • Google — Analytics, Search Console and Ads, for site measurement and advertising.
  • Business and marketing partners — to provide marketing services and advertise to you. We use Shopify to support personalized advertising with third-party services based on your online activity across different merchants and websites. These partners use your information in accordance with their own privacy notices. Depending on where you live, you may have a right to direct us not to share information about you for this purpose — see section 11.
  • When you ask us to — such as through your use of social media widgets or login integrations.
  • In connection with a business transaction — such as a merger, acquisition, reorganization or bankruptcy.
  • For legal reasons — to comply with applicable legal obligations including subpoenas, search warrants and similar requests, to enforce our terms and policies, and to protect or defend the Services, our rights, and the rights of our users or others.

We do not sell your personal information for money. Some of the advertising and analytics cookies described in section 6 may still count as a "sale" or "share" under certain US state privacy laws, because of how those laws define the terms. You can turn those off — see section 11.

5. Our relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Information you submit through the Services is transmitted to and shared with Shopify, as well as third parties that may be located in countries other than where you live.

We also use certain Shopify enhanced features that incorporate data from your interactions with our store, with other merchants, and with Shopify. To provide those features, Shopify may make use of personal information collected about those interactions. In those circumstances Shopify is responsible for processing your personal information, including for responding to requests to exercise your rights over its use for those purposes.

To learn more, see the Shopify Consumer Privacy Policy. Depending on where you live, you can exercise certain rights directly through the Shopify Privacy Portal.

6. Cookies, tracking, and your ad choices

We use cookies and similar technologies for three things:

  • Necessary. Keeping you logged in, remembering your cart, and security. The store doesn't work without these.
  • Analytics. How many people visit, which pages they read, and where they drop off.
  • Advertising. Measuring whether our advertising works, and showing our ads to people who have visited before.

You can control these in three ways:

  • Through the cookie preferences control on our site, where available.
  • Through your browser settings — most browsers let you block or delete cookies.
  • Through a Global Privacy Control (GPC) signal. If your browser or extension sends one, we automatically treat it as a request to opt out of any sale or sharing of your information for the device and browser you're using. If we can associate that device with a Shopify account, we apply the opt-out to the account as well. You can learn more at globalprivacycontrol.org. Other than Global Privacy Control, we do not recognize other "Do Not Track" signals.

Blocking necessary cookies will break parts of the store. Blocking the other two won't.

7. Marketing email

If you sign up for our list — at checkout, in a popup, or in the footer — we'll email you about new products and promotions.

Every marketing email carries an unsubscribe link. Use it and you're off the list. You'll still receive transactional email about orders you've placed: confirmations, shipping notices, mockup approvals, and anything else we need to tell you about a hat we're making for you. Those aren't marketing, and you can't opt out of them while an order is open.

8. Custom design files

This one is specific to us, so it gets its own section.

When you order custom hats you send us artwork — a logo, a mark, text, a file — or build a design in our customizer. Here's what happens to it:

  • We use it to make your hats. That's the whole point.
  • We keep it on file so reorders don't mean starting over. If you'd rather we didn't, tell us and we'll delete it once your order has shipped.
  • We don't sell it, license it, or hand it to anyone except the service providers in section 4 who need it to fill your order.
  • We may show finished work — photographs of hats we've made — in our portfolio, on the site, or on social media, unless you tell us not to. Tell us at any point, before or after, and we'll leave your work out. See section 5 of our Terms of Service for the license this rests on.

9. How long we keep it

How long we retain personal information depends on why we have it — whether we need it to maintain your account, provide the Services, comply with legal obligations, resolve disputes, or enforce our terms and policies. In practice:

  • Order and transaction records — as long as tax and accounting rules require, and then as long as we need them to handle warranty claims and reorders.
  • Custom design files — on file for reorders, unless you ask us to delete them.
  • Marketing contacts — until you unsubscribe.
  • Analytics data — according to the retention settings of the providers named in section 4.

When we no longer need something, we delete it or strip it of anything that identifies you.

10. Security

Our store runs on Shopify, which encrypts data in transit and holds payment data to PCI-DSS standards. Access to customer records is limited to the people who need it to run the business, which at our size is a very short list.

No security measures are perfect or impenetrable, and we won't pretend otherwise. Information you send us may not be secure while in transit, so please don't use unsecured channels to send us sensitive or confidential information. If a breach ever affects your information, we'll notify you as required by law.

11. Your rights and choices

Depending on where you live, you may have some or all of the rights below. They aren't absolute, they may apply only in certain circumstances, and in some cases we may decline a request where the law permits.

  • Right to access or know. Request access to the personal information we hold about you, where it came from, why we have it, and who we've disclosed it to.
  • Right to delete. Request that we delete personal information we hold about you, subject to records we're legally required to keep.
  • Right to correct. Request that we correct inaccurate personal information.
  • Right to portability. Receive a copy of your personal information in a portable format and, in certain circumstances, have us transfer it to a third party.
  • Right to opt out of sale, sharing, or targeted advertising. Depending on where you live, you may opt out of the "sale" or "sharing" of your personal information, or of processing for purposes considered "targeted advertising." Exercise that right by enabling Global Privacy Control in your browser (see section 6), or by emailing us at hello@hatandpatch.com with "Do Not Sell or Share" in the subject line.
  • Managing communication preferences. Opt out of promotional email at any time using the unsubscribe link. We may still send non-promotional email about your account or your orders.

How to make a request. Email hello@hatandpatch.com with what you want. We'll confirm we've received it within 10 business days and respond substantively within 45 days. If we need more time, we'll tell you why and take up to another 45 days.

We may need to verify your identity before acting on a request, as permitted or required by law — usually by matching your email address or order details against our records. You may designate an authorized agent to make a request on your behalf; before we accept it, we'll require proof that you authorized them, and we may need to verify your identity directly with you.

We will not discriminate against you for exercising any of these rights. Same prices, same service, same hats.

To learn more about how Shopify uses your personal information and what rights you may have over data processed by Shopify, visit privacy.shopify.com.

12. Complaints and appeals

If you have a complaint about how we handle your personal information, contact us using the details below and we'll take it seriously.

If we decline a request, you can appeal by replying to our decision. We'll review it and give you a written answer within 45 days. Depending on where you live, you may also lodge a complaint with your state attorney general or your local data protection authority.

13. International transfers

We may transfer, store and process your personal information outside the country you live in, including by our service providers and their subcontractors.

If we transfer personal information out of the European Economic Area or the United Kingdom, we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses, or the equivalent contracts issued by the relevant competent UK authority, unless the transfer is to a country determined to provide an adequate level of protection.

14. Children

The Services are not intended for children, and we do not knowingly collect personal information from anyone under the age of majority in their jurisdiction. As of the last updated date, we do not have actual knowledge that we "sell" or "share" (as those terms are defined in applicable law) the personal information of anyone under 16 years of age.

If you're a parent or guardian and believe your child has given us personal information, email us using the details below and we'll delete it.

15. Third-party websites and links

The Services link out to websites and platforms operated by third parties. If you follow a link to a site we don't control, review their privacy and security policies and terms — we don't guarantee and aren't responsible for the privacy or security of those sites, or the accuracy of information found on them.

Information you post in public or semi-public venues, including third-party social platforms, may be viewable by others without limitation on its use. Our inclusion of a link doesn't by itself imply endorsement.

16. Changes to this policy

We may update this Privacy Policy from time to time, to reflect changes in our practices or for other operational, legal or regulatory reasons. We'll post the revised policy on this website, update the "Last updated" date, and provide notice as required by applicable law.

17. Contact

If you have questions about our privacy practices or this Privacy Policy, or you'd like to exercise any of the rights described above, email us at hello@hatandpatch.com, call or text 613-408-6512, or write to us at:

Hat & Patch Co.
4221 Rideau Valley Dr N
Manotick ON K4M 0T8
Canada