Privacy Policy

What we collect

Order information. When you place an order — whether or not you create an account — we collect your name, email address, shipping address, and phone number (if you provide one), along with what you ordered and the order total.

Account information. Creating an account is optional; you can check out as a guest. If you sign in (powered by Clerk), we store your Clerk account id, email address, and display name so your account can be linked to your past orders.

Custom logo uploads. If you upload an image for custom-printed caps or a configured box, we store the uploaded file (both the cropped print-ready version and, as a backup, your original upload before cropping) in our object storage, along with the crop area you selected. If your upload is later attached to a paid order, we also link it to that order and the associated name/email.

Cart activity. As you add items to your cart, we periodically save a snapshot of the cart (items, quantities, and subtotal) to our database so we can recover it if you leave without completing checkout — this is standard "abandoned cart" functionality. This happens even for guest shoppers who haven't entered an email yet; once you do provide an email (at checkout or by signing in), it's attached to that cart record.

Contact form submissions. If you use the contact form, the name, email, and message you submit are emailed to our support inbox. We don't keep a separate database record of the message itself beyond that email.

Payment information. We do not collect or store your card number, expiration date, or CVV. Checkout happens on a Stripe-hosted payment page — your card details go directly to Stripe and never touch our servers. We do receive and store payment metadata from Stripe, such as the payment amount, a Stripe session/transaction id, and (when Stripe provides it) the billing/shipping name and address associated with the payment.

Technical & usage information. We use Google Analytics and, when configured, Google Ads conversion tracking (see "Analytics & advertising" below). We also briefly log the IP address of requests to certain endpoints (like the contact form) purely to apply rate limits and prevent abuse.

How we use it

• To process, print, package, and ship your order.
• To send transactional emails — order confirmations, shipping notifications, and replies to contact-form requests.
• To recover abandoned carts (e.g. showing you what's still in your cart, or following up if you provided an email).
• To detect and prevent spam, abuse, and fraudulent orders.
• To understand site usage and measure the effectiveness of our advertising, via Google Analytics and Google Ads.
• To maintain your account and order history if you choose to sign in.

Payments

All checkout payments are processed by Stripe through a Stripe-hosted Checkout page. Card numbers, expiration dates, and CVVs are entered directly into Stripe's payment form and are never sent to or stored on VialBox servers. Stripe's handling of your payment data is governed by Stripe's own privacy policy.

Analytics & advertising

When configured, we use Google Analytics (GA4) and Google Ads conversion tracking (via Google's gtag.js) to understand site traffic and measure ad performance. This can include events like viewing a product, adding an item to your cart, starting checkout, and completing a purchase.

If you complete a purchase and we have your email address, we use Google's Enhanced Conversions feature to improve ad measurement accuracy — your email is hashed in your browser before it's sent to Google, so Google never receives it in plain text from this integration.

Cookies & local storage

We use a small number of browser storage items:

• Cart identity. A cart id and your current cart contents are stored in your browser's local storage so your cart persists between visits.
• Ad/campaign attribution. If you arrive via an ad or campaign link, we store the relevant campaign parameters (e.g. UTM values, Google/Facebook click ids), your landing page, and referrer in local storage so a later purchase can be attributed to that campaign.
• Sign-in session. If you sign in, Clerk sets cookies to keep you signed in.
• Analytics/advertising cookies. When Google Analytics / Google Ads are configured, Google sets its own cookies in your browser as part of that service.

You can clear local storage and cookies, or block them, through your browser settings; doing so may sign you out or reset your cart.

Who we share data with

We share data with the vendors that make the store work:

• Stripe — payment processing (see "Payments" above).
• Clerk — account authentication, if you choose to sign in.
• Google (Analytics / Ads) — site analytics and ad conversion measurement, when configured.
• Resend — delivery of transactional emails (order confirmations, shipping updates, contact-form replies).
• Object storage / hosting providers — your uploaded logo images are stored in S3-compatible object storage; the site itself runs on Railway.
• Shipping carriers (e.g. USPS) — the name and address needed to deliver your order.

We don't sell your personal information, and we don't share it with anyone else for their own marketing purposes.

Data retention

We retain order, account, and cart records for as long as reasonably needed to fulfill orders, provide support, and meet our own record-keeping needs. We don't currently have an automated deletion schedule; if you'd like your data removed, contact us (see "Contact" below) and we'll address it manually.

Your choices & rights

• Guest checkout. You can order without creating an account.
• Account data. If you have an account, you can manage your sign-in details through Clerk's account controls.
• Access, correction, or deletion. Email support@vialboxes.com to request a copy of the data we hold about you, ask us to correct it, or ask us to delete it.
• Cookies & tracking. You can block or clear cookies and local storage in your browser at any time (see "Cookies & local storage" above).

Children

VialBox is not directed to children under 13, and we don't knowingly collect personal information from children under 13.

Changes to this policy

We may update this policy as the site changes. We'll update the "Last updated" date above when we do.

Contact

Questions about this policy or your data? Email support@vialboxes.com.