Privacy.

Who runs this site.

Gisele's Princess Closet is operated by Made By 1891, a sole proprietorship based in Frederick, Maryland, USA. The "data controller" (in GDPR language) is Anthony Mowl. Contact: contact@madeby1891.com.

What we collect.

• Booking information: name, billing address, shipping address, email, phone number, kid's first name and size, trip dates, destination.
• Payment information: processed by Stripe. We never see or store your full card number — only a card token from Stripe and the last 4 digits + expiration for receipt/display purposes.
• Communication records: emails, texts, and phone notes related to your booking.
• Site analytics: none at launch. We do not run Google Analytics, Meta Pixel, or any third-party analytics tracker. We may add lightweight, privacy-respecting analytics (e.g., Plausible) in the future and will update this page when we do.
• Klaviyo email subscription: if you sign up for our email list at booking confirmation, your email and name go to Klaviyo for transactional and marketing sequences. You can unsubscribe at any time from any email.

Where it lives.

• Google Sheet: the source of truth for inventory, bookings, customers, and claims. Access is restricted to the admins (Anthony and Fallon Mowl) and the operating Google account.
• Stripe: payment records, including card tokens. Stripe is PCI-DSS compliant. Stripe's privacy policy.
• Klaviyo: email subscribers and email-related events (open, click, unsubscribe). Klaviyo's privacy policy.
• Shippo or EasyPost: shipping label generation. They receive name and ship-to address for the purpose of generating UPS labels. Shippo's privacy policy.
• UPS: they need name and ship-to address to deliver your package. Standard carrier flow.
• Cloudflare: our serverless functions run on Cloudflare Workers. Cloudflare may log IP addresses as part of its routing/security infrastructure. Cloudflare's privacy policy.
• GoDaddy: the static site is hosted on a GoDaddy cPanel server. GoDaddy's privacy policy.

Why we collect what we collect.

• To process and fulfill your rental (the only required reason).
• To contact you about your booking (shipping updates, return reminders, damage claims).
• To bill the card on file if you've agreed to a claim or are past return due date (per terms).
• To send transactional email (booking confirmation, shipping notification, return reminder) — not opt-in.
• To send marketing email if you opt in — clearly opt-in, easily unsubscribed.

What we will never do.

• Sell or rent your data to anyone, ever.
• Share your data with advertising partners for retargeting.
• Email your kid. We only communicate with the booking adult.
• Store more data than we need. Old records get archived and minimized after the retention windows below.

Retention.

• Active booking records: kept while the booking is active and 12 months after return, then archived.
• Financial records: kept 7 years for US tax compliance.
• Marketing subscribers: kept while subscribed. Unsubscribing removes you from active lists; we retain the unsubscribe record itself indefinitely so we don't accidentally re-add you.
• Server logs: typically 30 days at Cloudflare and GoDaddy.

Your rights.

You can email contact@madeby1891.com at any time to:

• See what we have about you (data access request).
• Correct anything that's wrong.
• Delete your record (we'll keep only what's required for tax and legal purposes).
• Export your data to a portable format.
• Unsubscribe from marketing (also one-click in any marketing email).

We respond within 14 days. California residents have additional rights under the CCPA; New York and other state residents have their respective state rights. All of these requests get the same fast response — we don't make you fight for a copy of your own data.

Children.

This is a rental service for parents and guardians purchasing on behalf of children. We do not knowingly collect data directly from children under 13. The kid's first name and clothing size we collect at checkout is provided by the adult booker. If you believe a child has provided us data directly, contact us and we'll delete it.

Cookies.

We use only the cookies necessary to make the booking flow work (session cart, booking-in-progress state). No third-party tracking cookies. No advertising cookies. No analytics cookies at launch.

Changes to this policy.

If we make a material change, we update the "last updated" date at the top of this page and email active customers. Significant changes will be highlighted on the home page until a reasonable period has passed.

How to reach us.

Email: contact@madeby1891.com
Phone: see contact
Mail: Made By 1891, Frederick, MD (full address available on request)