Privacy Policy — Never Below
Last Updated: October 29, 2026
Effective: at store launch on neverbelow.com
1. Introduction
Never Below ("we," "us," or "our") operates neverbelow.com (the "Site"), a clothing store. Every piece we sell is printed to order. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have.
Operator: Never Below, operated by Victor Avila, Santa Rosa, California.
2. Information We Collect
2.1 Information You Provide Directly
- Order information — your name, email address, shipping address, and the items you buy. Collected at checkout so we can make and deliver your order.
- Payment information — card payments are processed by Stripe on Stripe's own hosted checkout pages. Your full card number goes to Stripe, never to our servers.
- The Above List (our email list) — your email address, only when you choose to join. No purchase required.
- Messages you send us — emails or contact-form messages, and what you write in them.
2.2 Information Collected Automatically
- Essential technical data — IP address, browser and device type, and the pages you visit, recorded in server logs for security and to keep the Site working.
- Order status lookups — when you open your order-status link, we record the visit so we can show your order's progress. The link itself acts as your key; there is no account and no password.
- Analytics and marketing data — only with your consent. If you accept non-essential cookies, we and our analytics/advertising partners may collect pages viewed, products viewed, and purchase events to measure the Site and to run and measure advertising. If you decline, none of this is collected.
2.3 Information from Third Parties
- Stripe confirms to us whether your payment succeeded; we receive payment status and limited details (such as card type and last four digits), never your full card number.
- Printful, our print-on-demand fulfillment partner, sends us production and shipping status for your order, including tracking numbers.
2.4 Cookies and Similar Technologies
| Cookie Type | Purpose | Examples | Duration |
|---|---|---|---|
| Essential | Cart, checkout, security, remembering your cookie choice | Cart token, checkout session, consent preference | Session to 12 months |
| Analytics | Understanding how the Site is used so we can improve it | Aggregated page and product views | Up to 14 months |
| Marketing | Running and measuring ads, and reaching people who visited the Site | Ad platform pixels (e.g., Meta, TikTok, Google) — set only with consent | Up to 13 months |
Essential cookies are always active because the store cannot function without them. Analytics and marketing cookies are set only after you opt in through our cookie banner, and you can change your choice at any time.
3. How We Use Your Information
- Making, shipping, and supporting your order (contractual necessity)
- Sending order confirmations, shipping notices, and order-status information (contractual necessity)
- Sending The Above List emails — first access to drops and early lookbooks (your consent; unsubscribe any time)
- Preventing fraud and keeping the Site secure (legitimate interest)
- Improving the Site and our products (legitimate interest; consent where cookies are involved)
- Running and measuring advertising (your consent)
- Meeting tax, accounting, and legal obligations (legal obligation)
We do not use your information for automated decisions that produce legal or similarly significant effects.
4. How We Share Your Information
We share personal information only with the providers who make the store run:
- Stripe — payment processing
- Printful — prints and ships your order; receives your name, shipping address, and order details solely to fulfill it
- Supabase — our database and order-status infrastructure
- Resend — delivers transactional email (confirmations, shipping notices)
- Hosting and platform providers — serve the Site
- Analytics and advertising partners — only if you consent to those cookies
- Meta Platforms (Facebook and Instagram) — with explicit marketing acceptance, our Meta Pixel and Conversions API share page/product views, cart additions, checkout activity and paid order values; IP address, browser user agent, and Meta cookie identifiers; and a SHA-256-hashed order email for customer matching, advertising measurement and optimization. Hashing is not anonymization. We retain your visitor reference, acceptance time, notice version, categories and region, and preserve acceptance evidence when you withdraw. Withdraw through Cookie Settings in the footer or contact support@neverbelow.com; withdrawal stops future advertising sharing, including delayed order reporting. Global Privacy Control disables marketing sharing.
We may also disclose information if required by law, subpoena, or court order, or to protect our rights and the safety of others. If the business is ever sold or merged, information may transfer to the new operator under this same policy.
We do not sell your personal information.
5. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Order and transaction records | 7 years | Tax and accounting obligations |
| Above List email addresses | Until you unsubscribe (then kept on a suppression list so we never email you again) | Consent management |
| Support messages | 3 years | Service quality and dispute records |
| Analytics data | 14 months | Performance improvement |
| Server logs | 90 days | Security and debugging |
6. Data Security
- Encryption in transit (HTTPS/TLS) across the Site
- Payments handled entirely by Stripe, which is PCI-DSS compliant; we never store full card numbers
- Order-status pages are protected by unguessable signed links rather than passwords
- Access to order data is limited to the people and providers who need it to fulfill your order
No system is perfectly secure, but we take reasonable, current measures to protect your information.
7. Your Rights Under GDPR (EEA/UK Residents)
You have the right to access, correct, delete, restrict, or port your personal data; to object to processing based on legitimate interests; and to withdraw consent at any time. You may also complain to your local Data Protection Authority. Contact us at the address in Section 12 — we respond within 30 days.
8. Your Rights Under CCPA/CPRA (California Residents)
You have the right to know what personal information we collect and how we use it; to delete it; to correct inaccuracies; to opt out of the "sale" or "sharing" of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising your rights.
We do not sell personal information. If you consent to marketing cookies, the resulting data flows to advertising partners may count as "sharing" under California law — you can withdraw that consent at any time via the cookie settings or our Do Not Sell or Share My Personal Information page.
Categories collected (past 12 months, once the store is live): identifiers (name, email, address, IP), commercial information (orders), internet activity (pages and products viewed — consent-based for non-essential tracking), and approximate geolocation derived from IP address.
9. Children's Privacy
The Site is not intended for children under 13 (or 16 in the EEA), and we do not knowingly collect their information. Purchases require you to be 18 or to have a parent or guardian's consent. If you believe a child has provided us information, contact us and we will delete it.
10. International Data Transfers
Our providers process data primarily in the United States. If you are outside the US, your information will be transferred there, with safeguards such as Standard Contractual Clauses where required.
11. Changes to This Policy
We will post updates on this page, change the "Last Updated" date, and email Above List members about material changes. Continued use of the Site after an update means the updated policy applies.
12. Contact Information
- Email: support@neverbelow.com
- Operator: Never Below, operated by Victor Avila, Santa Rosa, California.