Privacy policy
321 Cookie is operated by 321 Cookie LLC ("321 Cookie", "we", "us", "our"). This Privacy Policy explains what personal information we collect at 321cookie.com, why we collect it, who we share it with, and how long we keep it.
Last updated: 30 August 2026.
1. Who we are, and how to reach us
321 Cookie LLC
15623 Summerbrooke Ln
South Beloit, IL 61080
United States
Email: hello@321cookie.com
Phone: +1 (815) 310-0796
We make 3D-printed cookie stamps and cookie presses. Some of our stamps are ready-made designs; others are made from a description you type or from a photograph you upload. Because of that last part, this policy has a section about photographs that most online stores do not need. It is section 3, and it is the one worth reading.
2. What information we collect
Information you give us
- Your name, email address, phone number, and shipping and billing addresses.
- Order details and payment information. We never see or store your full card number — payments are handled by Shopify and its payment providers.
- Anything you write to us: emails, phone calls, messages, and product reviews you choose to publish.
- Marketing preferences, if you sign up for email or SMS.
Information collected automatically when you visit
- Your IP address, device and browser type, the pages you viewed, and how you arrived at our site.
- Cookies and similar technologies — see section 8.
Design inputs
- Photographs you upload to the stamp designer.
- Descriptions, style choices and edit instructions you type into the designer.
- The stamp designs we generate from those inputs, and the printable file we cut from each design.
A photograph you upload will often show a person — frequently a child, a pet, or you. Section 3 says exactly what happens to it.
3. Photographs, faces and biometrics
What we do with a photo you upload. We send it to an automated image service operated by Google, which produces a stylised black-and-white drawing based on it. We then convert that drawing into the raised relief pattern that is 3D printed onto your stamp. Someone at 321 Cookie may look at your photograph and the resulting design — to check that it will actually print, to fix a problem with it, or to answer a question you have asked us. Photographs are also used, in the limited way described in section 4, to work out why a design came out badly so that we can make the process better.
What we do not do. We do not use facial recognition. We do not measure, extract, derive or store face geometry, a face template, a faceprint, a fingerprint, a voiceprint, an iris or retina scan, or a scan of hand geometry. We do not use your photograph to identify or verify who any person is, and we do not compare it against any database of people. We do not sell, lease, trade or otherwise profit from your photograph or from anything derived from it, and we do not license it to anyone for advertising.
Illinois Biometric Information Privacy Act (BIPA). 321 Cookie LLC is an Illinois business. We do not believe we collect "biometric identifiers" or "biometric information" as BIPA defines them: we derive no measurement of any person's face or body from your photograph, and we never use it to identify anyone. We publish a written retention and destruction schedule regardless. It is section 4, and we hold ourselves to it.
Photographs of other people. Please upload only a photograph you are entitled to upload. If it shows someone else, you should have their permission. If it shows a child, you should be that child's parent or guardian, or have their parent's or guardian's permission.
Publishing. We will not publish your photograph, your design, or anything identifying you — on our site, on social media, or anywhere else — unless you have asked us to or given us permission.
4. How long we keep things — our retention and destruction schedule
| What | How long we keep it |
|---|---|
| The original photograph you uploaded | Deleted 30 days after you upload it. |
| An uploaded photograph attached to a design that failed our quality checks, that you complained about, or that we selected into a small random sample used to check quality | Up to 12 months, so that we can work out what went wrong and improve the process, then deleted. |
| The stamp design we generated, and the printable file cut from it | Kept indefinitely, so that you can reorder the same stamp. |
| Descriptions and instructions you typed into the designer | Kept with the design. |
| Order, invoice and tax records | As long as tax and accounting law requires, generally seven years. |
| Your contact details and marketing preferences | Until you ask us to delete them, or until they have been inactive long enough that we no longer need them. |
| Website and analytics logs | Up to 24 months. |
You can ask us to delete sooner. Email hello@321cookie.com and we will delete your photograph, and if you want, the design generated from it as well. If you ask us to delete a design for an order we have not printed yet, we may not be able to complete that order.
What deletion means. The image file itself is destroyed. We keep a small record that the file existed and was deleted — its size, its dimensions, and a one-way checksum — so that we can show we handled it properly. That record cannot be turned back into your photograph.
5. Why we use your information
- To make, print, pack and ship the thing you ordered.
- To take payment and to prevent fraud.
- To answer your questions and to handle problems, replacements and refunds.
- To keep the records that tax, accounting and consumer law require.
- To improve our designs and our design process, using the limited photographs described in section 4.
- To send you marketing, if you asked for it. You can unsubscribe from any message we send.
If you are somewhere that requires us to name a legal basis, ours are: performing our contract with you (orders and delivery), our legitimate interests (running, securing and improving the shop), legal obligation (tax and accounting), and consent (marketing, which you can withdraw at any time).
6. Who we share it with
We share personal information only with service providers who need it in order to do a job for us, and only for that job:
- Shopify — our store, checkout and payment platform, and our order and customer records.
- Google — the automated image service that turns an uploaded photograph or a description into a design.
- Cloudflare — hosting, and storage for uploaded photographs and generated designs.
- SimplyPrint — the software that sends designs to our 3D printers.
- Shipping carriers and label providers — including USPS, UPS and Easyship, who receive your delivery address.
- Judge.me — product reviews, if you write one.
- Xero — our accounting records.
- Make (Integromat) — automation between the systems above.
We may also share information with professional advisers, or with a public authority where the law requires it, and with a buyer if the business is ever sold — in which case this policy continues to apply to information collected before the sale.
We do not sell your personal information for money. Please also read section 7, which describes something that several US state laws treat as "sharing".
7. Advertising and personalisation on the Shopify platform
Our store runs on Shopify, and a Shopify feature called Network Intelligence is currently switched on. It means that data about your interactions with our store is used together with data from other Shopify stores to improve products, advertising targeting and personalisation. No other merchant can see your data.
Under several US state privacy laws this may count as "sharing" personal information for targeted advertising, or as a "sale". You can opt out at any time:
- on our Your Privacy Choices page; or
- by turning on the Global Privacy Control signal in your browser, which we honour automatically.
8. Cookies and tracking
We use cookies and similar technologies that are necessary to run the shop — keeping your cart, keeping you signed in, and securing checkout — and others that measure how the site is used so that we can improve it.
We currently sell only within the United States, and our platform does not show a cookie consent banner to visitors in the regions we sell to. You can still block or delete cookies in your browser settings, and you can opt out of data sharing for advertising as described in section 7. Blocking necessary cookies will stop checkout from working.
9. Your privacy rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you, and get a copy of it;
- have it corrected;
- have it deleted;
- opt out of the sale or sharing of personal information, and of targeted advertising;
- not be treated worse for exercising any of these rights.
How to exercise them. Email hello@321cookie.com and tell us what you want. We will reply within 45 days, and will tell you if we need longer. We may ask you to confirm details of an order so that we do not hand your information to somebody else. You may use an authorised agent; we may ask for proof that you authorised them. If we refuse a request we will tell you why, and you can ask us to reconsider by replying to that email.
If you are in the EU or the UK, we ship only within the United States, but where we hold information about you, you also have the right to object to processing, to restrict it, to data portability, and to complain to your local data protection authority.
10. Children
Our shop is meant for adults. We do not knowingly collect personal information from anyone under 13, and children should not create an account or place an order. If you believe a child has given us personal information, email hello@321cookie.com and we will delete it.
This is a different thing from a photograph of a child, uploaded by their parent or guardian to have a stamp made. That is expected, and it is covered by sections 3 and 4.
11. Where your information is held, and how it is protected
Our store data is hosted in the United States. Uploaded photographs and generated designs are held in cloud storage with access restricted to us. We use encrypted connections and we limit who inside the business can see what. No method of storage or transmission is perfectly secure and we cannot promise absolute security — but we can promise the retention schedule in section 4, which limits how long anything is there to be lost.
12. Changes to this policy
If we change this policy we will update the date at the top. If a change is significant — particularly a change to section 3 or section 4 — we will say so prominently on the site.
13. Questions and complaints
Write to hello@321cookie.com, or to 321 Cookie LLC, 15623 Summerbrooke Ln, South Beloit, IL 61080, United States. If you are not satisfied with our answer you may complain to your state Attorney General or, in the EU or the UK, to your data protection authority.