Privacy Policy
Last updated: 3 July 2026
1. Who is responsible for your data
The data controller is Earendil Commerce LLC (trading as Crown & Battle), 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States. For anything related to your personal data, write to info@earendil-commerce.com.
2. What we collect
- Order & delivery data — name, email, phone number, shipping address, and the products you buy (collected at checkout).
- Payment data — processed entirely by Stripe. We never receive or store your card number; we only receive confirmation of payment and a payment reference.
- Browsing data — cookies and similar technologies (Meta Pixel, Google Analytics, Microsoft Clarity, UTM parameters), device and usage information. See our Cookie Policy.
3. Why we use it (purposes and legal bases)
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Processing and delivering your order, sending order emails | Order & delivery data | Performance of a contract (Art. 6(1)(b)) |
| Accounting and tax records | Order data | Legal obligation (Art. 6(1)(c)) |
| Advertising measurement and marketing (Meta Pixel, analytics) | Browsing data, hashed email | Consent (Art. 6(1)(a)) |
| Fraud prevention and payment security | Order and payment reference data | Legitimate interest (Art. 6(1)(f)) |
4. Who we share data with
We share data only with the service providers that run this shop:
- Stripe — payment processing
- Supabase — order database hosting
- Resend — transactional emails (order confirmations)
- Meta (Facebook) — advertising measurement (Pixel and Conversions API; personal identifiers are hashed before being sent)
- Google — analytics and address autocomplete (Google Maps)
- Microsoft Clarity — anonymised usage analytics
- Shipping carriers — name, address and phone, to deliver your parcel
We do not sell your personal data.
5. International transfers
We are a US company and data is processed in the United States and other countries where our providers operate. Where data of UK/EU residents is transferred internationally, our processors rely on recognised safeguards such as Standard Contractual Clauses and/or certification under the EU-US Data Privacy Framework (Stripe, Google, Meta and Microsoft are DPF-certified).
6. How long we keep data
- Order records: kept for as long as required by tax and accounting law (typically up to 7 years).
- Support correspondence: up to 2 years after the case is closed.
- Advertising/analytics cookies: see the durations in the Cookie Policy.
7. Your rights (UK & EU)
You have the right to access, rectify, erase and receive a portable copy of your data, to object to or restrict processing, and to withdraw consent at any time (without affecting prior processing). To exercise any right, email info@earendil-commerce.com — we respond within one month. You also have the right to lodge a complaint with your data protection authority; in the UK that is the ICO (ico.org.uk).
8. Your rights (United States)
Depending on your state of residence, you may have the right to know what personal information we hold about you, to request its deletion, to correct it, and to opt out of “sale” or “sharing” of personal information for targeted advertising. We honour such requests regardless of statutory thresholds — email info@earendil-commerce.com with the subject “Privacy request”. We do not discriminate against you for exercising these rights.
9. Children
This website is not directed at children. We do not knowingly collect personal data from anyone under 16; if you believe a minor has provided us data, contact us and we will delete it.
10. Changes
We will post any changes to this policy on this page and update the date at the top.