Privacy Policy

This policy explains what personal information Atom Eyes LLC, trading as Rare Goblin (“we”) collects when you use this site, why we collect it, who else sees it, and what you can do about it.

1. Who is responsible

Atom Eyes LLC, trading as Rare Goblin is the controller of the personal data described here. You can reach us at support@raregoblin.com.

2. What we collect

Information you give us

• Order information — name, email address, shipping address, billing address and phone number if you provide one.
• Account information — if you create an account: your name, email and a password (stored by Shopify, hashed; we never see it).
• Support messages — whatever you write to us, plus your name, email and any order number you reference.
• Marketing consent — your email address and a record of when and how you opted in, which we keep so we can evidence the consent.

Information collected automatically

• Strictly necessary cookies — a cart identifier, a session token if you sign in, and your cookie preferences. Without these the shop cannot work.
• Visit counts — our host, Cloudflare, counts page views, the page you came from, and your browser and country. It uses no cookies and no identifier that follows you, so it cannot recognise you on another visit or another site.
• Analytics — only if you consent: pages viewed, products viewed, and approximate location derived from your IP address.
• Marketing/advertising — only if you consent: identifiers used by advertising platforms to measure whether an ad led to a purchase.
• Abuse prevention — we store a hashed form of your IP address with contact-form and newsletter submissions so we can identify abuse. We do not store the raw address.

What we do not collect

We never see your payment card details. Checkout is handled entirely by Shopify, which is PCI-DSS compliant. Card numbers do not reach our servers, are not stored by us, and cannot be read by us.

3. Why we use it, and our legal basis

4. Who we share it with

We share only what each provider needs to do its job:

• Shopify — our commerce platform. Processes orders, payments and tax. Receives your order information.
• Cloudflare — hosts this website and stores customer accounts (your name, email, a one-way hash of your password — never the password itself — and saved addresses). Also forwards email you send to our @raregoblin.com addresses.
• Our print-on-demand production partner — manufactures and ships your order. Receives your name, shipping address and the items ordered. It does not receive your payment details.
• Email provider — sends transactional and, where you have consented, marketing email. Receives your email address and message content.
• Hosting and error monitoring — runs the site and records technical errors so we can fix them.
• Analytics and advertising platforms — only where you have consented.

We do not sell your personal information. We do not share it with anyone for their own independent marketing.

These are the companies that receive it, what each one gets, and why:

5. International transfers

Our providers operate in the United States and elsewhere, so your information may be transferred outside your country. Where required, transfers rely on Standard Contractual Clauses or an equivalent safeguard.

6. How long we keep it

• Order records — for as long as tax and accounting law requires, typically 6–7 years.
• Account information — until you ask us to delete the account.
• Support messages — up to 3 years, so we can see the history of an issue.
• Marketing consent records — while you are subscribed, and for a reasonable period afterwards as evidence of the consent and the unsubscribe.
• Analytics data — as configured in the analytics platform, typically 14 months.

7. Your rights

Depending on where you live, you may have the right to:

• access a copy of the personal data we hold about you;
• correct information that is wrong;
• delete your data, subject to records we must legally keep;
• object to or restrict certain processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting what came before;
• opt out of “sale” or “sharing” of personal information (we do neither);
• not be discriminated against for exercising any of these rights.

To exercise any of them, email support@raregoblin.com. We respond within 30 days. We may ask you to confirm your identity — not to obstruct you, but so we do not hand your data to someone else.

8. Cookies and your choices

Strictly necessary cookies always run; nothing else does until you allow it. Analytics and marketing scripts are not loaded at all before consent — we do not load them and then ask.

You can change your mind at any time: Privacy settings.

9. Children

This shop is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us data, write to us and we will delete it.

10. Security

The site is served over HTTPS with a strict Content Security Policy. Session tokens are stored in httpOnly cookies that JavaScript cannot read. Secrets are kept server-side. Payment card data never touches our infrastructure. No system is perfectly secure, and we will not claim otherwise — but if a breach affects you, we will tell you and any required regulator promptly.

11. Changes

If we change this policy we will update the date below, and for material changes we will say so on the site.

12. Complaints

If you are in the UK or EU and are unhappy with how we have handled your data, you may complain to your national supervisory authority. We would appreciate the chance to put it right first — tell us.