Draft for owner review — the store is not open for live orders.

Privacy Policy

Prepared November 2, 2026

SellFlixAndChill uses information to run this store, fulfill orders and respond to you. This policy describes the website’s current implementation.

Information we collect

During checkout we collect your name, email, delivery address, purchased products, quantities and accessory choices. Order records include prices, shipping charges, tax, payment references, payment and fulfillment status, and tracking information. We do not store full payment-card numbers or card security codes in the store database.

The support form collects your name, email, optional order number, subject and message, plus a submission reference and timestamps. Messages are stored in the shop database before an email notification is attempted. Please do not send card details, passwords or other unnecessary sensitive information. Email replies and any photos you send in reply are handled through our support email account; these replies are not automatically copied into the website inbox.

For abuse prevention, the server derives a hash from the connection IP address and, for support requests, the submitted email, and records request counters. The host and service providers may also process connection information and operational logs under their own policies. Hashing does not make all information anonymous.

How we use it

We use these details to calculate shipping and applicable tax, process payments, make and dispatch your products, resolve problems, prevent abuse, keep business records, and send transactional messages. An optional order number and matching email can associate a support request with an order for administrator use. This match does not give anyone public access to the order.

Services that process information

ChatGPT Sites and its hosting infrastructure operate this website. The implementation uses server-side Cloudflare Workers, a D1 database for orders and support records, and R2 storage for product images. These providers process information needed to host and operate the service.

Stripe hosts the payment page and processes payment information, customer contact/delivery details, purchase amounts and applicable tax. Shippo receives the shipping details and parcel information needed to validate addresses, obtain rates, buy labels and provide tracking; the selected carrier receives information needed for delivery.

Resend is the website’s transactional email service. It receives sender/recipient information and message contents for order, support and shipment notifications. Support notifications are sent to our monitored Hotmail inbox, operated by Microsoft, so we can reply to you. The notification sender is not a support mailbox; customer-facing messages use a monitored Reply-To address.

These services have their own privacy practices. See OpenAI, Cloudflare, Stripe, Shippo, Resend and Microsoft. Processing locations and provider retention may differ from ours.

The site loads its display fonts through Google Fonts. Your browser contacts Google to request those files, sharing connection information such as your IP address and browser request details. See Google’s Privacy Policy.

Browser storage and analytics

The shopping bag is stored in your browser’s local storage so it can remain between visits. You can clear it using your browser settings. The storefront code does not currently include advertising pixels or a third-party analytics script. Hosting, sign-in and payment providers may use cookies or similar technologies for their services, security and session management. We do not promise that these providers collect no usage information.

Retention and security

Order, support and email-attempt records are stored persistently and are not currently deleted on an automatic schedule. We retain information for fulfillment, support, business records and applicable legal requirements. A final routine retention schedule has not yet been established. Provider and email-account retention is governed by those services’ settings and policies.

Administrator access and administrative changes are checked on the server. Provider secrets remain server-side. We use HTTPS and access controls, but cannot promise that any system is completely secure. We may disclose information when reasonably necessary to comply with law, address fraud or protect rights.

Privacy questions and requests

Use Contact Support for questions or requests concerning your information, including access, correction or deletion where applicable. We may need to verify your identity. Some records may need to be retained for legal obligations or unresolved transactions. We will explain relevant limitations rather than promise immediate deletion from every provider or backup.