Privacy & Cookie Policy
Effective date:
Who we are and how to reach us
, operating the Shiloh Esther website at shiloh-esther.com, is responsible for the personal information processing described here. Contact or with privacy questions or requests.
This policy covers the website, our own account and email services, our forms, and orders we handle. A retailer or other independent service may also provide its own privacy notice. Links to this policy are available before account registration and at relevant points of collection.
Information you provide
Contact and support. If you contact us, we process your email address, any name or other details you choose to provide, the contents of your message, and our correspondence to respond and manage the request. Please do not send unnecessary sensitive information or information identifying a child.
Email access and accounts, when available. If you request gated access or create an account, we process . We use this information to provide requested access, send verification and service messages, maintain account security, and manage your preferences. Required fields are identified. Without the necessary access information, we cannot provide an account‑based feature.
Agreement records. For features requiring agreement, we retain to document the agreement and investigate disputes or misuse. The retention schedule below applies. Account access does not automatically subscribe you to promotional email.
Newsletters. If you separately subscribe, we use to send the updates you requested. You can unsubscribe through the link in a marketing email or contact . Necessary account and order messages may continue while relevant.
Purchases. If you purchase directly from us, we process to fulfill the order and handle support, accounting, and legal requirements. processes .
Purchases from independent retailers are handled under those retailers' notices; describe any order information they share with us at .
Other active forms. A permission to respond to an inquiry does not authorize publication of a testimonial or child's image.
Information collected automatically
When you visit, the website and its providers process . We use the listed data for .
We obtain information from . We do not treat an email address as proof of a person's age, identity, or parental authority.
Cookies and similar technologies
Cookies, local storage, pixels, embedded media, and similar tools can store or access information on your device. Our current inventory is: .
Essential technologies: . Blocking these may prevent the associated feature from working.
Optional technologies: . Where consent is required, we request it before activating the technology. You can change your choices through .
Rejecting optional cookies does not prevent access to features that do not depend on them. Browser settings may also control storage, but do not necessarily cover every technology. Our handling of Global Privacy Control and other legally recognized preference signals is . Our handling of the older Do Not Track browser signal is . These signals are not interchangeable.
How we use information and applicable legal grounds
We use the information specified above to provide requested access and resources; fulfill direct orders; respond to inquiries; send requested newsletters; maintain the website and prevent misuse; keep necessary business records; honor privacy choices; and comply with applicable law. Each purpose applies only to the information reasonably needed for it.
Where EU or UK data-protection law applies, our applicable grounds are : steps you request before a contract and performance of the relevant contract; compliance with identified legal obligations; consent for activities requiring it; and identified legitimate interests, such as proportionate service security or support, where those interests are not overridden by your rights. We do not assume that every listed ground applies to every activity. We identify any additional condition required for special-category information before processing it.
Who receives information
We disclose information to the following providers only for the actual purposes and data categories specified: ; ; ; ; ; ; .
We may disclose relevant information to professional advisers subject to appropriate confidentiality, to authorities where legally required or otherwise lawfully justified, and as reasonably necessary to investigate fraud or protect legal rights. A business reorganization may involve a lawful transfer subject to applicable protections and required notices; this does not authorize unrestricted new uses of your information.
Sale, sharing, and targeted advertising:
Children and adult-managed access
Our books and activities are for children to enjoy with appropriate adult involvement. Account registration, purchases, and adult contact forms are intended to be completed by parents, caregivers, educators, or other eligible adults. Children should not submit their email addresses or other personal information through these adult features.
If you believe a child has provided personal information through the website, contact with enough detail to locate it. We will assess the request, verify authority when reasonably necessary, and take the action required by applicable law, including deletion or cessation of processing where appropriate.
Actual children's data practices:
If a feature requires verifiable parental consent, we provide the required direct parental notice and obtain that consent before collection except where a lawful exception applies. A general Terms checkbox or ordinary email verification is not a substitute. Where COPPA applies, parents can consent to collection and internal use without agreeing to optional third-party disclosures; those nonintegral disclosures require separate verifiable parental consent. Parents can request review or deletion of covered children's information and refuse further collection or use by contacting , subject to the verification and exceptions allowed by law. We do not condition a child's participation on providing more personal information than is reasonably necessary.
Required schedule if COPPA applies:
If we introduce child submissions, galleries, recordings, personalized profiles, or other features involving children's personal information, we will establish the required notices, consent mechanisms, limits, and safeguards before activating them. A broad website release does not provide permission to publish a child's photo, voice, or story.
Retention and deletion
We keep information only for as long as needed for the disclosed purposes, applicable legal obligations, and legitimate dispute handling, using the periods or criteria below. We delete or deidentify it when no longer required, subject to applicable law. Retention is not indefinite merely because material on the site is proprietary.
Unverified access requests and expired tokens: . Active account data: . Closed-account data: . Terms acceptance records: . Security logs: . Newsletter data and suppression records: . Order and accounting records: . Support inquiries: . Backups: . Covered children's data: .
We may preserve specific information longer where lawfully necessary for a legal hold, dispute, or statutory obligation, and restrict its use accordingly. We may retain a limited suppression record to honor an unsubscribe request. Account deletion may end account-based access but does not remove consumer rights or require destruction of a lawfully retained order record.
Security and international processing
We use appropriate to the information and risks. No system can guarantee absolute security. If an incident requires notice, we will provide it as required by applicable law. Do not send passwords, payment credentials, or unnecessary sensitive information through ordinary contact messages.
We operate in the United States. Information is processed in . Where applicable law requires safeguards for international transfers, we use . Visiting the website does not waive international data-protection rights or create blanket consent to every transfer.
Your choices and privacy rights
Depending on your location and the law's applicability, you may have rights to know or access information, correct it, obtain a portable copy, delete it, restrict or object to processing, withdraw consent, and opt out of certain sales, sharing, targeted advertising, or profiling. Where applicable, additional rights include an authorized-agent request and appeal of a denied request. Minnesota residents covered by the applicable law may also request a list of specific third-party recipients and have specific rights relating to qualifying profiling decisions.
Send requests to or use . We verify identity or authority only where legally permitted or required and only to a proportionate extent. Opt-out requests are not subject to identity verification where the law prohibits that requirement, without excluding legally permitted fraud checks. We explain any lawful limitation and respond within the applicable statutory period. We do not require you to create a new account solely to submit a rights request. We will not deny a legal right solely because you have closed your account. We will not unlawfully discriminate against you for exercising privacy rights.
Where an appeal right applies, reply to a denial with "Privacy appeal" or contact . We will provide the review procedure and information about further complaint options required by law. You may also complain to the relevant regulator, including the Minnesota Attorney General, the California Privacy Protection Agency if applicable, an EU supervisory authority, or the UK Information Commissioner's Office.
Withdrawing consent does not invalidate earlier lawful processing. Unsubscribing from marketing does not withdraw a necessary contractual instruction to send a requested login or order message. Optional newsletter consent is not a condition of website access.
Policy changes
We will update the effective date when this policy changes and provide additional notice when required. If a change requires new consent, we will request it before the affected processing. We will not rely on a policy edit alone to authorize an incompatible new use of previously collected information.