Privacy Policy and Data Protection Standards

This privacy policy took effect on 2026-11-12. All data practices, retention schedules, and ad network measurement frameworks described herein govern every interaction originating on or following this calendar date. Prior versions are archived at our Santa Fe studio office.

The data controller responsible for personal information processed through this website is Doodletss, trading at doodletss.com, with a physical workshop and retail establishment situated at 120 Don Gaspar Ave, Santa Fe, New Mexico 87501, Santa Fe, New Mexico, United States. Telephone inquiries are routed through 505-983-3771, and written electronic communications are received at [email protected].

Our web infrastructure records strictly defined operational inputs. When submitting an estimate request via zasuefd.php, the system writes the visitor name, phone number, email address, physical postal delivery address, kind of artisan craft requested, project notes, requested material specification, and the affirmative consent confirmation. Simultaneously and automatically, our logging daemon captures the visitor IP address, browser user-agent header, referring URL, timestamp of form rendering, and timestamp of transmission. The support chat script (suru07a.php) logs visitor dialogue text and issues an ephemeral browser session token so active consultation threads persist across page views. When advertising campaigns deliver visitors, URL parameters containing click identifiers are parsed. Consent preferences are committed locally to localStorage under the key site_consent_v2. This site maintains no user accounts, requires no passwords, and processes zero credit card transactions or banking details because our catalogue operates on an inquiry-only basis.

Recorded data is deployed solely for explicit business purposes: calculating custom craft quotes for earthenware ceramics, cedar carvings, and home decor; coordinating studio pickup or safe postal dispatch to physical addresses; addressing artisan consultation inquiries in real time; verifying authentic form submissions against automated spam bots via honeypot traps; auditing web server security; and evaluating aggregate advertising campaign effectiveness across approved commercial ad channels.

Under applicable statutory frameworks, processing operations rest upon three distinct legal grounds. Commission estimates and production communications proceed under Contract (Article 6(1)(b) GDPR), being essential to take preparatory steps at the requester’s direct initiative before entering a sales agreement. Marketing telemetry, optional analytics cookies, and advertising measurement proceed exclusively under affirmative Consent (Article 6(1)(a) GDPR). Server maintenance, infrastructure defense, honeypot spam filtering, and basic operational stability proceed under our Legitimate Interest (Article 6(1)(f) GDPR) to maintain an uncompromised digital studio presence.

This website is an active destination for paid commercial acquisition campaigns. Google Ads, Microsoft Advertising and Meta Ads send traffic here. We receive inbound traffic directed by google ads, microsoft advertising, and meta ads. When an advertisement is selected on these networks, inbound hyperlinks append specific click identifier parameter tokens: gclid for Google Ads, msclkid for Microsoft Advertising, and fbclid for Meta Ads. These identifiers enable post-click verification of campaign effectiveness, keyword valuation, and artisan inquiry attribution.

In accordance with consent mode standards and Google Consent Mode v2, our site maintains a default privacy state. The four regulatory signals—ad_storage, ad_user_data, ad_personalization, and analytics_storage—remain strictly held denied upon initial page load until the visitor allows storage. No marketing cookies, conversion pings, or personalized targeting parameters transmit until the visitor affirmatively clicks “Accept” on our consent interface. If the visitor selects “Decline” or subsequently revokes permissions via our preferences control, all four parameters (ad_storage, ad_user_data, ad_personalization, and analytics_storage) are set back to denied immediately, halting non-essential tracking scripts.

Data received is handled by contracted infrastructure providers operating under strict confidentiality mandates. Google Ireland Ltd / Google LLC processes Google Ads conversion signals and consent pings when storage is permitted. Microsoft Ireland Operations Ltd processes query signals under Microsoft Advertising campaigns, governed by the Microsoft privacy statement at https://privacy.microsoft.com/privacystatement (privacy.microsoft.com). Meta Platforms Ireland Ltd receives conversion tokens when active Meta Ads campaigns run. The hosting provider that serves this site and stores the enquiry database, and the mail provider that carries the notification to our Santa Fe operator inbox, handle operational transmission.

Because our physical workshop is based in Santa Fe, New Mexico, data transmitted by international visitors crosses borders into the United States. Such transmissions are secured through standard contractual clauses (SCCs) approved by the European Commission, alongside supplementary technical safeguards including TLS 1.3 cryptographic transport and restricted studio access controls.

Personal data is preserved only for defined, finite durations. Customer inquiry records, commission specifications, and corresponding email threads are retained for exactly 36 months to accommodate multi-year warranty references and seasonal client reorders. Support chat conversation histories are purged automatically after 12 months. Web server traffic logs, including incoming IP records and user-agent strings, are overwritten after 30 days. Stored visitor consent choices recorded under site_consent_v2 persist in the browser for 12 months before re-prompting.

We protect stored records using layered technical safeguards: mandatory HTTPS transport encryption across the entire doodletss.com domain, hardened database server environments, firewall boundaries on all terminal endpoints, automated brute-force defenses, strict input hygiene to block injection vulnerabilities, and non-reversible hashing of session identifiers. Physical work records at 120 Don Gaspar Ave are kept under locked administrative supervision.

Visitors residing within the European Economic Area, United Kingdom, or Switzerland possess statutory entitlements under the gdpr. These comprise: the right to access stored personal records; the right to rectification of inaccurate or outdated specifications; the right to erasure (“right to be forgotten”); the right to restriction of active processing; the right to structured data portability in a machine-readable format; the right to object to processing grounded in legitimate interest; and the absolute right to withdraw consent at any juncture without impacting previous lawful processing.

Residents of California, Colorado, Connecticut, Virginia, Utah, and other applicable states enjoy protections under statutory enactments including the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa). These include the right to know what personal data categories are gathered, the right to delete personal information, the right to correct factual inaccuracies, and the right to non-discrimination for exercising privacy prerogatives. Doodlet’s does not sell personal information or share customer personal information for cross-context behavioral advertising without explicit consent.

This website actively detects and honours the global privacy control (Sec-GPC) browser header. When a browser transmits a valid GPC broadcast signal indicating an opt-out preference, our systems interpret this directly as an instruction to withhold non-essential analytical and marketing storage without presenting redundant secondary verification prompts.

Doodlet’s operates an artisan home decor and studio craft showcase aimed strictly at adult gift commissioners and home decorators. We do not knowingly solicit, harvest, or maintain personal records belonging to individuals under sixteen years of age. If an inquiry is identified as originating from a minor without verifiable parental consent, the transmission and associated logs are deleted from our database immediately.

If you consider our handling of your information deficient, you possess the legal prerogative to lodge a formal complaint with an appropriate supervisory authority. United States residents may contact the Office of the New Mexico Attorney General (Consumer Protection Division) or the California Privacy Protection Agency (CPPA) where CCPA rules govern. European residents may submit grievances to their national Data Protection Authority (DPA).

To invoke your statutory entitlements regarding access, deletion, correction, or portability, forward a written request directly to [email protected] or via registered post to: Doodlet’s Data Office, 120 Don Gaspar Ave, Santa Fe, New Mexico 87501, United States. State your full legal name, prior email address submitted through our inquiry portal, and specific nature of your directive. Every verified data request is processed and answered within 5 days.

We periodically modify this privacy statement to reflect operational alterations at our Santa Fe workshop, evolving statutory requirements, or modified ad network integration guidelines. Any revisions are published at doodletss.com/privacy/privacy.html with a renewed effective date displayed at the head of the statute. We urge clients to inspect this document periodically.

For inquiries regarding data stewardship, commission records, or algorithmic advertising disclosures, reach our studio coordinator directly: Doodlet’s Workshop, 120 Don Gaspar Ave, Santa Fe, New Mexico 87501, Santa Fe, New Mexico, United States. Telephone: 505-983-3771. Email: [email protected]. We answer all general inquiries within standard Santa Fe workshop operating hours.