Policies
Privacy Policy
Last updated:
The short version: we collect what we need to make your order and to send the emails you ask for. We don't sell personal information. Analytics and marketing stay off until you allow them.
Who we are
Cornerstone & Ink is run by Josh Garcia, doing business as Cornerstone & Ink. When this policy says "we" or "us," that's who it means.
Email: hello@cornerstoneandink.com
What we collect
- Contact details you give us, such as your name, email address and phone number.
- Your church's name, if you're ordering for a church.
- Order content: logos, series and sermon titles, dates, verse text and anything else you send with an order.
- Order records: for each purchase we keep the order number, Stripe's checkout reference, what you bought (product and whether it's done-for-you, DIY or a wallpaper), the amount, your name, email and church name, the order status, the dates it was placed and paid, and, for downloads, how many times your download link has been used. We never see or store card or bank account details; Stripe handles those.
- Email signup info: first name, email address and (if you choose) your church's name, plus the time you agreed to marketing emails and where you signed up (the homepage form or the gallery list).
- Emails you send us, and our replies.
- Cookie choices: an anonymous id, the categories you allowed, the policy version, the time, and your browser name. We do not store your IP address with that record.
- Analytics, only if you allow it: pages visited, the site that referred you, and general device type.
Why we use it
- To make and deliver your order, and to contact you about it.
- To send the emails you asked for, such as your welcome code, a free wallpaper, and notes about new packs.
- To answer your questions.
- To keep the records tax law requires.
- To understand which pages are useful, when you allow analytics.
- To measure ads later, only if you allow marketing. We don't run ad pixels today.
Who processes it for us
We use a small number of trusted services. Each one only receives what it needs to do its job, and each has its own privacy policy.
- Stripe handles payments, checkout, receipts and invoices. It receives your name, email, billing details and payment details. Card and bank details go straight to Stripe; we never see or store them. Stripe's privacy policy
- Supabase is our database and private file storage. It holds order records, form submissions, email signups, consent records and DIY download files. It does not set a cookie in your browser. Supabase's privacy policy
- Resend sends order confirmations, download links, order notifications and the marketing emails you signed up for. It receives your name, email address and the content of those emails. Resend's privacy policy
- Vercel hosts this website. Serving a page sends Vercel the usual request data, including IP address and browser type, so the site can run and stay secure. If you allow analytics, Vercel also counts page views without setting a cookie. Vercel's privacy policy
- Google Analytics, if you allow analytics and we have turned it on, receives page measurements and, when you buy, the items and the amount. It does not receive your name, email or church. The tag does not load until you allow analytics. Google's privacy policy
- Google (Gmail and Google Drive) is our email inbox and how we deliver finished done-for-you files. It receives emails you send us and the files we make for you.
- ImprovMX forwards mail sent to hello@cornerstoneandink.com to our inbox. It receives emails you send us as they pass through. ImprovMX's privacy policy
These services may store data in the United States. If you're outside the US, your information will be transferred to and processed in the US.
Cookies and similar storage
A cookie is a small file a site stores in your browser. We also use your browser's own storage for a few of the same jobs. Strictly necessary storage stays on. Analytics and marketing stay off until you choose them. Nothing in those two categories is pre-ticked.
Before any Google tag can run, we tell Google to deny ad storage, analytics storage, ad user data and ad personalization. We update that signal only after you choose. If Google Analytics is not configured, no Google tag loads at all.
| Name | Category | How long | What it is for |
|---|---|---|---|
| ci_consent | Strictly necessary | 12 months | Remembers your choice, the policy version and an anonymous id. The same record is kept in browser storage. |
| ci-cart-v1 | Strictly necessary | Until you clear site data | Your order, in this browser only. It is not sent to us until you place the order. |
| ci-welcome-popup | Strictly necessary | 30 days | Remembers that you closed the welcome offer, or signed up, so it does not keep appearing. |
| ci-announce-dismissed | Strictly necessary | Until you clear site data | Remembers that you closed an announcement, including the welcome-offer bar. The full name includes which bar. |
| decap_oauth_state | Strictly necessary | 10 minutes | Signs the site owner into the private editor. Visitors don't get this cookie. |
| _ga and ga… | Analytics | Up to 2 years | Google Analytics. Set only after you allow analytics, and only if we have switched it on. |
| Vercel Analytics | Analytics | No cookie | Cookieless page counts. The script loads only after you allow analytics. |
| Stripe cookies | Strictly necessary | Set by Stripe | On Stripe's checkout page, not on ours, so Stripe can take payment and prevent fraud. |
| Marketing pixels | Marketing | None today | We don't run ad pixels. If we add one, it loads only after you allow marketing. |
Our fonts are served from our own site, so loading a page doesn't send your information to a font provider.
Email marketing
The homepage signup, and the gallery list, are how you agree to marketing email. The form says so before you send it. We store the time you agreed and the source (homepage signup or gallery list). Resend delivers those emails.
Each marketing email has an unsubscribe link in the footer. It does not need a login. Opening it shows a confirmation that you are unsubscribed. Mail apps can also unsubscribe in one click from the message itself. Either way, we record that address on a suppression list and skip it for marketing. The footer names Cornerstone & Ink, includes hello@cornerstoneandink.com, and includes our postal address.
Order emails still arrive. Those are receipts, download links, and done-for-you updates about a purchase. They are not on the marketing list, and they do not include the unsubscribe link.
Signing up again on the homepage or the gallery form is a new agreement. That clears the suppression, and marketing email can start again. Joining a coming-soon series list does not. That note is also a list email, and it uses the same unsubscribe link. Using it stops marketing email to that address, including later notes about that series.
Do Not Sell or Share
We don't sell personal information, and we don't share it for cross-context behavioral advertising. We don't rent or trade it.
If we add a marketing pixel later, allowing marketing could count as a "share" under California law. You can turn that off in Cookie settings or Your privacy choices, in the footer.
If your browser sends Global Privacy Control (Sec-GPC or navigator.globalPrivacyControl), we treat that as an opt-out of sale and sharing. Marketing stays off, including if you click Accept all.
Your privacy choices
Use Cookie settings or Your privacy choices in the footer to open the same panel. Accept all, Reject all and Customize have equal weight. You can change the choice any time. We ask again when this policy's cookie version changes, and 12 months after you last chose.
You can also email hello@cornerstoneandink.com to see, correct or delete the information we hold about you. We'll respond within 30 days. We may need to keep some payment records even after a deletion request, because tax law requires it.
How long we keep it
- Order files and logos: 12 months after delivery, then deleted, unless your church asks us to keep them longer.
- Invoices, order and payment records: as long as tax law requires.
- Download links: stop working 7 days after purchase; your order record is kept with the payment records.
- Email signup info: while you are on the list. After you unsubscribe we keep the address and the date, so marketing email does not start again unless you sign up on the homepage or gallery form.
- Cookie choice in your browser: 12 months.
- Our copy of that choice: 24 months, then deleted. It has no IP address.
- Emails you send us: as long as we need them to help you, and no longer than 3 years.
How we protect it
Our database and download files are private and can only be reached by our own website's server. Download links are signed, expire, and can only be used a limited number of times. We use strong passwords and two-step sign-in on the services listed above. No system is perfectly secure, but if we ever learn your information was exposed, we'll tell you promptly.
Children
This site is intended for adults and church staff. It isn't directed at children under 13, and we don't knowingly collect their information. If you think a child has sent us information, email us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change affects how we use information you've already given us, we'll email you first. A new cookie version asks for your choice again.
Contact
Cornerstone & Ink · hello@cornerstoneandink.com
Questions about this policy? Email hello@cornerstoneandink.com.