Skip to main content

Privacy Policy

Privacy Policy

Plain English. What we collect, why, who sees it, how we protect it, and what you can ask us to do with it.

Who Fenfair is

Controller

Fenfair (operated by Fenfair LLC, principal address 12700 Donahoo Rd, Kansas City KS 66109) is the controller of personal information collected through fenfair.com and the seller workspace. For privacy questions or to exercise rights described below, email legal@fenfair.com.

What we collect

Information Fenfair collects.

  • Account information: email, name, signup timestamp, authentication identifiers (via our identity provider Clerk).
  • Shop information: store name, brand kit, products, media uploads, custom domain configuration.
  • Business operations: orders, quote requests, proofs, shipments, materials inventory, customer messages.
  • Payment information: handled by Stripe; we receive a tokenized reference, never card data.
  • Technical signals: IP address (transient), user agent, page-load performance, error reports.
  • Communications: emails you send us, support tickets you submit.

What we do not collect

Categories Fenfair does not collect.

  • Biometric data
  • Health data
  • Geolocation beyond approximate region from IP
  • Tracking pixels on third-party sites
  • Cross-site behavioral profiling for advertising

Why we collect it

Lawful basis.

  • Contract performance: to provide the shop builder, storefront hosting, payments, marketing automation, and analytics you signed up for.
  • Legitimate interests: detecting fraud and abuse, improving the product, sending essential service emails.
  • Consent: marketing communications you opt into (newsletter, training content).
  • Legal obligations: tax recordkeeping (orders retained for IRS minimum 7 years), responding to lawful requests.

Who sees it

Subprocessors.

Fenfair shares personal information with carefully selected service providers under data processing agreements. See /subprocessors for the current list. Categories include hosting (Vercel), database (Neon), authentication (Clerk), email delivery (Resend), payments (Stripe), file storage (Cloudflare R2), shipping integrations (Shippo).

How long we keep it

Retention windows.

  • Account + business records: as long as your account is active, plus 30-day grace window after closure, then hard-deleted (except retained financial records per US tax law, 7 years).
  • Buyer PII collected by your shop (customer addresses, subscriber emails): retained as long as relevant to your business; scrubbed on account closure.
  • Technical logs (IP, errors): 90 days rolling.
  • Communications + support tickets: 24 months.

International transfers

US-based processing.

Fenfair is a US-based service. Data is stored on US infrastructure. If you access Fenfair from outside the US (including the European Economic Area, United Kingdom, or Switzerland), your information is transferred to and processed in the United States. Where applicable, Fenfair relies on Standard Contractual Clauses for international transfers.

Your rights

GDPR, CCPA, and state-law rights.

  • Access: request a copy of personal information we hold about you. Use /settings/account"Download your data" for self-service.
  • Deletion: request erasure. Use /settings/account"Close my Fenfair account" for self-service. Note: financial records retained per US tax law are exempt.
  • Correction: update inaccurate information from /settings/account.
  • Portability: download in machine-readable format via the same export tool.
  • Restriction / objection: contact legal@fenfair.com.
  • California residents: under CCPA you have the additional right to opt out of sale or sharing. Fenfair does NOT sell or share personal information for cross-context behavioral advertising.
  • Children: Fenfair is not directed at users under 16. We do not knowingly collect information from children.

Cookies and similar technologies

Strictly necessary cookies and privacy-safe analytics.

Fenfair uses strictly-necessary cookies for authentication, security, and load balancing. We use Vercel Analytics, which collects anonymized pageview and performance data without identifying individuals. We do not use third-party advertising trackers or cross-site behavioral analytics.

Data breaches

Breach notice.

We will notify affected users within 72 hours of confirming a personal data breach where there is a risk to your rights or freedoms, in accordance with applicable laws. Status updates will be posted at /status/public during any active incident.

How to contact us

Privacy questions, requests, or complaints.

Email legal@fenfair.com for any privacy question, request, or complaint. We respond within 30 calendar days. You may also lodge a complaint with your local data protection authority.

Changes to this policy

Policy updates.

We will post material changes to this page at least 30 days before they take effect, and notify active sellers by email. Last updated: 2026-06-05. Previous versions are available on request.