Final Legal Draft | August 8, 2026 | Complete bracketed business details before publication.
vintage.mcautumn.us
McAutumn LLC, a New York limited liability company (“McAutumn,” “Seller,” “we,” “us,” or “our”), operates McAutumn Vintage. Principal business address: [BUSINESS ADDRESS — TO BE COMPLETED]. Privacy contact: [PRIVACY EMAIL — TO BE COMPLETED].
This Policy describes personal information processed when you visit the Website, communicate with us, purchase or receive Products, make a return/condition claim, or interact with fraud, payment, shipping, customs, insurance, or dispute-resolution processes.
Depending on the interaction, we may collect:
• identity and contact data, such as name, email, phone, billing/shipping address, and account identifiers;
• transaction data, such as order history, Product, price, payment status, refunds, shipping, tax/customs information, and communications;
• payment-related data supplied by processors, such as payment token, card type/last digits, authorization, fraud indicators, and transaction identifiers; we do not need to store full card numbers where a payment processor handles them;
• Website/device data, such as IP address, browser, device, approximate location, referral, logs, session/cart identifiers, and cookie/local-storage data;
• legal acceptance records, including policy version, click-wrap timestamp, session/order identifier, IP/device data, and records showing disclosures presented before purchase;
• Product/claim evidence, including photographs, video, Security Device identifiers, condition maps, package/return images, carrier delivery data, signatures where available, and records used to identify the physical Product returned;
• fraud/security data, including risk signals, suspicious transaction patterns, failed payment attempts, chargeback history related to our transactions, and records of confirmed product substitution or return abuse;
• information voluntarily submitted in support, authenticity, return, privacy, or legal requests; and
• lawful information received from service providers, carriers, payment networks, fraud-screening tools, public sources, sanctions lists, or authorities.
We seek to avoid collecting unnecessary sensitive information. We may process identity or other information necessary for fraud prevention, sanctions/export compliance, customs, legal claims, or payment verification when lawful.
We may process information to:
(a) operate, secure, maintain, and troubleshoot the Website;
(b) form and perform purchase contracts, process payments, ship Products, provide customer service, and administer claims;
(c) document the condition and identity of one-of-a-kind Products before shipment and on return;
(d) prevent, detect, investigate, and respond to fraud, product substitution, theft, false non-delivery claims, abusive chargebacks, Security Device tampering, and misuse of contractual return procedures;
(e) verify identity, payment, address, sanctions/export eligibility, and transaction risk;
(f) defend or pursue legal claims, arbitration, chargebacks, insurance, carrier claims, tax/audit matters, and contractual rights;
(g) satisfy accounting, tax, customs, recordkeeping, consumer-protection, court, regulatory, and law-enforcement obligations;
(h) measure Website performance and, where lawfully enabled, analytics or marketing effectiveness; and
(i) protect customers, Seller, service providers, and the public from unlawful activity.
Where the GDPR or UK GDPR applies, the legal basis may include performance of or steps toward a contract; compliance with legal obligations; legitimate interests such as transaction security, fraud prevention, record integrity, legal-claim defense, customer support, and improvement of the Website; consent where required; and establishment, exercise, or defense of legal claims.
When we rely on legitimate interests, we intend to balance those interests against applicable individual rights and reasonable expectations. Consent may be withdrawn where processing is based on consent, without affecting prior lawful processing.
We may disclose relevant information to payment processors, card networks, banks, fraud-prevention providers, identity/compliance providers, shipping carriers, freight providers, insurers, customs brokers, tax/accounting professionals, hosting/IT providers, analytics providers where enabled, lawyers, arbitrators/mediators, courts, government authorities, law enforcement, and other service providers reasonably necessary for the purposes described above.
We may share transaction evidence in good faith to contest a chargeback or fraudulent claim. We do not authorize a service provider to use customer data for unrelated purposes merely because it receives data from us; provider use remains subject to contract and applicable law.
If the business is sold, reorganized, merged, or transfers relevant assets, information may be transferred as part of that transaction subject to applicable law.
We do not sell customer lists for money. Some U.S. state laws define “sale,” “sharing,” or targeted advertising more broadly and may apply to certain advertising or analytics disclosures if such technologies are enabled and statutory thresholds are met. Where legally required, we will provide the applicable opt-out method and honor legally required opt-out preference signals.
Use of cookies, localStorage, pixels, tags, and similar technologies is described in the Cookie Policy. Strictly necessary technologies may be used for security, cart/checkout, legal acceptance records, fraud prevention, language/session settings, and core functionality. Non-essential technologies will be handled according to applicable consent/opt-out rules.
We have a legitimate business need to preserve reliable records of our own transactions, especially for one-of-a-kind Products. Subject to applicable law, records may be used to distinguish a returned Product from a substituted Product; establish pre-shipment condition; verify Security Devices; detect repeated false claims; and defend payment disputes.
We do not promise that a customer can erase records that we are legally entitled or required to retain for accounting, tax, fraud prevention, safety, legal claims, chargeback defense, or compliance. We will not use fraud-prevention records as a pretext for unlawful discrimination or retaliation against a person who exercises a lawful consumer/privacy right in good faith.
Retention depends on purpose, legal obligations, transaction value, dispute/chargeback windows, tax/accounting requirements, limitation periods, fraud risk, and the need to establish or defend legal claims. Some transaction and legal-acceptance records may be retained for years after an order. Security/fraud records may be retained for a period reasonably necessary to protect the business and customers, subject to applicable law and periodic relevance review.
When information is no longer reasonably required, we may delete, de-identify, or aggregate it, subject to technical backup cycles and legal holds.
Information may be processed in the United States and other countries. Where GDPR/UK GDPR or another law requires a transfer mechanism, we will use an applicable lawful mechanism, such as adequacy arrangements, Standard Contractual Clauses, the UK International Data Transfer Addendum/Agreement, or another legally permitted safeguard, as applicable to the provider and transfer.
Depending on residence, applicable statutory thresholds, and exemptions, you may have rights to request access, correction, deletion, portability, categories/sources/purposes, or to opt out of certain sale/sharing/targeted-advertising/profiling activities. Some information may be exempt or may be retained because the law permits retention for completing transactions, fraud/security, legal obligations, or legal claims.
Where required, we will authenticate requests and provide appeal or authorized-agent procedures. We will not unlawfully discriminate against a person for exercising an applicable privacy right.
Where applicable, you may have rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and complaint to a supervisory authority. These rights are subject to statutory conditions and exceptions, including legal obligations and the establishment, exercise, or defense of legal claims.
We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the business and information. No system is completely secure. Customers are responsible for securing their email, devices, account credentials, and payment credentials and for promptly reporting suspected compromise affecting a transaction.
The Website and Products are intended for adults. We do not knowingly solicit purchases from persons under 18. If we learn that personal information of a child was collected in a manner requiring deletion or parental authorization under applicable law, we will take appropriate action.
Third-party payment, shipping, social, embedded, or linked services may process information under their own privacy terms. Their independent processing is outside our control, although our disclosures to service providers remain subject to our obligations under applicable law.
We may update this Policy prospectively. The “last updated” date will identify the current version. A material change will be presented or notified where applicable law requires. Changes do not retroactively eliminate rights attached to a completed transaction.
Privacy requests: [PRIVACY EMAIL — TO BE COMPLETED]
Legal notices: [LEGAL NOTICE EMAIL — TO BE COMPLETED]
Business address: [BUSINESS ADDRESS — TO BE COMPLETED]