Privacy Policy

1. Who we are

PunnyPanda ("we", "us") is a print-on-demand apparel shop at punnypanda.com. This policy covers the public storefront, checkout, and related customer support. It does not replace the privacy terms of the payment and fulfillment partners we use (PayPal and Printify). PunnyPanda operates the store and creates the storefront and product content. When you buy, you pay through PayPal; PayPal handles the transaction, applicable taxes, receipts, and payment-related compliance.

Questions about this policy: hello@punnypanda.com. That address is the default support email in our store settings.

2. Information we collect

Depending on how you use the shop, we may process:

• Order details. Name, email, shipping address, and the items, sizes, and colors you buy. We collect these so we can take payment, print your shirt, and ship it.
• Cart contents. Your bag is stored in your browser's local storage (not on our servers) so it can survive a refresh. Clearing site data empties the cart.
• Newsletter signup. If you join the Panda Club form in the footer, we collect the email you enter so we can send updates, drops, and the occasional dad joke. You can opt out by emailing us.
• Email signup. If you use the email form, we store the email address you enter, the page you signed up from, and campaign parameters that were already in the address bar. We use that to send the current first-order offer, when one is available, and occasional shop notes. You can opt out by emailing us.
• Support messages. Whatever you send to hello@punnypanda.com (order ID, photos of a print issue, and so on).
• Hosting logs. The site is hosted on Vercel. Standard request logs (such as IP address, user agent, and timestamps) may be generated as part of running the app. We do not copy those logs into our own store, and we do not keep your IP or country code for analytics.
• Region bucket. Our host may include a country code on the request. We reduce that to a first-party cookie named pp_region with one of four values: eea (EEA, the UK, and Switzerland), us, row (rest of the world), or unknown. We do not store the country code itself. The cookie only picks the analytics and ads default described below. The page HTML is the same for every region.
• Analytics and ads usage. When Google tags are allowed, public pages can send page views and general usage (which pages are opened, and how people move through the shop) to Google. The same allowed state covers Google's analytics storage, ad storage, ad user data, and ad personalization. The admin area is not included. We do not load a Meta pixel.

We do not ask you to create a customer account to shop. Payment card details are entered in PayPal's checkout, not stored by PunnyPanda.

3. How we use information

• Process and fulfill orders (print, pack, and ship via Printify).
• Charge you through PayPal, including applicable sales tax or VAT that PayPal calculates.
• Send order and shipping updates.
• Handle reprints and refunds.
• Reply to support mail and keep a record of the request.
• Email newsletter subscribers, if you opted in via the footer form.
• Email people who asked for shop notes, if you opted in through the email form.
• Keep the store secure and debug checkout or fulfillment issues.
• See which public pages people open and how they move through the shop, when the four Google signals are granted. In the EEA, the UK, Switzerland, and when we cannot tell the country, all four stay denied until you accept. Accept then grants analytics storage, ad storage, ad user data, and ad personalization. In the United States and the rest of the world all four start granted unless you opt out.
• Count a completed purchase, and a later refund of that purchase, in Google Analytics from our server only when those signals are granted. If you rejected, used Do Not Sell or Share, have Global Privacy Control on, or are in the EEA, the UK, Switzerland, or an unknown country and have not accepted, we do not send that purchase or refund event. Global Privacy Control counts as denied even if you accepted earlier. If the order has no stored consent record (for example, an order placed before we stored one), we do not send the refund event. Fulfillment keeps the choice on the order when it updates the order note.
• Count store visits, cart adds, and checkout starts on our own admin funnel, using a random browser id.

4. Who we share information with

We don't sell your data to data brokers. Outside Europe, we share limited browsing data with Google for analytics and ads unless you opt out.

• PayPal is our payment processor. The customer pays through PayPal, which receives the customer and transaction information needed to take payment, calculate and remit applicable taxes, issue receipts, and handle payment-related compliance. PunnyPanda remains responsible for this storefront, its product content, customer support, and fulfillment coordination. Their processing is also subject to PayPal's privacy policy.
• Printify prints and ships each made-to-order item through its print-provider network. After payment, we send Printify the shipping name, address, email, and line items so they can produce and deliver the order. See Printify's privacy policy.
• Vercel hosts this Next.js app. They may process technical request data as part of serving the site.
• Google, when the four signals are granted (you accepted, or you are in the United States or the rest of the world and have not opted out, and Global Privacy Control is off). On public pages we can then send page views and general usage to Google. That granted state allows analytics storage, ad storage, ad user data, and ad personalization. If any of those signals is denied, the Google script does not load, and we do not send a cookieless ping in its place. The admin area is not included. See Google's privacy policy.

We may also disclose information if required by law, or to protect customers, our store, or others from fraud or abuse.

5. Cookies and similar storage

• Shopping cart. Saved in local storage under a PunnyPanda key so your bag persists in this browser.
• Admin session cookie. Store operators who sign into /admin receive an HTTP-only session cookie. Shoppers never get this cookie.
• PayPal checkout. Completing payment may set cookies or similar storage belonging to PayPal so the transaction can complete securely.
• Region. A first-party cookie named pp_region stores eea, us, row, or unknown for one day. We write it when it is missing or the region bucket changes. It is not HTTP-only. It does not store a country code or an IP address.
• Analytics and ads choice. A first-party cookie named pp_ga_consent remembers an explicit choice (granted or denied) for up to a year. That choice overrides the region default on later visits. It does not override Global Privacy Control. Closing a notice does not change it.
• Global Privacy Control. If your browser sends Global Privacy Control, all four signals stay denied, including when pp_ga_consent is already granted. We store a first-party cookie named pp_consent_via with the value gpc so checkout can see the signal. We do not erase your earlier Accept. While the signal is on, the page says it was honored and does not offer Accept. When the signal is off, that marker is cleared and your stored choice applies again. In every region, including the EEA, the UK, Switzerland, and an unknown country, the signal wins over the banner.
• Notice dismissal. Closing the United States, rest-of-world, or Global Privacy Control notice stores a first-party cookie named pp_consent_notice with the value 1 for up to a year. That only hides the notice. The footer Do Not Sell or Share My Personal Information link still opts out.
• Google tags. The script loads only when the four signals are granted. Google may then set its own cookies. We do not load it on the admin area, and we do not load a Meta pixel. While the signals are denied, we do not send cookieless pings.
• Shop funnel. Public pages set a first-party HTTP-only cookie named punny_vid. It is a random id so we can count visits, cart adds, and checkout starts for the store team. It is not your name or email, and we do not send it to an advertising network.

6. How long we keep it

Order records (customer, items, payment status, Printify fulfillment status) are kept so we can fulfill the order, handle a reprint or refund, and meet tax or bookkeeping needs. The order record also stores the analytics choice, the region bucket, and whether Global Privacy Control was on when checkout started, so a later purchase or refund report can follow that choice. Fulfillment keeps those fields when it updates the order note. A purchase or refund report is not sent when that Global Privacy Control flag is set, when the choice was denied, or when the order has no stored consent record (for example, an order placed before we stored one). Cart data lives only in your browser until you clear it. Shop funnel counts are kept for the admin dashboard and are tied to the random browser id, not to your name. Support emails are kept as long as needed to resolve the request. pp_region lasts one day from the time we write it. pp_ga_consent lasts up to a year unless you clear it. pp_consent_via lasts up to a year while Global Privacy Control is on and is cleared when the signal is off. pp_consent_notice lasts up to a year.

7. Your choices and rights

Where we ask first (the EEA, the UK, Switzerland, and when we cannot tell the country), a banner offers Accept and Reject at the same size and the same style. Nothing is pre-ticked. All four signals stay denied until you accept. Accept grants analytics storage, ad storage, ad user data, and ad personalization. Reject sets all four to denied.

In the United States and the rest of the world, all four signals are granted unless you opt out. A short notice, and the footer, include Do Not Sell or Share My Personal Information. Choosing it sets all four signals to denied and stores that choice for up to a year. You can close the notice without changing that choice. The footer link remains.

If your browser sends Global Privacy Control, that signal wins. All four signals are denied even if you had already accepted. The notice says the signal was honored. We do not offer a way to accept again while the signal is on. You can close that notice. Closing it does not turn the signals back on.

To change a choice when Global Privacy Control is off, use the footer link to opt out, or clear the pp_ga_consent cookie and reload the shop so the banner or notice can show again. You can also email hello@punnypanda.com.

You can ask us to access, correct, or delete personal information we hold, or to stop newsletter mail, at the same address. Depending on where you live, you may have additional rights under local law. We will need enough detail (for example an order ID) to find your record. We cannot delete information we are legally required to keep.

We do not claim a privacy certification. We have not published a registered office or a formal operator identity in store settings.

8. Children

The store is not directed at children under 13, and we do not knowingly collect personal information from them. If you think a child has sent us data, email hello@punnypanda.com and we will delete it where we can.

9. International transfers

PayPal, Printify, Vercel, and their print partners may process data in the United States and other countries. When the four Google signals are granted, Google may process that usage data in other countries as well. By ordering, you understand your information may cross borders so we can print and ship globally.

The country code used to choose the consent default is read from the host request and reduced to the pp_region cookie. We do not keep that country code on the order beyond the four-value bucket stored with the analytics choice and the Global Privacy Control flag.

We have not published a registered office or formal operator identity in store settings. For location-specific privacy questions, contact us at hello@punnypanda.com.

10. Changes

If we change how we collect or use data in a material way, we will update this page and the "Last updated" date. The Terms of Service and Refund Policy are part of shopping with us as well.