Privacy Policy

1. Who we are and how to reach the desk

Tyrs Treat Trove LLC is a computer integrated systems design business that also operates a curated candy keepsake studio and a small trove room. For the purposes of data protection law, the company is the controller of the personal information described in this policy. The company name in full is Tyrs Treat Trove LLC. The postal address recorded with the business registry is Huntington - 84528, United States (US). No physical street line is published by the registry, and the company does not claim a street line beyond the address shown on this page.

The front door of the business is the desk. The desk answers emails sent to bookings@tyrstreattrove.mom and calls placed to +18047013712 during the business hours published on the contact page. A written privacy request can be sent to the email address at any time, day or night, and the desk will acknowledge it within two working days. A caller who prefers the telephone may leave a short message and the desk will return the call within one working day. The desk keeps a plain record of every privacy request so that a request cannot be lost between conversations.

The company does not appoint a separate data protection officer, because the scale and the nature of the processing do not require one. Instead, privacy questions are handled by the same person who runs the trove desk, which keeps the answer practical. If a request needs more time than the standard reply, the desk explains the reason and gives an expected date.

2. The scope of this policy

This policy covers information that Tyrs Treat Trove LLC collects through the public website, through the contact form, through email and telephone conversations, through booking records, through the trove room during a fitting, and through the audit notes that follow a booking. It does not cover information that a client chooses to share with a fourth party on the client side, nor does it cover the practices of any other company.

The website is a set of static pages. It does not require an account, it does not run a login system, and it does not build a profile of a reader across visits. The only interactive element on the public pages is the contact form, which prepares an email in the device of the visitor and sends that email to the desk through the email application that the visitor already uses. The form does not transmit the message to a server owned by the company before the visitor presses send in the email application.

Where a page links to another site, that other site applies its own privacy policy. This policy stops at the point where a visitor leaves the company pages. Section 19 repeats this point and gives the visitor a simple rule for reading any linked page.

3. Information you give us directly

The desk receives personal information only when a person chooses to send it. The categories below are the ones that appear most often in real enquiries.

• Identity and contact details, including a first name, a last name, an email address and a telephone number.
• Booking details, including a preferred date, a preferred service window, an approximate drawer size and the number of guests expected.
• Content of a message, including a question about a shelf plan, a description of a keepsake theme, or a note about an allergy or a dietary requirement.
• Names submitted for printing, including the names of guests who will receive a keepsake box.
• Business details for a studio or an organisation that books under a company name, such as a billing contact and a purchase order reference.
• Photographs that a client sends of a drawer, a room or a sample box, which the desk uses to prepare a fitting plan.
• Payment references, such as the last four digits of a card number or a bank transfer reference, which arrive with a payment notice but which are not stored in full by the company.

The desk asks only for what a booking needs. A person who writes merely to ask a general question is not asked for a postal address, a date of birth or an account password. The company never asks for a password of any kind, and no member of staff will ever request one by email, by telephone or in person.

4. Information collected automatically

The web hosting provider that serves these pages records standard technical logs when a visitor requests a page. Those logs normally contain the internet protocol address of the request, the date and time of the request, the address of the page requested, the address of the page that referred the visitor, the browser type and the operating system family. The company uses these logs to keep the site running, to diagnose an error and to defend against abusive traffic.

The logs are technical records, not a marketing profile. The company does not merge a log line with a name from a booking, and it does not use the logs to reconstruct a reading history. A hosting provider may retain logs for a short period as part of its normal service, and the company has no control over the length of that retention beyond the contract it holds with the provider. Section 12 explains how the company treats its own copies of records, and section 9 explains the role of service providers.

The website does not use a third party analytics product to watch a reader. If the company later adds a measurement tool, the tool will be described on this page, the lawful basis will be stated, and a reader will be able to refuse the measurement without losing access to the pages.

5. Information from bookings and the trove room

A fitting session produces a cabinet plan. The plan records the measurements of the drawer, the shelf count, the color story and the booking windows that the client selects. The plan is a work record. It helps the desk to keep a promise across months and to avoid asking a returning client to repeat the same measurements.

During a keepsake box week, the desk records the plate register, the proof approvals and the date closes of the week. During a party stash day, the desk records the load plan and the refill counts. During a restock audit evening, the desk records the audit note with its numbered findings. These records belong to the booking, and they are kept for the period described in section 12.

The trove room is a working space. The company does not install a camera that records a client without a stated purpose, and it does not record a conversation with a client without a written note of consent. A photograph taken inside the room during a booking shows the cabinet rather than the client, and the desk will not publish a photograph that identifies a person without a separate written permission. A guest who does not want to appear in any photograph can simply say so at the door, and the desk will place a marker on the room sheet for the day.

6. How we use the information

Tyrs Treat Trove LLC uses personal information for a small number of stated purposes. Each purpose below is tied to a real task that a booking requires, and the company does not use a booking record for an unrelated purpose without asking first.

• To reply to an enquiry and to answer a question about a service window.
• To prepare, confirm and deliver a fitted booking, including a cabinet plan and a key tag.
• To run a keepsake box week, a party stash day, a tasting shelf session or a restock audit evening.
• To take payment, to issue a receipt and to keep the accounting records that the law requires.
• To keep a client informed about a change to a confirmed booking, such as a moved window or a supply delay.
• To protect the business against fraud, chargebacks and abusive messages.
• To improve the service by reading the pattern of questions that the desk receives, using aggregated notes rather than individual profiles.
• To comply with a legal obligation, a court order or a lawful request from a public authority.

The company does not sell personal information. The company does not rent a contact list. The company does not provide a booking record to a data broker. Where the company shares information with a service provider, the sharing is limited to the task described in section 9 and the provider is bound to use the information only for that task.

7. Legal bases for processing

Where the General Data Protection Regulation or a similar law applies, the company relies on the following legal bases. Each basis corresponds to a type of task described in section 6.

Contract and steps before a contract

The company processes the information needed to reply to an enquiry and to create a booking, because those steps happen before and during a contract with the client. This basis covers the cabinet plan, the booking dates, the proof approvals and the delivery record.

Legal obligation

The company processes the information needed to keep accounting records, to evidence a sale and to respond to a lawful request from a public authority. This basis covers receipts, invoices and the minimum bookkeeping trail that the law sets.

Legitimate interests

The company processes technical logs and a limited set of booking notes because it has a legitimate interest in keeping the site available, in protecting the business and in understanding how a service actually runs. The company weighs that interest against the rights of the individual and applies a narrow test before relying on it. A person may object to this basis at any time using section 14.

Consent

The company asks for consent before it sends a newsletter, before it publishes a photograph that identifies a person and before it records a client conversation. Consent can be withdrawn at any time. Withdrawal does not affect processing that happened before the withdrawal.

8. Cookies and similar technologies

The public pages are built as static documents and do not set a tracking cookie of their own. A hosting provider may set a small technical cookie to route a request or to balance traffic across servers. A technical cookie of that kind does not identify a reader and is not used for advertising.

The company does not run an advertising pixel, a cross-site identity tag or a session recording tool on these pages. If the position changes, this section will be rewritten and a simple refusal control will be offered before the first non-essential tag loads. A reader who blocks cookies in the browser will still be able to read every page and to use the contact form.

A browser may store a small amount of local data when a form field is filled. That storage belongs to the device of the visitor and is managed by the browser. The company cannot read that local data, and the visitor can clear it at any time through the browser settings.

9. Sharing information with service providers

Tyrs Treat Trove LLC uses a small number of providers to run the business. Each provider receives only the information that its task needs, and each provider is expected to protect that information and to use it only for the stated task.

• The hosting provider that serves the website and stores its technical logs.
• The email provider that carries a message between the desk and a client.
• The payment processor that handles a card payment and returns a receipt reference.
• The accounting service or bookkeeper that keeps the financial records of the company.
• A printing or engraving partner that produces a brass plate or a proof from a submitted name list.
• A courier or delivery partner where a completed order must travel to a client address.
• A professional adviser, such as a lawyer or an accountant, where a specific matter requires advice.

A provider acts on the instructions of the company. The company does not authorise a provider to sell the information or to use it for its own marketing. Where a provider is outside the country of the company, section 17 explains how the company protects a transfer.

The company may also disclose information where the law requires it, where a court orders it, or where disclosure is necessary to protect the safety of a person or the rights of the business. In that situation the company discloses the minimum amount that satisfies the requirement and, where it is lawful, tells the affected client that a disclosure has happened.

10. Payments and financial information

Card payments are handled by a payment processor. The company does not store a full card number, a security code or a bank password. The processor returns a transaction reference, a last four digit fragment and an amount, and the company keeps those fragments with the booking so that a receipt can be matched to an order.

Where a client pays by bank transfer, the company keeps the transfer reference, the amount and the date. A bank statement line is a financial record and is retained for the period that the bookkeeping law requires. Any document that contains a full account number is stored in a restricted folder, and access to that folder is limited to the person who keeps the books.

A client should never send a card number or a security code in an email message or through the contact form. If a message of that kind arrives by mistake, the desk deletes it and replies with a safe payment instruction instead of using the number.

11. Keepsake records and guest lists

A keepsake booking often involves a list of guest names. The client who supplies the list is responsible for having a lawful reason to share those names with the company. The company receives the list for one purpose, which is to print a plate or to label a box, and it does not use the list for marketing or for any other booking.

The desk keeps a proof register so that a spelling can be confirmed before a plate is fixed. The proof register holds the submitted names, the approval date and a note of any correction. Once the booking is closed and the plate is delivered, the proof register is retained only for the period described in section 12, after which it is deleted in a routine clean-up.

A guest who wants a name removed from a list can contact the desk. The desk will ask the booking holder to confirm the change, because the guest list belongs to the booking holder, and will then remove the name from the working register. A name that has already been engraved on a delivered plate cannot be removed from the physical object, and the company explains this limit at the time of the request.

12. How long information is kept

The company keeps information only for as long as a task or a legal rule requires. The periods below are the current standard periods, and they are reviewed once a year.

• An enquiry that does not become a booking is kept for twelve months, so that a returning question can be answered without starting over, and is then deleted.
• A booking record, including the cabinet plan, the load plan and the audit note, is kept for three years after the last invoice on the account.
• A financial record, including a receipt and an invoice, is kept for the period that the tax and accounting law requires, which is normally seven years for a business record.
• A proof register for a printed plate is kept for six months after delivery and is then deleted in the routine clean-up.
• A technical log held by the hosting provider is kept under the provider standard retention, which is normally a short period of days or weeks.
• A message that contains a privacy request is kept for two years as evidence that the request was handled.

When a period ends, the record is deleted or, where a record forms part of a legal claim or a legal obligation, it is moved to a restricted archive that only the person handling the matter can open. A record is never kept simply because a clean-up is inconvenient.

13. Security measures we maintain

The company uses technical and organisational measures that match the size of the business. Email accounts are protected by a long password and a second factor where the provider supports one. Devices that hold booking records are protected by a screen lock and by full disk encryption. Paper proof registers and printed plans are kept in a locked drawer in the trove room and are removed when the booking closes.

Access to a booking record is limited to the person who runs the desk and, where a plate is printed, to the printing partner for the single job. A member of staff who leaves the business loses access on the last working day. The company reviews its providers once a year and drops a provider that cannot show a reasonable security practice.

No system is perfectly secure. If a breach affects personal information, the company will assess the risk, notify the affected people and the relevant authority where the law requires it, and record the incident and the corrective steps in a plain internal note. The company would rather report a small incident early than wait for a large one.

14. Your rights and choices

Depending on where a person lives, the law gives a set of rights over personal information. The company honours the following rights for every client and every visitor, without asking for a legal citation first.

• The right to know whether the company holds personal information about you and to receive a copy.
• The right to correct an error in a name, an address, a spelling on a plate proof or a booking date.
• The right to delete information, where no legal rule requires the company to keep it.
• The right to restrict the use of information while a question is being resolved.
• The right to object to a use that relies on legitimate interests.
• The right to withdraw consent, where a use relies on consent.
• The right to receive information in a portable format, where the law provides for portability.
• The right not to be treated unfairly for exercising any of these rights.

To exercise a right, write to bookings@tyrstreattrove.mom with the request and a way to confirm identity. The desk does not ask for a copy of a passport for a simple request. A short reply from the email address on file is enough in most cases. The company answers within one month and explains any extension before the month ends. No fee is charged unless a request is clearly unfounded or repetitive, and the company explains the reason before it charges anything.

15. Privacy for children

The trove cabinet is a service for adults. The company does not knowingly collect personal information from a child under thirteen years of age, and it does not ask for a date of birth at the desk. A booking may involve children as guests, in which case the adult who books supplies any name that a plate needs, and the company treats that name as part of the booking record described in section 11.

If a parent or a guardian believes that a child has sent personal information to the desk without adult knowledge, the parent or guardian can contact bookings@tyrstreattrove.mom and ask for the information to be deleted. The desk will verify the relationship in a proportionate way, delete the information and confirm the deletion in writing. The same rule applies to a photograph that shows a child and that was posted by mistake.

16. Communication preferences and marketing

A message about a booking is a service message. The desk may send a confirmation, a reminder, a proof approval and an audit note without a marketing consent, because those messages carry out the booking that the client asked for. A client cannot opt out of a message that is needed to deliver a confirmed window without also ending the booking.

A newsletter or a seasonal note is marketing. The company sends marketing only where the recipient has asked for it, and every marketing message carries a simple way to stop. A request to stop is processed within two working days. The company keeps a short suppression note so that the same address is not added again by accident.

A person may also ask the desk to reduce the number of service messages, for example by requesting a single reminder instead of a reminder at each stage. The desk will record the preference on the booking and follow it wherever it does not conflict with a safety message.

17. International visitors and data location

The company is based in the United States, with contact details at Huntington - 84528, United States (US). A visitor from another country should understand that a message sent to the desk travels to the United States, where the privacy law may differ from the law of the visitor country. The company answers a visitor from the European Economic Area, the United Kingdom or another jurisdiction in the same way, and it applies this policy to every visitor regardless of location.

Where a provider stores information in another country, the company uses a provider that offers an appropriate safeguard, such as a standard contractual clause or an equivalent mechanism, and it reviews that safeguard when the provider contract is renewed. A client may ask which safeguard applies to a particular transfer, and the desk will answer in plain terms.

18. Automated decisions and profiling

The company does not make an automated decision that produces a legal or similarly significant effect for a person. The desk does not use a scoring model to decide whether to accept a booking, and it does not use a profile of a visitor to set a price.

A pricing band for a service depends on the shelf count, the wrapper finish and the length of the window, and the desk calculates it from the cabinet plan during a conversation. A client can ask how a band was reached and will receive a line by line explanation in the reply.

The only automated process on the site is the scroll reveal on the public pages, which shows a section as a reader moves down the page. That process runs in the browser of the visitor, does not collect information and does not send a signal to the company.

19. Third party links and services

A page on this site may link to a map service, a payment page, a printing partner or a social page. Those services are run by other companies and are governed by their own privacy policies. The company does not control the information that another company collects when a visitor follows a link.

A visitor who follows an external link should read the privacy notice of that service before entering a name, a card number or a message. Where the company relies on a payment processor, the payment page belongs to the processor and the notice on that page explains how the processor handles the card details. The company receives only the confirmation and the fragment described in section 10.

20. Changes to this policy

The company reviews this policy once a year and whenever a new service or a new provider changes the way information is handled. A material change is published on this page with a new effective date, and a client with a booking in progress receives a short note about the change by email.

A small correction to a spelling or to a contact detail does not require a notice to every client, but the effective date is updated so that a reader can see that the page has changed. The company keeps the previous version of the policy for two years so that a question about an older practice can be answered.

A reader who does not agree with a change may stop using the site and may ask for the deletion of information that is not needed for a legal record. The rights in section 14 continue to apply after a change.

21. How to make a complaint

The company would like the chance to fix a problem before a formal complaint is made. A person who is unhappy with the handling of personal information can write to bookings@tyrstreattrove.mom with the word complaint in the subject and a short description of what went wrong. The desk acknowledges within two working days and answers within twenty working days with a decision and a reason.

A person who lives in a jurisdiction with a data protection authority may also complain to that authority. The company will cooperate with a lawful investigation and will provide the records that the authority requests. Making a complaint to an authority does not affect the service that a client receives from the trove desk.

22. Contact details for this policy

The controller for this policy is Tyrs Treat Trove LLC, with a postal address at Huntington - 84528, United States (US). The privacy desk is reachable by email at bookings@tyrstreattrove.mom and by telephone at +18047013712. The business hours are published on the contact page, and a message sent outside those hours is read on the next working day.

This policy is published by Tyrs Treat Trove, the developer and business publisher of this website, and the company name in full is Tyrs Treat Trove LLC. Please include the words privacy request in the subject line of an email so that the message reaches the right folder without delay.