Privacy Policy — White Cloud Flutes

White Cloud Flutes ("we," "us," or "our") respects your privacy. This policy explains what we collect, why, how we use and share it, and the choices and rights you have. It applies to whitecloudflutes.com and to orders you place with us, wherever in the world you live.

Who we are

White Cloud Flutes is an independent instrument workshop based in San Francisco, California, USA, and the controller of your personal information. For any privacy question or request, reach us through our contact page — a real person will help.

Information we collect

Information you give us. When you place an order, subscribe to our journal, ask to be notified when a flute is back in stock, leave a review, or send us a message, we collect details such as your name, email address, shipping and billing address, phone number (if you provide one), your order, and whatever you choose to write to us.

Payment information. Card payments are processed by Square. Your full card details are entered directly with Square and are never stored on or seen by our servers.

Information collected automatically. Like most websites, we receive certain technical data when you visit — IP address, browser and device type, pages viewed, referring page, and similar usage information — through cookies and similar technologies described below.

Cookies and similar technologies

We use cookies and similar technologies to:

Make the site work — keep your shopping cart and preferences and keep the site secure. These are strictly necessary.
Understand usage — measure which pages are useful so we can improve them (analytics).
Advertising — measure how our ads perform and, in some cases, show you relevant ads on other sites.

You can control or delete cookies in your browser settings, and where the law requires it we ask for your consent before setting non-essential cookies. Blocking some cookies may affect how the site works.

Analytics and advertising

We use the following Google services:

Google Analytics to understand how visitors use our site (such as pages visited, general location, and device), so we can improve the store.
Google Ads to measure the results of our advertising (conversion tracking) and, at times, to show our ads to people who have visited our site (remarketing). To measure ad performance we may store a Google click identifier ("gclid") with an order.

These services set their own cookies and process data under Google's policies. You can read how Google uses data at policies.google.com/technologies/partner-sites, opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on, and manage ad personalization at adssettings.google.com.

How we use your information

To process, fulfill, and ship your order, and to send order and shipping updates.
To respond to your messages and provide customer support.
To send our journal or back-in-stock alerts — only if you've opted in.
To measure and improve our site, products, and advertising.
To prevent fraud, enforce our terms, and comply with the law.

For visitors in the EEA and UK, our legal bases are: performing our contract with you (orders and support); your consent (marketing emails and non-essential cookies); and our legitimate interests in running, securing, and improving our store, balanced against your rights.

How we share your information

We do not sell your personal information. We share it only with the service providers that make your order and our store work, and only what each needs:

Square — payment processing.
USPS and EasyPost — shipping labels and delivery.
Our email provider — order and journal emails.
Google — analytics and advertising, as described above.
Our website host — to operate the site.

We may also disclose information when required by law, or to protect our rights, safety, or property.

International transfers

We're based in the United States, and our providers may process data in the US and other countries. Where we transfer personal data from the EEA or UK, we rely on appropriate safeguards such as the providers' standard contractual clauses.

Data retention

We keep order records as long as needed for the purposes above and to meet tax, accounting, and legal requirements. We keep marketing contacts until you unsubscribe, and message records for as long as needed to help you.

Your rights and choices

You can unsubscribe from marketing emails at any time using the link in any message. Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent.

EEA/UK (GDPR): you have the rights above and the right to lodge a complaint with your local data protection authority.

California (CCPA/CPRA): you have the right to know, delete, and correct your personal information and to opt out of the "sale" or "sharing" of personal information and of targeted advertising. We do not sell your personal information for money, and you won't be treated differently for exercising your rights.

To make a request, contact us through the contact page. We'll verify and respond as the law requires.

Global Privacy Control & Do Not Track

Some browsers offer a Global Privacy Control (GPC) or "Do Not Track" signal. Where the law requires us to treat these as an opt-out of targeted advertising, we do.

Children's privacy

Our store isn't directed at children, and we don't knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we'll delete it.

Security

We use reasonable technical and organizational measures to protect your information, including encrypted (HTTPS) connections and trusted payment processing. No method of transmission or storage is perfectly secure, but we work hard to keep your data safe.

Changes to this policy

If we update this policy, we'll post the new version here with a fresh date below, and make significant changes clear.

Last updated: June 8, 2026.