Data Use & Protection Policy

1. Our Data Principles

• Collect only what we need. We ask for the minimum information required to quote, fulfill, and support your order.
• Use it only for why we collected it. We do not sell your personal information, and we do not use it for unrelated purposes.
• Keep it only as long as needed. Data is deleted or anonymized once it is no longer required for the purpose it was collected or for a legal obligation.
• Protect it by default. Security is built into how the site and our vendors operate, not bolted on afterward.

2. How Your Data Is Protected in Transit

• All traffic to and from this website is encrypted with HTTPS/TLS.
• A strict Content-Security-Policy limits which external services the site is allowed to talk to, reducing the risk of injected or malicious scripts.
• Public input endpoints (orders, contact, quotes, chat) are rate limited to defend against abuse and automated attacks.

3. How Your Data Is Protected at Rest

• Order, account, and contact records are stored in a managed, access-controlled PostgreSQL database (Neon) with encryption at rest.
• We never store full payment card numbers. Card data is captured and processed directly by Stripe, a PCI-DSS Level 1 certified payment provider. We only retain a payment status and a reference token.
• Account credentials and sessions are managed by Clerk; we do not store your raw password.

4. Who Can Access Your Data

Access to customer data is limited to authorized Muskingum Materials staff who need it to process orders and provide support, and to the vetted service providers listed in our Privacy Policy who process data on our behalf under contract. Each provider is used only for the specific function it performs:

5. Payment & Pricing Integrity

Order totals are always re-validated on our server against authoritative pricing before any charge is created — prices submitted by the browser are never trusted. This protects both you and us from tampering and billing errors.

6. AI Chat Data

Messages you send to our AI chat assistant are processed to generate a helpful reply and may be stored to improve service quality. Please avoid sharing sensitive personal information (such as card numbers or government IDs) in chat. Chat transcripts are covered by your deletion rights below.

7. Cookies & Tracking

We use cookies that are necessary for the site to function (authentication and secure checkout) and, with your consent, analytics cookies to understand how the site is used. You can manage analytics consent through the cookie banner and your browser settings.

8. Data Breach Response

In the unlikely event of a data breach that affects your personal information, we will investigate promptly, take steps to contain it, and notify affected customers and any required authorities in accordance with applicable law.

9. Your Control Over Your Data

You can access, correct, export, or delete your data. To remove your information, see Delete My Data Request. For the full list of rights, see our Privacy Policy.

10. Contact