Privacy Policy

Who we are

This site is run by Birdhaus, a Wyoming profit corporation (Wyoming filing ID 2025-001603315), doing business as BirdHaus and By BirdHaus (“BirdHaus”, “we”, “us”). We operate from Orange County, California. BirdHaus also runs Scanacart, the product authentication platform behind our NFC tags and label codes.

Short version: we collect what you send us, plus basic device and scan data. We use it to answer you, make your product and check that products are genuine. We don’t sell it, we don’t use it for ad targeting, and this site sets no cookies.

What we collect and why

When you send the contact form. Your name, email, phone if you give it, company, what you need, quantities, timeline, brand stage and your message. With it we save the page you sent it from, the site that linked you here, campaign tags in the link, your browser type and a one-way hash of your IP address. The hash lets us block repeat spam without storing your IP address.

When you request a quote in Studio. The same contact details, your notes and your design. See Studio uploads.

When you verify a product. The tag or code ID, the time, your browser and device type, and your IP address, which we use to work out an approximate, city-level location. See Product verification scans.

When you browse. Our hosting provider keeps standard server logs, such as IP address, the page requested and browser type, for security and to keep the site running. We don’t use them to build a profile of you.

The table below lists the categories of personal information we collected in the last 12 months, where it came from and what we use it for.

We don’t collect sensitive personal information as defined by California law, such as government ID numbers, financial account details, precise geolocation, health information or the contents of your messages on other services. We don’t use personal information to infer things about you.

Product verification scans

When you tap a BirdHaus NFC tag or check a label code, your phone opens a verify page. To answer “Authentic” or “Not verified”, our systems receive and record:

• the tag or code ID, and whether it passed
• the date and time of the scan
• your browser and device type (user agent)
• your IP address, which we turn into an approximate city, region and country

We use this to:

• confirm the product is genuine, and catch cloned or copied tags, which are shut off automatically
• spot counterfeits and products sold far from where they shipped
• show the brand that owns the product where and when its products are checked
• show aggregated counts on our network map

We don’t ask for your name or account to verify a product. We process scans on behalf of the brand that owns the product, as its service provider, and share scan records with that brand only for its authentication and analytics. If a brand’s own app or website asks you for more, such as a sign-up for rewards, that brand’s privacy policy applies to what you give it.

The network map shows totals by city, such as how many checks happened in Mexico City. It shows no individual scan, device or IP address, and nobody can be identified from it.

Studio uploads

In Studio you can add a logo or artwork and design a product in 3D. When you request a quote, we save the file you uploaded, a version with the white background removed if you asked for one, a picture of your 3D design, and your design choices. Files go to private storage that only our team can open. They are not public and we don’t use them for anything except your quote, mockups and order.

Studio runs in your browser until you send the quote. If you close the page without sending, nothing you uploaded reaches us.

Cookies and analytics

This site sets no cookies and loads no analytics, advertising or tracking scripts. There’s no Google Analytics, no Meta pixel and no ad network. Fonts are served from our own domain. Because nothing tracks you, there’s no cookie banner to dismiss. If that changes, we’ll update this policy first and ask for your consent where the law requires it.

Who we share it with

We share personal information only with:

• Service providers that run the site for us, under contracts that limit them to providing their service: Vercel (hosting and server logs), Supabase (database and private file storage), Resend (sending form notifications by email) and our business email provider.
• Manufacturing partners, only when you place an order, and only what they need to produce it, such as your artwork.
• The brand that owns a product you verify, as described in Product verification scans.
• Authorities or others when the law requires it, to protect our rights or safety or those of others, or as part of a merger or sale of the business, in which case this policy continues to apply to your information.

We don’t sell or share your personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act (CCPA). We have not done so in the last 12 months. We do not sell or share the personal information of anyone under 16.

You still have the right to opt out. To make a request, email info@bybirdhaus.com with the subject “Do not sell or share”. We record it, and if our practices ever change, we will not sell or share your information.

Global Privacy Control. We honor Global Privacy Control (GPC) signals from your browser as a valid request to opt out of sale and sharing, for that browser. You don’t need to do anything else. We treat Do Not Track signals the same way.

How long we keep it

• Contact and Studio requests: for as long as we’re talking with you or working together, then up to 3 years after our last contact, unless you ask us to delete them sooner. Information tied to an order is kept as long as tax and business records require, usually 7 years.
• Studio files: up to 2 years after your quote if no order follows. Artwork for an order is kept so we can reorder and reproduce it, until you ask us to delete it.
• Verification scan records: for as long as the brand’s authentication program runs, so clones and counterfeits can be traced, and then up to 3 years. City-level totals on the network map contain no personal information and may be kept indefinitely.
• Server logs: kept by our hosting provider for a short period, typically days to weeks.

Your California privacy rights

If you live in California, the CCPA gives you the right to:

• Know what personal information we collected about you, where it came from, why we collected it and who we disclosed it to, and get a copy of it
• Delete personal information we collected from you, with some exceptions, such as records we must keep by law
• Correct personal information that is wrong
• Opt out of the sale or sharing of your personal information
• Limit the use of sensitive personal information. We don’t collect any, so there is nothing to limit.
• Not be discriminated against for using these rights. We won’t deny you service, charge you a different price or give you a different level of quality because you made a request.

California’s “Shine the Light” law lets you ask which personal information we shared with third parties for their own direct marketing. We don’t share it for that purpose. We honor these requests from anyone, wherever you live.

How to make a request

1. Email info@bybirdhaus.com with the subject “Privacy request”, or send a message through our contact form.
2. Say which right you’re using: know, delete, correct or opt out.
3. Include the name and email you used with us. For verification scans, include the tag or code ID and roughly when you scanned it, since we don’t know who scanned a tag.

Verification. To protect you, we confirm a request comes from you before we act on it, usually by replying to the email address we have on file. For a copy of specific information or a deletion, we may ask for one more detail that matches our records. We use what you give us only to verify the request. A request to opt out doesn’t need verification.

Authorized agents. Someone you authorize can make a request for you. We’ll ask for your signed permission and may ask you to confirm your identity with us directly.

Timing. We confirm receipt within 10 business days and respond within 45 days. If we need longer, up to 45 more days, we’ll tell you why. Requests are free.

Security

Forms are sent over encrypted connections (HTTPS). Leads and uploads are stored in a private database and private storage that only our server can reach, and the keys never reach your browser. We store a one-way hash of your IP address instead of the address itself. Download links in our internal emails expire after 30 days. No system is perfectly secure, but we limit access to the people who need it and review it.

Children

This site is for businesses and adults. It is not directed to children, and we don’t knowingly collect personal information from anyone under 16, or from children under 13. If you believe a child has sent us information, email info@bybirdhaus.com and we’ll delete it.

Visitors outside the US

We are based in the United States, and our service providers store data in the US. If you use the site or verify a product from another country, your information is processed in the US, where privacy laws may differ from yours. You can use the rights in this policy wherever you live.

Changes to this policy

We’ll update this page when our practices change and change the date at the top. If a change is significant, such as a new use of your information, we’ll say so on this page before it takes effect.

Contact

Questions or requests: info@bybirdhaus.com. See also our Terms of Use and Accessibility Statement.

Birdhaus, a Wyoming profit corporation (Wyoming filing ID 2025-001603315), doing business as BirdHaus and By BirdHaus.