Privacy policy
Privacy policy
This policy explains what personal information Birchnook collects, why we collect it, who we share it with, and the choices you have. It applies to birchnook.com, to orders you place with us, and to any other way you interact with us — by email, or through our social accounts.
Last updated: 28 July 2026.
1. Who is responsible for your data
Birchnook is a trading name of Goody Woody Karolina Zielińska, a business established in Poland. We are the data controller for the personal information described in this policy.
- Legal entity: Goody Woody Karolina Zielińska
- Address: Jana Kazimierza 9/29, 01-248 Warszawa, Poland
- REGON: 142164527 · NIP: PL1132754707
- Email: contact@birchnook.com
- Phone: +48 790 400 606
We make our pieces in Warsaw and ship them to customers in the United States. Because we are established in Poland, European data protection law (the GDPR) governs how we handle personal information. If you live in the United States, your state may also give you specific rights — those are set out in section 10.
2. What we collect
We only collect what we need. The categories below use the terminology of US state privacy laws so you can match them to your rights.
| Category | Examples | Where it comes from |
|---|---|---|
| Identifiers and contact details | Name, email address, shipping and billing address, phone number | You, when you order, subscribe or contact us |
| Order and transaction information | Items ordered, personalisation text, order value, delivery status, returns and refunds | You and our platform |
| Payment information | Confirmation of payment, payment method type, last four digits, billing address | Our payment processors. We never see or store full card numbers. |
| Communications | Emails you send us, support requests, review submissions and any photos you attach | You |
| Device and usage information | IP address, browser and device type, pages viewed, referring site, approximate location derived from IP, cookie and advertising identifiers | Automatically, through cookies and similar technologies |
| Inferences | Product preferences and audience segments used to decide which emails or ads to show you | Derived from the above |
We do not collect sensitive personal information as defined by US state privacy laws — no government identifiers, precise geolocation, health, biometric, racial, religious or sexual-orientation data. We do not ask for it and we do not want it. Please do not include such information in a message, a review or a personalisation field.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Taking, making and delivering your order; handling returns, refunds and exchanges; answering your questions | Performance of our contract with you |
| Keeping accounting and tax records | Compliance with a legal obligation |
| Preventing fraud and abuse, keeping the store secure | Our legitimate interest in protecting the business and our customers |
| Understanding how the store is used so we can improve it | Our legitimate interest in running and improving our business |
| Sending you marketing emails | Your consent, which you can withdraw at any time |
| Measuring advertising and showing you relevant ads on other platforms | Your consent where required; otherwise our legitimate interest in marketing our products |
| Publishing reviews and customer photos you choose to submit | Your consent, given when you submit them |
We do not use your personal information to make automated decisions that produce legal or similarly significant effects about you.
4. Who we share it with
We do not sell your personal information for money. We share it only with the service providers we need to run the store, and only for the purposes described above. Each is bound by contract to protect it.
| Who | What for |
|---|---|
| Shopify International Limited and Shopify Inc. | Our e-commerce platform and hosting — the store, checkout, customer accounts and order records run on Shopify |
| Payment processors used at checkout (including Shopify Payments and any wallet you choose, such as Shop Pay, Apple Pay, Google Pay or PayPal) | Taking payment, verifying it and preventing payment fraud |
| Shipping carriers and our fulfilment partners | Delivering your order and providing tracking |
| Klaviyo | Sending our marketing and order-related emails, and measuring whether they were opened |
| hCaptcha (Intuition Machines) | Protecting our forms from automated abuse |
| Meta Platforms, Google and Pinterest | Measuring our advertising and showing you relevant ads — see sections 5 and 8 |
| Cloudflare | Delivering the site securely and processing our own analytics and advertising measurement |
| Professional advisers, accountants and authorities | Where the law requires it, or to establish or defend legal claims |
We may also disclose personal information in connection with a sale, merger or reorganisation of the business, in which case we will tell you before your information becomes subject to a different privacy policy.
5. Cookies, tracking and advertising
Cookies are small files stored on your device. We and our partners use them, along with similar technologies such as pixels and local storage, for the following purposes.
| Type | What it does | Can you turn it off? |
|---|---|---|
| Strictly necessary | Keeps your cart and checkout working, remembers your session, protects our forms from abuse, and keeps the site secure. The store cannot work without these. | No — but they are never used for advertising |
| Analytics | Tells us which pages are visited and where visitors come from, so we can improve the store. Includes Shopify's own analytics and Google Analytics. | Yes — see below |
| Advertising | Measures whether an ad led to a visit or a purchase, and allows Meta, Google and Pinterest to show you our products on their platforms. Includes identifiers such as _fbp, _fbc, _ga and, where we run Pinterest advertising, _epik. |
Yes — see below |
Some of this measurement happens on our own servers rather than in your browser: when you place an order, we may send a record of that purchase to Meta, Google and Pinterest so they can attribute it to an ad. Where we do this, contact details are transmitted in an irreversibly hashed form, never in the clear. Your IP address and browser user-agent are processed in the clear because the advertising platforms require them, and we delete our copy after 90 days.
How to control this. You can block or delete cookies in your browser settings, though the store may not work correctly without the strictly necessary ones. You can also opt out of the sharing of your information for targeted advertising at any time through Your Privacy Choices. If your browser or an extension sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of personal information for the browser and device you are using.
6. Marketing emails
We only send marketing emails to people who have asked for them — by subscribing on the site, or by opting in at checkout. Every email has an unsubscribe link at the bottom, and unsubscribing takes effect immediately. You can also email contact@birchnook.com and we will remove you.
Unsubscribing from marketing does not stop transactional messages such as order confirmations, shipping notifications and replies to your questions — we need to send those to fulfil your order.
7. Reviews and customer photos
If you submit a review or a photo, the content you provide and the first name or display name you choose will be published on the site and may be used in our marketing. Your email address is never published — we use it only to verify the review relates to a real order and to contact you if we have a question. You can ask us to remove a review you have submitted at any time by emailing contact@birchnook.com.
8. Social media, and how we use the Pinterest API
We keep a Birchnook business account on Pinterest, and we use the Pinterest API to manage it. Here is exactly what that involves.
- What we send to Pinterest. We use the API to create and schedule Pins on our own Birchnook boards. What we send is our own marketing material: product photography hosted on our store's content delivery network, the Pin title and description we wrote, the board it belongs to, and a destination link to a page on birchnook.com. It contains no customer personal information.
- What we read back from Pinterest. We read the performance of our own Pins, boards and account — impressions, saves, outbound clicks and similar aggregate figures — so we can tell which designs resonate and what to make next. This is aggregate data about our own content and our own account.
- What we do not do. We do not access, collect, store or process the personal information of Pinterest users. We do not read other people's profiles, boards or private data. We do not use Pinterest API data to build profiles or audiences of individual users, we do not combine it with our customer records, and we never sell it, rent it or transfer it to any third party. We use Pinterest data only to run our own Pinterest presence.
- Security and retention. Our Pinterest access token is stored securely, is used only by our own publishing tool, and is never shared. Pin content and the account statistics we read back are kept only as long as we need them to manage the account, and are deleted if we stop using the integration or if our API access is revoked.
- Pinterest advertising. Separately from the API, if we advertise on Pinterest, Pinterest may set cookies on your browser or receive conversion measurement from our site, exactly as described in section 5. You can opt out of this at any time through Your Privacy Choices or by sending a Global Privacy Control signal.
Pinterest is an independent controller of the data it holds about you as a Pinterest user. Your use of Pinterest itself — including anything you do with our Pins on their platform — is governed by Pinterest's own Privacy Policy and terms of service, not by ours.
The same principles apply to the other platforms where Birchnook has a presence, including Instagram and Facebook (Meta). We publish our own content and read our own aggregate account statistics. We do not collect personal information about the people who follow or interact with us beyond what those platforms show us in their own dashboards, and each platform remains the controller of your account and activity there.
9. How long we keep it
| What | How long |
|---|---|
| Order and payment records | 5 years from the end of the accounting year, as Polish tax and accounting law requires |
| Customer account and address book | Until you ask us to delete it, or 3 years after your last order |
| Marketing profile and email engagement history | Until you unsubscribe, then up to 3 years of inactivity before deletion |
| Support and email correspondence | 3 years from your last message to us |
| Analytics and advertising event logs | 90 days, after which they are deleted |
| Published reviews and photos | Until you ask us to remove them |
| Pinterest and social account statistics | While the account is active; deleted if we stop using the integration or our API access is revoked |
Where we are required to keep information to establish or defend a legal claim, we keep it until that claim is resolved.
10. Your rights if you live in the United States
Depending on your state — California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and a growing number of others — you may have the right to:
- Know what personal information we have collected about you, where it came from, why we collected it and who we shared it with;
- Access a copy of that information in a portable format;
- Correct information that is inaccurate;
- Delete the information we hold about you, subject to the records we are legally required to keep;
- Opt out of the sale or sharing of your personal information and of targeted advertising, through Your Privacy Choices or a GPC signal;
- Not be discriminated against for exercising any of these rights. We will never charge you more, give you less, or refuse to serve you because you exercised a privacy right.
To exercise any of these rights, email contact@birchnook.com with the word "Privacy" in the subject line. We will verify your identity by asking you to confirm details we already hold, such as the email address used to place an order, and we will respond within 45 days. If we need more time, we will tell you why.
An authorised agent may submit a request on your behalf with written proof of authorisation. If we decline your request, you may appeal by replying to our decision — we will review the appeal and respond within 45 days, and if we deny it we will tell you how to complain to your state attorney general.
Sale and sharing. We do not sell personal information for money. We do share identifiers, device information and browsing activity with Meta and Google for cross-context behavioural advertising, which some state laws treat as a "sale" or "share". You can stop this at any time using the links above. We do not knowingly sell or share the personal information of anyone under 16.
11. Your rights if you are in the EU, the EEA or the UK
You have the right to access your personal information, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time without affecting anything we did before you withdrew it. Email contact@birchnook.com and we will respond within one month.
If you are unhappy with how we have handled your information, you can complain to the Polish supervisory authority — Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl — or to the authority in your own country.
12. International transfers
We are based in Poland and our customers are in the United States, so your information necessarily crosses borders. Several of our service providers — including Shopify, Klaviyo, Meta, Google and Cloudflare — process data in the United States. Where information is transferred out of the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, or on the provider's certification under the EU–US Data Privacy Framework, together with additional safeguards where they are needed.
13. Security
Our store runs on Shopify, which is PCI DSS Level 1 certified. Traffic to and from the site is encrypted in transit. Access to customer data is limited to the people who need it to run the business, and payment card details never reach our systems. No system can be guaranteed perfectly secure, but if a breach ever affected your personal information we would notify you and the relevant authority as the law requires.
14. Children
Our products are made for children's rooms, but they are sold to adults. The store is not directed to children and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, email contact@birchnook.com and we will delete it.
15. Changes to this policy
If we change this policy we will update the date at the top of the page. If the change is significant — for example, a new purpose for using your information — we will tell you by email or with a notice on the site before it takes effect.
16. Contact us
Questions about your privacy, or want to exercise a right? Email contact@birchnook.com and a person will answer you — usually within one business day.
