Privacy policy

Last updated: September 8, 2026

Palmroute LLC, a New Mexico limited liability company ("we," "us," "our"), operates https://bobbleandbean.com. This policy explains what personal information we collect, why we collect it, and the choices you have.

Information we collect

Information you give us

  • Name and email address
  • Billing address and country
  • Order history
  • Any message you send to our support address

Information collected automatically

  • IP address, browser type, device type, operating system
  • Pages viewed, time on site, and the site or ad you arrived from
  • Cookie identifiers

Payment information

We do not collect, see, or store your full card number. Payments are processed by Shopify Payments, which is PCI-DSS compliant. We receive only the last four digits, the card brand, and whether the payment succeeded.

Why we use it

  • To deliver the pattern you purchased and send your download link
  • To provide customer support and reissue files
  • To detect and prevent fraudulent orders
  • To meet our tax, accounting, and legal obligations
  • To send marketing email, only if you opted in
  • To measure how our advertising performs

Cookies and tracking

We use:

  • Essential cookies — required for the cart and checkout to function.
  • Analytics cookies — aggregate traffic measurement.
  • Advertising cookies — Pinterest, Meta (Facebook and Instagram) pixels, used to measure ad performance and show relevant ads.

You can refuse non-essential cookies through the banner shown on your first visit, or block cookies in your browser settings. Blocking essential cookies will prevent checkout from working.

Who we share information with

We share only what is necessary, and only with:

  • Shopify Inc. — our e-commerce platform and hosting provider
  • Shopify Payments — payment processing and fraud screening
  • Shopify Email — order confirmation and marketing email delivery
  • Pinterest, Meta (Facebook and Instagram) — advertising measurement
  • Professional advisers (accountants, lawyers) where required
  • Law enforcement or regulators where we are legally required to do so

We do not sell your personal information.

International transfers

We are based in the United States and our service providers may process data in the United States and elsewhere. Where we transfer personal data out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses.

How long we keep it

  • Order and transaction records: 7 years (US tax and accounting requirements)
  • Marketing contacts: until you unsubscribe
  • Analytics data: up to 26 months
  • Support emails: 3 years

Your rights

Depending on where you live, you may have the right to:

  • Request a copy of the personal information we hold about you
  • Correct information that is inaccurate
  • Request deletion of your information
  • Object to or restrict how we use it
  • Opt out of marketing at any time
  • Opt out of "sharing" for cross-context behavioral advertising

California residents (CCPA/CPRA): you have the rights listed above, plus the right not to be discriminated against for exercising them. We do not sell personal information as that term is defined under the CCPA.

EU/UK residents (GDPR): our legal bases are contract performance (delivering your order), legitimate interests (fraud prevention, analytics), consent (marketing, advertising cookies), and legal obligation (tax records).

To exercise any right, email support@bobbleandbean.com. We respond within 30 days and may ask you to confirm your identity first.

Marketing email

Every marketing email includes an unsubscribe link. Transactional email — your order confirmation and download link — is not marketing and cannot be unsubscribed from, because it is how you receive the product you paid for.

Children

Our store is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, email support@bobbleandbean.com and we will delete it.

Security

We use TLS encryption across the entire site, and our platform and payment provider maintain PCI-DSS compliance. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

Changes

We may update this policy. The "last updated" date above will change, and material changes will be announced on this page.

Contact

Palmroute LLC
1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110
support@bobbleandbean.com