Privacy Policy

Infrastructure and analytics

Our site runs on servers we operate, behind Cloudflare, which provides HTTPS encryption and network protection.

We use Google Analytics 4 to understand how visitors find and use our site: which pages are viewed, how long visits last, the type of device and browser, the website that referred you, and your approximate location (city or region), which Google estimates from your IP address. Google Analytics sets first-party cookies (_ga and _ga_ followed by an ID) so it can recognize a returning browser. Google Analytics 4 does not log or store IP addresses. We have turned off Google signals and ad personalization, so this data is not used to show you ads or linked to a Google account, and we use it only in aggregate to improve the site. Google processes it as our service provider; you can read how Google uses information from sites that use its services.

We do not load Meta tracking pixels or third-party behavioral advertising scripts, and we do not follow your activity across other websites.

You can opt out by blocking or deleting cookies in your browser, by installing the Google Analytics opt-out browser add-on, or by turning on Global Privacy Control (GPC). When your browser sends a GPC signal, our site does not load Google Analytics at all.

Other than the analytics cookies above, the only cookies our site uses are strictly necessary ones for checkout and fraud prevention.

Bot protection and communications

When you communicate with our team or browse our site, we process minimal necessary information:

• Bot defense: When it is turned on, we use Cloudflare Turnstile on our contact and newsletter forms to prevent spam bots and malicious form submissions. Turnstile evaluates browser characteristics without collecting personal biometrics.
• Support correspondence: Messages sent through our forms or to [email protected] are used solely to respond to your inquiry and provide customer service.
• Newsletters and updates: We use Cloudflare Email Service to deliver transactional notices (such as order confirmations and shipping tracking) and our email newsletter. The newsletter is double opt-in and contains an unsubscribe link in every issue. Email addresses are never rented, sold, or shared.

Store operations and third-party partners

Patriot Merch manages customer accounts, shopping carts, and order processing on our own custom e-commerce infrastructure. To process financial transactions and deliver physical merchandise, we work with trusted service partners:

• Payment processing via Stripe: Payments are handled securely through Stripe. Your full credit or debit card details are encrypted and transmitted directly to Stripe’s PCI-DSS Level 1 certified servers. Payment card numbers never touch or reside on our servers. Where applicable, state and local sales taxes are calculated at checkout by Stripe Tax.
• Print fulfillment by Printful: Physical merchandise—including t-shirts, hoodies, caps, and stickers—is manufactured on demand by Printful. Printful receives the recipient name, shipping address, order contents, and phone number (if provided for carrier alerts) strictly to manufacture, package, and ship your items within the United States.

Data retention practices

We retain customer records only for as long as required to satisfy operational and legal requirements:

• Order records: Invoices, purchase receipts, and fulfillment logs are retained to comply with commercial tax obligations and accounting standards.
• Customer support records: Customer correspondence is retained as needed to respond to your inquiry and provide follow-up support.
• Newsletter records: Email addresses remain in our newsletter database until you choose to unsubscribe, at which point your email is marked inactive and removed.

State privacy rights including California (CCPA/CPRA)

Residents of California and states with comprehensive privacy legislation possess specific legal protections regarding their personal data:

• Right to know and access: You may request details on the personal data categories we collect, use, and share.
• Right to deletion: You may request the deletion of your personal data, subject to legal recordkeeping obligations.
• Right to correction: You may request corrections to inaccurate personal records.
• Right to opt-out of sale or sharing: We do not sell personal data, nor do we share personal data for cross-context behavioral advertising. We have not sold or shared consumer information during the preceding twelve months.
• Right to non-discrimination: Exercising your statutory privacy rights will never result in altered pricing or degraded service quality.

To submit a verified privacy request, email [email protected] or mail our office at 1752 Wilking Way, Shakopee, MN 55379.

Children’s privacy

Patriot Merch is a general-audience retail website intended for adults. We do not knowingly solicit, collect, or maintain personal data from children under 13 years of age. If we learn that personal data from a child under 13 has been submitted without verified parental consent, we will promptly delete that information from our records.

Contact information

If you have questions, comments, or requests regarding this Privacy Policy or our security standards, contact us at:

• Email: [email protected]
• Mailing address: 1752 Wilking Way, Shakopee, MN 55379