Privacy Policy

Effective date: October 16, 2026. MATORY is a small independent shop based in Calumet City, Illinois. This policy explains how information is used when you browse, create a My Matory account, contact us, or place an order.

Information you provide: We collect the contact and delivery details you enter at checkout, including your name, email address and shipping address, and retain order items, recorded prices, discounts, payment status and shipping terms to process and support your order. Do not send card numbers, passwords or verification codes to our support address.

My Matory: Email verification is used to sign in without a password. We store account details, preferences, favorites, order associations and member-benefit records. Authentication uses temporary verification challenges, rate-limit records and secure session cookies. Bag cookies maintain your shopping bag. These operational cookies are separate from aggregate analytics.

Payments: Stripe hosts the payment screen and processes payment information. MATORY stores payment references and order status, but does not receive your full card number. Stripe processes information under its own privacy policy. A verified payment is checked against our order records before normal fulfillment.

Transactional email: Resend is used to deliver sign-in codes and order-related emails. These may include an order summary and delivery details. Authorized store operators receive order details needed to prepare and support your order. Signing in or purchasing does not by itself subscribe you to marketing emails.

Newsletter and preferences: If you subscribe, we store your email address, optional name and the consent version. Member marketing preferences can be changed in My Matory Profile. To ask us to stop newsletter messages or to discuss your subscription, contact support@matoryofficial.com.

Aggregate analytics: MATORY currently records limited events such as page and product views, category selection, approved product-related search terms, favorites actions, bag actions and checkout starts. Our analytics do not use persistent visitor or session identifiers, do not store raw IP addresses or raw user-agent strings, and do not join browsing events to an account or an order. Events may include an hour-rounded time, broad device/browser category, optional country, approved page paths and allowlisted referral or campaign values. Unknown or potentially sensitive search terms are discarded. Current analytics respect supported Do Not Track and Global Privacy Control signals. Authentication cookies are checked only to exclude signed-in store owners; account identity is not stored with browsing events. Owners can enable a signed, secure analytics-exclusion cookie for seven days in their browser, which continues excluding test traffic after logout and can be turned off in Admin. A random identifier for one event suppresses duplicate delivery; it is not a visitor identifier. Known bots are filtered on a best-effort basis. Earlier unclassified counts are reported separately.

Analytics retention: Events are retained for a rolling 90-day reporting window. Older events are removed when new events are stored. Cleanup is event-driven, so expired rows may remain until the next accepted event. Visitors, returning visitors and visitor-level purchase attribution are not measured by this system.

Service providers: Cloudflare hosts the website and database; Stripe processes payments; Resend delivers transactional emails. Delivery providers may receive the name and address needed to ship an order. Each provider may maintain its own security and service logs. Our analytics statements do not describe or limit those providers’ separate processing.

Retention: Account, order, shipping and benefit records are retained for store operations, customer support, fraud prevention and applicable recordkeeping needs. There is currently no automatic deletion schedule for every business record. Expired authentication challenges and sessions are cleaned up during later authentication activity. Contact us about access, correction or deletion; some records may need to be retained. We do not promise immediate or unconditional deletion.

Security: Access to the administration area is restricted to authorized owners. We use server-side access checks and secure session cookies, and avoid placing payment credentials in browser code. No method of transmission or storage is completely secure.

Contact and updates: For privacy questions or requests, email support@matoryofficial.com. We may update this policy as our services change and will update the effective date on this page. This policy describes the current service and does not provide a guarantee of legal compliance in every jurisdiction.