Plain words, kept short. The Lundr privacy policy: what we collect, why, who we share it with, how long we keep it, and every right you have to change or delete it. Lund Studio LLC, Westminster, Colorado.
The short version
Lundr.tech collects the minimum needed to sell you a file and answer you afterward. We do not sell your data, do not track you across other sites, do not run analytics of our own, and do not see the prompts you send your AI — the cards run in your AI, not ours. The theme sets no cookies of its own. Shopify hosts checkout and its own privacy policy governs what it collects there.
1 · What we collect
Your name, email and (for tax) shipping address at checkout — Shopify collects these and passes them to us. Your payment details are collected by Shopify and its payment processors; we never see the full card number. Your order record — what you bought, when, and the assent you gave at the sealed cart (the term, the not-Zuckerberg confirmation, the WITNESS timestamp). Basic server logs when you visit the site — IP address, browser, and page requested — kept for security only, no longer than 30 days. Anything you write us — kept in our email so we can answer you.
2 · Why we collect it
To fulfil your order and deliver files; to send editions when the card is updated; to answer your questions; to detect fraud and abuse; to comply with tax and legal record-keeping requirements. Nothing else.
3 · Who we share it with
Shopify (checkout, hosting). Payment processors (Stripe, Shopify Payments, Apple Pay, Shop Pay, PayPal — whichever you use). Email delivery services (Google Workspace, Shopify’s transactional email). Tax authorities where the law requires. No one else. We do not sell, rent, or trade your data to third parties for their own use, ever.
4 · How long we keep it
Order records: seven (7) years, to satisfy tax and accounting requirements. Email correspondence: until you ask us to delete it. Server logs: 30 days.
5 · Your rights
Anyone whose personal data we hold can ask what we have (right of access), ask us to correct it, ask us to delete it, ask us to send it to you in a portable format, and opt out of any secondary use we make of it (we make none, so this is a no-op — but the right stands). Write us at carterluense@gmail.com with your order number. We respond within 30 days, and always within any shorter period your jurisdiction requires.
6 · Colorado residents (Colorado Privacy Act)
Colorado’s Privacy Act, effective July 1 2023, gives Colorado residents the rights above plus: the right to opt out of targeted advertising (we run none); the right to opt out of the sale of personal data (we sell none); the right to opt out of profiling for consequential decisions (we do none); and the right to appeal a denied request. To appeal, write us at the address above with “CPA appeal” in the subject line.
7 · California residents (CCPA/CPRA)
California residents have the rights above plus: the right to know what personal information we have; the right to delete; the right to correct; the right to opt out of sale or sharing (we do neither); the right to limit use of sensitive personal information (we hold none — no Social Security number, no biometric identifiers, no precise geolocation, no health data, no protected-class information); and the right to non-discrimination for exercising any of these rights. We have not sold personal information as the CCPA defines it in the twelve months before this policy was last updated, and we do not intend to.
8 · Other US states
Virginia (VCDPA), Connecticut (CTDPA), Utah (UCPA), and a growing list of state laws grant similar rights. We honor them all under the same process: email carterluense@gmail.com.
9 · Children under 13 (COPPA)
This store is not directed to children under 13 and we do not knowingly collect their personal information. Anyone 13–17 needs a parent or guardian in the loop for any purchase, and for using any card that is about physical activity, health, food, or money.
10 · Cookies
The theme sets no cookies of its own. It runs one script — the day-and-night switch — which keeps one preference in your browser only and sends nothing anywhere. Shopify sets a small number of technical cookies (session, cart) as a requirement for checkout; these are not tracking cookies. No third-party analytics (Google Analytics, Meta Pixel, TikTok Pixel, or any other) are installed on this store.
11 · Do Not Track and Global Privacy Control
We do not track you across other sites, so DNT and GPC signals do not change what we do. We honor them by default.
12 · International transfers
Lund Studio LLC is in Colorado, United States. If you are outside the US and buy from us, your personal data is processed in the US. Shopify processes data in multiple regions per its own policy.
13 · Data security
We keep the minimum data possible. Shopify handles payment security. Our email is on Google Workspace with two-factor authentication. If a breach affecting your personal data occurs, we notify you within the time your jurisdiction requires (in Colorado, without unreasonable delay).
14 · Changes
We may update this policy. The date at the bottom always shows when it was last changed. Material changes are announced at the top of the page and, where the change materially affects you, by email to anyone with an active order in the last year.
15 · Contact
For any privacy question or to exercise any right above: Carter Luense, Lund Studio LLC · carterluense@gmail.com · Westminster, Colorado, United States. Last updated September 21, 2026 — draft pending review by counsel of record.