PRIVACYPOLICY.

Who we are

State of Stick, Co. Inc. ("State of Stick, Co. Inc.", "we", "us", or "our") is a Michigan company based in Battle Creek, Michigan, USA. This Privacy Policy explains how we handle information when you visit stateofstick.co(the "Site") or contact us for retail, custom, wholesale, brand-activation, or digital services.

Service workspaces and company payments

When a company uses the service workspace, we process company and user identity, access roles, equipment identifiers, service requests and contact details, appointments, work notes, uploaded photos/documents, estimates, itemized invoices, billing email addresses, due dates, cash/check receipt references, approval records and payment/invoicing-term acceptance records. Company staff receive information according to their roles; customer views are limited to authorized records. Uploaded equipment files are shared with people granted access to that equipment. Internal work notes are not included in customer views.

Stripe collects payment credentials and company identity/bank information through hosted checkout and onboarding. We do not collect full card numbers or bank credentials in our service forms. We receive connected-account identifiers, readiness information, payment references, amounts, currency, platform fees and refund/dispute status to operate payments, reconcile records, prevent duplicate charges and provide support. Necessary identifiers, amounts and account information are shared with Stripe. See Stripe's Privacy Policy.

The service company determines the purposes of its customer service records; we process those records to provide its workspace and act separately for our own account administration, security, billing and legal obligations. Contact your service company about its records and info@stateofstick.co about our processing or access assistance. Company staff may opt into new-request email alerts; this does not subscribe homeowners to marketing. Required contract, consent, accounting and dispute records may remain after account closure; deletion and export requests are reviewed under the applicable agreement and law.

Information we collect

Information you give us

• Contact and inquiry details you submit through our contact, custom, wholesale, collaboration, or brand-activation forms — typically your name, email, phone, business name, and the message or project details you provide.
• Your name and email address when you subscribe to drop and shop updates, plus your business or organization and city/state if you choose to share them.
• Information you provide when reviewing or electronically signing an agreement, quote, or order, including your name, acknowledgements, signature record, IP address, and browser information.
• Emblem claim information and any optional public claim photo, location, note, or contact details you choose to provide.
• Opt-in venue interaction information you choose to provide, such as reward claims, offer clicks, lead forms, VIP access requests, or app-based participation in a disclosed venue experience.

Information collected automatically

• Standard server and security logs (IP address, browser/user-agent, pages requested, timestamps) generated by our hosting and security providers to operate and protect the Site.
• When you intentionally tap or scan a connected object, we may record the time, tag and campaign identifiers, requested destination, authenticity result, general device category, session identifier, referrer, and region-level network geography. We do not treat network-derived location as GPS and do not use it to follow movement.
• IP address and browser information may be converted into one-way hashes for security, fraud detection, QA filtering, and aggregate measurement. A hash may still be treated as pseudonymous information where applicable.
• Essential cookies and browser storage used for security, checkout, private sessions, intake drafts, and preferences. Connected analytics are session-only by default. See our Cookie Policy.

Engagement analytics

Connected experiences can record page views, taps, clicks, scroll depth, time on a page, media errors, and form-start or submission events, with session and object identifiers. These events help us operate and evaluate experiences; they are not proof of a person's identity, understanding, or task completion. First-party measurement uses a short-lived session by default. Optional repeat-visit measurement requires an affirmative preference. This site does not currently load a third-party product-analytics integration or use advertising cookies. Reports intended for partners use aggregate results; small groups and pseudonymous records can still present identification risks and should not be described as anonymous merely because names are removed. Manage optional measurement on our Cookie Policy and preferences page.

Connected venue and wireless features

NFC and QR interactions are intentional: you tap, scan, click, claim, or submit something. For venue programs, we may also support scoreboard QR, app links, sponsor zones, VIP areas, team-store moments, installation health checks, or other approved signal sources. Any expanded venue signal is used only for disclosed opt-in experiences, venue-app features, or internal installation operations. We do not offer hidden tracking of nearby phones.

Venue and sponsor reporting may include aggregate counts by object, zone, event window, offer, video, lead path, or signal source. We may also process limited installation health information, such as whether a deployed piece or signal source appears active. Sponsor reports are aggregate and operational; they are not individual visitor trails.

AI-assisted services and proposed pilots

Where an AI-assisted feature is enabled, the information submitted for that task and relevant business or object context may be processed to generate a draft or response. Available infrastructure includes Cloudflare Workers AI and, where enabled, OpenAI through Cloudflare AI Gateway. Providers and retention depend on the configured service; this policy does not promise zero retention or a particular processing region. See AI and assistive-use information. Do not submit medical records, passwords, financial account details, or another person's sensitive information through general inquiry or demo forms.

Assistive pilot evaluation is a proposed activity, not blanket permission to collect participant data. Before a pilot collects observations, accessibility preferences, support needs, or recordings, participants must receive a specific notice explaining the data, purpose, responsible organizations, recipients, retention period, and withdrawal options. Publicity and identifiable quotations require separate permission. See our pilot evaluation framework.

How we use your information

• To respond to your inquiries and provide quotes, custom work, wholesale, and other services.
• To send shop news and drop announcements when you have subscribed (you can unsubscribe at any time).
• To process and document agreements, orders, and commissioned projects.
• To operate emblem claims, certificates, private document delivery, and electronic-signature records.
• To operate connected venue activations, sponsor reporting, aggregate zone reporting, and installation health checks.
• To provide enabled AI-assisted services and assess their quality, subject to the applicable service notice and agreement.
• To secure the Site, prevent spam and abuse, and operate our infrastructure.
• To comply with our legal and tax obligations.

How information is shared

We do not sell your personal information. We share it only with service providers who help us run the business, and only as needed:

• Payment and commerce providers — when used, third-party checkout services process purchases under their own privacy practices.
• Infrastructure and security providers — website hosting, content delivery, and bot/spam protection.
• Email and CRM providers — to deliver transactional and subscription emails, notify our team, and manage business contacts and project leads.
• Storage providers — private or public cloud storage for submitted logos, claim photos, agreements, and project documents.
• AI processing — the configured AI and gateway providers needed to process an enabled task, as described above.
• Legal and compliance — when required by law, or to protect our rights, customers, or the public.

Data retention

We keep inquiry and project records while they are active and for a reasonable business follow-up period. Payment, contract, signature, and accounting records may be retained as required for legal, tax, dispute, fraud-prevention, and recordkeeping purposes. Uploaded assets are retained while needed for production, recognition, or the project archive, subject to agreed usage rights. Security logs are generally retained for shorter operational periods by us or our infrastructure providers. When information is no longer needed, we delete, de-identify, or securely archive it as appropriate.

Connected-engagement events are assigned a retention deadline when collected. The platform default is 90 days, although a shorter or longer period may apply to a documented activation need, up to two years. Contract, transaction, fraud-prevention, and consent records may follow a different legally justified schedule.

Your choices and rights

• You can unsubscribe from marketing emails using the link in any email or by contacting us.
• You may request access to, correction of, or deletion of the personal information we hold about you.
• You may withdraw optional public-display or service-contact permission by contacting us, subject to material already produced or legal records we must retain.
• You can control cookies through your browser — see our Cookie Policy.
• You can enable or withdraw optional repeat-visit analytics at any time on our Cookie Policy and preferences page. Withdrawing stops future cross-visit recognition and clears the optional visit cookie.

To exercise any of these rights, email us at info@stateofstick.co.

Children's privacy

The Site is not directed to children under 13, and we do not knowingly collect personal information from them through our general Site. These general forms are not a child-enrollment process. A proposed child-facing pilot requires a separate age-appropriate notice and consent process before collection. If you believe a child has provided us information, contact us so we can investigate and take appropriate action.

Security

We use access controls, encrypted transport, private storage for sensitive uploads, server-side payment verification, spam protection, security headers, and other reasonable safeguards appropriate to the information we handle. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

United States processing

We are based in Michigan, and information may be processed in the United States by us and our service providers. If you access the Site from another country, its data-protection rules may differ from those where you live.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be reflected on this page.

Contact us

Questions about this policy or your information? Reach us atinfo@stateofstick.co or 269.425.1770, State of Stick, Co. Inc., Battle Creek, Michigan, USA.

Rights and required procedures can depend on where you live and the service involved. We may need to verify a requester's identity or authority without collecting unnecessary information. Nothing in this policy limits rights that applicable law gives you.