WebHead Workshop ("we", "us", "our") is a small business operating from South Florida, USA. We design and sell 3D-printed products, including functional web shooters and custom pole vault tips, through our website at webheadworkshop.com and through marketplace listings on Etsy, eBay, and Cults3D.
For purposes of this policy, WebHead Workshop is the entity responsible for deciding how and why your personal information is processed (the "data controller" under EU/UK law, or the "business" under California law).
The California Consumer Privacy Act (CCPA/CPRA) defines specific categories of personal information. In the past 12 months we have collected the following categories:
| Category | Examples we collect | Sources |
|---|---|---|
| Identifiers | Name, email address, postal address, phone number, IP address, account ID | You, marketplace order data, server logs |
| Customer records | Name, address, phone, payment information (last 4 only) | You, Square |
| Commercial information | Products viewed, products purchased, order history, returns, support history, marketing preferences, promo codes used | You, your activity on the site |
| Internet activity | Browsing behavior on our site, pages viewed, links clicked, time on page, search terms | Google Analytics, advertising pixels, server logs |
| Geolocation (approximate) | Approximate city/state derived from IP address (we don't collect precise GPS location) | Server logs, analytics |
| Inferences | Inferred interests based on browsing (e.g., interested in cosplay, pole vault, etc.) — used by advertising partners to determine ad relevance | Advertising partners (Google, Meta, Pinterest) |
| Audio/visual | Images you upload for personalization | You (only when you upload) |
We do not collect: biometric information, precise geolocation, health information, government IDs, financial account numbers (beyond what Square processes), or sensitive demographic data.
We share personal information only with the service providers we use to run the business, and with advertising partners as described in Section 6. Each provider has its own privacy policy.
| Service provider | What they receive | Why |
|---|---|---|
| Hostinger (hosting + email) |
All site traffic, server logs, order data stored in our database, and outgoing email | Runs the website, database, and business email infrastructure. |
| Square, Inc. (payment processing) |
Card information, billing address, order total, email | Processes payments. We never see or store your card number. |
| Google Analytics (Google LLC) |
Site usage data, approximate location, device info, cookies | Aggregate analytics for site improvement. |
| Google Ads (Google LLC) |
Conversion events (orders placed after ad clicks), retargeting cookies, hashed email for customer match (where applicable) | Measure ad effectiveness, show ads on Google and partner sites. This counts as "sharing" under CCPA — see Section 8. |
| Meta Platforms, Inc. (Facebook/Instagram Pixel) |
Page views, products viewed, items added to cart, purchases completed, hashed email for customer match | Measure ad effectiveness, build audiences, show ads on Facebook and Instagram. Sharing under CCPA — see Section 8. |
| Pinterest, Inc. (Pinterest Pixel) |
Page views, products viewed, purchases completed | Measure ad effectiveness, show ads on Pinterest. Sharing under CCPA — see Section 8. |
| Google Fonts & Font Awesome | IP address and browser data when fonts/icons load | Provides typography and icons. |
| Formspree (contact form) |
Everything you enter into the custom request form | Receives form submissions and forwards them to us. |
| Etsy | N/A (Etsy sends data to us for fulfillment) | Etsy is the seller of record for marketplace transactions. |
| YouTube (embedded videos) |
IP and browser data when a video loads | Hosts our tutorial videos. |
| USPS & other shipping carriers | Recipient name and address | Required to deliver your order. |
We may also disclose information if legally required (valid subpoena or court order) or if necessary to protect the rights, property, or safety of our customers, ourselves, or others.
We do not sell personal information for monetary consideration. However, the use of advertising pixels described above constitutes "sharing" under California law and similar laws. See Section 8 for opt-out options.
We use the following advertising and measurement tools:
Google's tracking tag (gtag.js) measures conversions from Google Ads campaigns and may set cookies for remarketing. When you visit our site after clicking a Google ad, or when you complete an order, that information is sent to Google. We may also upload hashed customer emails to Google Ads for customer match audiences.
The Meta Pixel tracks page views, content views, add-to-cart events, and purchases. This lets us measure how Facebook/Instagram ads perform and build retargeting audiences. We may also share hashed customer emails through Meta's Conversions API.
The Pinterest Pixel tracks page views, content views, and conversions to measure Pinterest ad performance.
You can also opt out of interest-based advertising across many networks at once:
whw_cart): your in-progress cart contents. Stays on your device until you clear it or complete checkout.whw_promo_code): any promo code you've entered, so it persists across cart/checkout navigation. Cleared on successful order._ga and _ga_* cookies to distinguish visitors and sessions. Default expiry: 24 months._gcl_au, IDE, and related cookies for conversion tracking and remarketing._fbp and related cookies for tracking page views and conversions for Facebook/Instagram ads._pinterest_ct, _pinterest_sess, and related cookies.Most browsers let you view, manage, and delete cookies and local storage on a per-site basis. Blocking third-party cookies is increasingly the default in modern browsers (Safari, Firefox, Brave) and will not break essential functions of our site.
Under California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Texas (TDPSA), and similar laws, you have the right to opt out of "sharing" or the sale of your personal information for cross-context behavioral advertising. We use advertising pixels that qualify as "sharing" — and you can stop them in any of the following ways:
Option 1: Enable Global Privacy Control (GPC) in your browser.
The GPC signal is a browser-level setting that automatically tells every site you visit that you do not want your information shared for advertising. Once enabled, we honor it automatically. Setup guides:
Option 2: Opt out via the advertising partners directly.
See Section 6 for per-platform opt-out links (Google Ads, Meta, Pinterest).
Option 3: Email us.
Send a request to [email protected] with the subject line "Do Not Sell or Share — Privacy Request." We will process your request within 15 business days. You don't need to create an account or verify your identity for a basic opt-out request, but we may ask for verification if the request involves access or deletion of personal information.
Authorized agents: if you'd like an authorized agent to make this request on your behalf, they can email us with written authorization from you. We may contact you to verify the authorization.
Opting out of sharing for advertising does not affect:
Depending on where you live, you may have the right to:
To make any of these requests, email [email protected]. We will respond within the timeframe required by applicable law (typically 45 days for CCPA, 30 days for GDPR). We may ask you to verify your identity before acting on the request.
California residents have all the rights listed in Section 10, plus the right to know what categories of personal information we have collected, sold, or shared in the past 12 months (see Section 3) and the right to limit the use of "sensitive personal information." We do not collect sensitive personal information as defined by CPRA.
We do not sell personal information for monetary consideration. We do "share" personal information for cross-context behavioral advertising — see Section 8 for opt-out.
In the past 12 months, the categories of personal information we have shared for cross-context behavioral advertising are: identifiers (hashed email), internet activity, commercial information (products viewed and purchased), and inferences. We did this with the categories of third parties listed in Section 5 (Google, Meta, Pinterest).
Residents of these states have substantially similar rights to access, correct, delete, and port their personal information, plus the right to opt out of targeted advertising and sales. See Section 8 for opt-out. Some states (Colorado, Connecticut, Texas, Virginia) require us to honor the GPC browser signal — we do.
If we deny a privacy request, you have the right to appeal. Reply to the denial email or send a new email to [email protected] with subject line "Privacy Request Appeal." We will respond within 60 days.
If you are in the EU, EEA, or UK, you have rights under GDPR including: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing (including to profiling for direct marketing), and the right not to be subject to solely automated decision-making.
Our legal bases for processing:
To exercise any GDPR right, email [email protected]. You also have the right to complain to your local data protection authority.
Our website is a general-audience site and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has submitted information to us, contact [email protected] and we will delete it.
Consistent with the CCPA, we do not knowingly sell or share the personal information of consumers under 16 years of age without affirmative authorization. Buyers under 18 should have parent or guardian permission before placing an order.
We take reasonable steps to protect the information we collect. Our site uses HTTPS for all traffic, payment data is handled by a PCI-compliant processor (Square) and never touches our servers, passwords are stored hashed, and access to internal dashboards is restricted to authenticated team members. No system is perfectly secure, but we work to reduce risk where we can. In the event of a data breach affecting your personal information, we will notify you in accordance with applicable law.
WebHead Workshop operates from the United States. If you are visiting from outside the U.S., your information will be transferred to and processed in the U.S. by us and our service providers. By using our site, you consent to this transfer. The U.S. may have different data protection standards than your country.
We may update this policy from time to time. The date at the top will be updated when that happens. If we make material changes affecting how we use information we already hold about you, we will take reasonable steps to notify you — for example, by posting a banner on the site or emailing customers directly.
Questions about this policy, or requests to exercise your rights, should go to:
WebHead Workshop
Email: [email protected]
Location: South Florida, USA