§privacy policy
Belmont Batcave LLC, a North Carolina limited liability company ("Belmont Batcave," "we," "us," or "our"), runs the store and music venue at 2603 Boundary St, Belmont, NC, the website at belmontbatcave.com, and the Belmont Batcave app for iPhone. This policy explains what information we collect, why we collect it, who we share it with, and the choices you have. We keep it short and we don't sell your data.
01Who we are
Belmont Batcave is an independent alternative store and vendor collective in Belmont, North Carolina, operated by Belmont Batcave LLC. We are the party responsible for the information collected through the website, the app, and our rewards program. You can reach us any time at [email protected].
02What this policy covers
This one policy covers all three places we hold information about you:
- The website at belmontbatcave.com, including the online shop, the newsletter and vendor applications.
- The Belmont Batcave app for iPhone, which is free, and which you can browse and buy from as a guest without ever making an account.
- The rewards program, whether you joined in the shop at the register or in the app.
It does not cover our vendors' own businesses. Vendors sell their own goods through us, and anything you arrange with a vendor directly, off our website and outside our app, is between you and them.
03What we collect
If you just look around
You can browse the shop, on the website or in the app, without giving us anything and without making an account. We do not require you to sign in to look, and we do not build a profile of you if you don't.
Information you give us
- Newsletter signups — your email address, and the page or form you signed up from.
- Vendor applications — your name, business/brand name, email, phone number (optional), Instagram handle (optional), a description of what you make or sell, your message, and any images you choose to upload with your application.
- An account, if you make one: your name, your email address, an optional phone number, and a password. Passwords are stored scrambled (hashed), never in a form we or anyone else can read back.
- Sign in with Apple, if you use it instead of a password: Apple sends us a unique identifier for you, and, if you allow it, your name and an email address. That address may be Apple's private relay address rather than your real one, and that is fine with us. We never receive your Apple password.
- Orders — what you bought, what it cost, tax, and the shipping name and address you give us. We keep the address as it was at the time of the order, because it is part of the receipt.
- Saved addresses, if you choose to save one for next time. These live in your account and are separate from your order history.
- Your profile, if you set one up: a username, a display name, a short bio, and a profile picture.
- Reviews, follows and likes you leave in the app.
- Messages you send to a vendor or to Batcave staff through the app, and anything you report to us.
Information collected automatically
- When you submit a form, we record your IP address, your browser's user-agent string, and a timestamp. We use this to prevent spam and abuse and to keep a basic security log.
- Our web server keeps standard request logs, from the website and from the app. The app identifies itself and its version number so we can tell an out-of-date copy to update.
- We do not run advertising trackers, third-party analytics, or behavioral profiling, on the site or in the app. The app contains no advertising and no analytics SDK. We do not track you across other companies' apps or websites, and we never ask for permission to, because we have no use for it.
- We do not send push notifications and the app does not ask for permission to. If that changes we will update this policy first.
We never see or store your full payment card number. See section 06.
04Cookies & tracking
We try to keep the site light. Here's the full picture:
- No advertising or analytics cookies. We don't use Google Analytics, ad pixels, or cross-site tracking.
- Local storage (not a cookie). When you dismiss or sign up through our newsletter pop-up, we store a small flag in your browser so we don't show it again for about 30 days. This never leaves your device and isn't shared with us.
- Google Fonts. Our typefaces load from Google Fonts. Your browser requests the font files from Google, which means Google may receive your IP address as part of that request. Google states it does not use these requests to build advertising profiles.
- Instagram embed. Our home page embeds an Instagram post. When that embed loads, Instagram/Meta may set its own cookies and receive your IP address and page information under Meta's own privacy policy, which we don't control.
- In the app, we store your sign-in token and your basket on your own device so you stay signed in and don't lose what you picked out. Signing out removes the token.
You can block or delete cookies and local storage in your browser settings. Blocking them won't break the core site. Because we don't track you across sites, we honor "Do Not Track" by simply not doing it.
05How we use your information
- To take, ship and account for your order, and to send you a receipt and updates about it.
- To run your account and your rewards balance, and to show you your own history.
- To send you our newsletter when you ask us to (new vendors, drops, and event invites).
- To pass messages between you and a vendor, and to deal with anything reported to us.
- To review and respond to vendor applications.
- To protect the shop against spam, abuse, and fraud, and to keep it secure.
- To operate, maintain, and improve the website and the app.
- To comply with the law, including tax and accounting rules, and to enforce our Terms of Use.
We only process your information where we have a lawful basis to do so, typically your consent (newsletter), performance of a contract with you (your order), our legitimate interest in running the store and keeping it secure, or to take steps you asked for (reviewing your application).
We do not use your information to advertise to you elsewhere, and we do not sell it.
06Payments
Card payments, on the website and in the app, are processed by Stripe. Your card details go directly to Stripe and are entered on Stripe's own payment screen. We never receive, see or store your full card number. What comes back to us is the outcome of the payment, the amount, and the last few digits and card brand so you and we can tell one payment from another.
If you pay with Apple Pay, Apple passes a device-specific token to Stripe rather than your card number, and the same is true for us.
Stripe is an independent controller of the payment information it handles, including data it collects to detect fraud, under Stripe's own privacy policy. Refunds, chargebacks and disputes are handled through Stripe as well.
07Rewards & your member card
Joining our rewards program is optional and free. When you join, we create a member number and a barcode for you, and we keep a running record of the points you earn and spend.
- Points are earned on things you buy. When you scan or give your member number at the register, that purchase is attached to your account so it can earn, which means we record the sale and its total against your membership. The same happens automatically for orders you place while signed in.
- Points can never be bought, and rewards are always physical goods, in-store discounts or in-person experiences.
- The points record is permanent and append-only. Corrections are added as new entries with a reason, rather than by rewriting or deleting history, so your balance can always be explained to you.
- Your member barcode is stored on your device so it still scans when there is no signal in the shop. It is only your member number.
08Your profile, reviews and follows
Some of what you do in the app is meant to be seen by other people. Here is exactly which parts:
- Public: your username, your profile picture, your bio, and any review you leave, shown with the vendor's listing.
- Your first name only. Where a name is shown instead of a username, we show your first name and never your surname, even though we hold your full name on your account.
- Never public: your email address, your phone number, your addresses, your order history and your points balance.
- Follows and likes. A vendor can see how many followers they have, and an item can show how many people liked it, but we do not show a vendor the list of who follows them, and we do not show anyone the list of who liked an item.
- Profile pictures are re-encoded when you upload them, which strips the location and camera data that phones attach to photos. A selfie taken at home does not publish where your home is.
- Usernames are unique across the whole shop, shared by shoppers and vendors, so a name that is taken cannot be reused while it is in use.
You can change your username, edit or remove your bio and picture, and delete a review you left, at any time.
09Chat and direct messages
The vendor portal has a chat area: shared rooms that every active vendor can read, and one-to-one direct messages between vendors, or between a vendor and Batcave staff. The Belmont Batcave app also has an inbox, where a shopper and a vendor can message each other about an item or an order.
Batcave staff can read direct messages, in the vendor portal and in the app. We do this to run the collective and to deal with reports, not to browse for the sake of it, and every time a member of staff opens a direct conversation we record who opened it and when. A direct message is private from everybody else: nobody except the two people in the conversation and Batcave staff can read it. You are told this in the app, above the message box, as well as here.
You can block someone you do not want to hear from. Blocking stops messages in both directions and removes any follow between you. You can also report a message, or a listing, to us. A report tells us who sent it and includes a copy of what you reported, so that we can still act on it after the original is edited or taken down.
Please treat messages as you would a conversation in the shop rather than a private channel. Do not send payment card numbers, bank details, passwords or government ID through them. If you need to send us something sensitive, email [email protected] instead.
Photos posted in chat are deleted after 30 days. Messages are kept for 6 months and then removed automatically. A message you report, or that staff hide, stays on record so we can deal with it.
10Email & the newsletter
We send our newsletter, and emails about your account and your orders, using Resend, an email delivery provider that processes sending on our behalf. Every newsletter includes a one-click unsubscribe link and our physical mailing address, in line with the U.S. CAN-SPAM Act. You can unsubscribe at any time, and we'll stop, no hard feelings. If you unsubscribe, we keep a minimal record of your email's unsubscribed status so we don't email you again by mistake.
Receipts, order updates, address confirmations and password resets are not marketing and cannot be turned off while you have an account or an open order. They are the record of something you asked us to do.
11Who we share it with
We do not sell, rent, or trade your personal information. We share it only with:
- Our vendors, and only what they need: if you buy from a vendor, they are told what sold and the shipping details needed to send it. If you message a vendor, they see your username, your profile picture and your first name.
- Stripe, to take payment, issue refunds and handle disputes.
- Apple, if you use Sign in with Apple or Apple Pay, under Apple's own privacy policy.
- Service providers who help us run the shop: our hosting provider, Cloudflare (security/DNS/CDN), and Resend (email delivery). They process data only to provide their service to us.
- Legal authorities, if we're required to by law, a valid legal request, or to protect the rights, safety, and property of Belmont Batcave, our visitors, or others.
- A successor, if the business is ever sold or transferred, subject to this policy.
12How long we keep it
- Newsletter: until you unsubscribe or ask us to delete you.
- Vendor applications: for as long as needed to review and follow up, after which we may delete or archive them.
- Orders, payments and rewards history: for as long as tax, accounting and payment-dispute rules require us to keep the records of a sale. This is the one category we cannot delete on request, and it is why deleting your account empties your details out of it rather than erasing the sale.
- Saved addresses: until you delete them, or until you delete your account, whichever comes first.
- Messages: 6 months. Chat photos: 30 days. Reported items are kept while we deal with them.
- Security logs: a limited time for abuse-prevention and troubleshooting.
13How we protect it
We use reasonable technical and organizational safeguards, including encryption in transit (HTTPS/TLS), hashed passwords, short-lived sign-in tokens, access controls, and rate limiting, to protect your information. Signing out, or deleting your account, signs out every device holding a session. No method of transmission or storage is 100% secure, but we take protecting your information seriously.
14Your account, and deleting it
You can delete your account yourself, from inside the app, under Account. You do not have to email us and you do not have to ask. Here is exactly what happens when you do, so there are no surprises:
- Deleted outright: your saved addresses, and your username, which goes back into the pool for someone else.
- Cleared from your record: your name, email address, phone number, password and Apple sign-in link. What is left cannot be used to identify you or to reach you.
- Withdrawn: your reviews stop being shown, and your follows and likes are removed, so you do not stay in anyone's follower count after you have gone.
- Closed: your rewards membership, including any remaining points. Points are not refundable and do not survive deletion, so spend them first if you want them.
- Kept: the sales themselves, because a receipt is an accounting record we are required to hold, and the vendor was paid against it. Those records keep the shipping address that was on the order at the time.
- Signed out everywhere, on every device, within a few minutes.
Deleting your account does not unsubscribe you from the newsletter, because that is a separate consent with its own unsubscribe link in every email. Use the unsubscribe link, or ask us, if you want that gone too.
Deletion is permanent. We cannot restore an account, its points or its history afterwards.
15Your choices & rights
You can ask us to access, correct, or delete the personal information we hold about you, or to stop using it, at any time. Depending on where you live, you may have specific rights:
- California residents: you have the right to know what personal information we collect and to request its deletion. We do not sell or "share" your personal information as those terms are defined under California law, so there is no need to opt out of a sale.
- EU/UK residents: where the GDPR/UK GDPR applies, you have rights to access, rectify, erase, restrict, and port your data, and to object to processing or withdraw consent.
To exercise any of these, email [email protected] and tell us what you'd like. We'll verify your request and respond within a reasonable time. We won't discriminate against you for exercising your rights.
16Children
The website and the app are intended for a general audience and are not directed to children under 13. We don't knowingly collect personal information from children under 13, and you must be 13 or older to make an account. If you believe a child has given us information, contact us and we'll delete it.
17Other sites & links
Our site links to and embeds third-party services (Instagram, TikTok, Facebook, Google/Apple Maps). Their privacy practices are their own and are governed by their policies, not this one.
18Changes to this policy
We may update this policy from time to time. When we do, we'll change the "last updated" date at the top. Material changes will be reflected here, so check back occasionally.
19Contact us
Questions, requests, or concerns about privacy?
Belmont Batcave LLC
2603 Boundary St, Belmont, NC 28012
[email protected] · (980) 990-3223
⌇ See also our Terms of Use and Accessibility Statement.