Privacy Policy
How MazeCrafts Labs, Inc. collects, uses, shares and protects personal information for families, teachers and school accounts.
This Privacy Policy explains how MazeCrafts Labs, Inc. (“MazeCrafts”, “we”, “us”) handles personal information when you visit mazecrafts.com, create a MazeCrafts account, subscribe to a monthly maze-construction kit, buy a wooden labyrinth puzzle, download a printable activity pack, or contact our support and schools teams. It applies to every part of our service, including the learning portal and the community gallery.
We wrote this policy to be read, not skimmed past. If anything here is unclear, write to [email protected] and a human will answer.
1. Who we are and how to reach us
MazeCrafts Labs, Inc. is a Delaware corporation with its operating office at 214 Birchwood Ave, Suite 3, Portland, OR 97214, USA. For the purposes of the EU and UK General Data Protection Regulation we are the controller of the personal information described below. You can reach our privacy team at [email protected] or by telephone at +1 (503) 555-0142 during business hours, Monday to Friday.
2. Information we collect
2.1 Information you give us
- Account details. Your name, email address, password hash, and the display name you choose for the learning portal.
- Order and delivery details. Shipping and billing address, telephone number where a carrier requires one, gift messages, and the age band you select so we send an appropriately graded kit.
- Payment details. Card payments are captured directly by our payment processor. We receive and store only the last four digits, card brand, expiry month and year, and an opaque processor token. We never see or store your full card number.
- School and district information. Institution name, purchasing contact, purchase order numbers, tax exemption certificates, and the classroom counts used to size a site licence.
- Support correspondence. Messages, photographs of damaged or missing parts, and the notes our agents add to your ticket.
- Community gallery submissions. Build photographs, captions and puzzle solutions you choose to publish, plus any moderation history attached to them.
2.2 Information we collect automatically
When you browse mazecrafts.com we record a small set of technical signals: the pages requested, referring page, approximate country and region derived from your IP address, device type, screen size band, and browser family. Our analytics tool is configured to avoid cross-site identifiers and does not build advertising profiles. We also keep short-lived server logs containing IP address and user agent for security, fraud prevention and debugging.
2.3 Information from third parties
Our payment processor returns fraud and risk signals with each transaction. Carriers return delivery scan events. Where a school buys through a reseller or a marketplace, we receive the order and contact details needed to fulfil and support that order.
3. How and why we use information
| Purpose | Categories used | Legal basis (EU and UK) |
|---|---|---|
| Create and administer your account | Account details | Performance of a contract |
| Take payment, prevent fraud, and meet accounting duties | Payment and order details | Contract; legal obligation; legitimate interests |
| Pack, ship and track kits and puzzles | Delivery details | Performance of a contract |
| Answer support requests and send replacement parts | Support correspondence, order details | Performance of a contract |
| Publish and moderate the community gallery | Gallery submissions | Consent; legitimate interests in a safe community |
| Send order, shipment and renewal notices | Account and order details | Performance of a contract |
| Send optional newsletters and teacher resources | Email address, interests | Consent |
| Measure how the site performs and improve activity design | Aggregate usage signals | Legitimate interests |
| Keep the service secure and investigate abuse | Server logs, risk signals | Legitimate interests; legal obligation |
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not run third-party advertising pixels on mazecrafts.com.
4. Children, families and our COPPA posture
Our products are designed for children, but our service is not. MazeCrafts accounts are opened, owned and controlled by adults: a parent, guardian, teacher or school administrator. We do not knowingly collect personal information directly from children under 13, and the checkout, account area and community gallery are all built on the assumption that the person typing is the adult account holder.
Because the Children’s Online Privacy Protection Act shapes how we build, we apply these rules:
- Registration asks only for adult contact details. There is no child profile, no child login, and no field that requests a child’s full name, school class list, photograph or precise location.
- Where a kit is graded by age, we store a coarse band such as “ages 8 to 10” attached to the order, not a date of birth.
- Community gallery captions are moderated before publication. We remove children’s full names, faces where a guardian has not confirmed consent, school names, uniforms and any other detail that could identify a child’s location.
- Teachers using a school site licence must not upload pupil names or pupil-created accounts. Classroom progress features are deliberately aggregate only.
If you believe a child has given us personal information, email [email protected] with the detail you can share. We will delete the information and any derived records within ten business days and confirm in writing.
5. Cookies, analytics and similar technologies
We use a small number of first-party cookies for sign-in, cart state and consent preferences, plus privacy-preserving analytics and payment fraud protection. Full names, purposes and durations are listed in our Cookie Policy, which also explains how to change or withdraw your choices at any time.
6. Service providers and subprocessors
We keep our vendor list short and publish it. Each provider below is bound by a written data processing agreement, may use personal information only on our instructions, and must apply security measures at least as protective as our own.
| Provider | Role | Data involved | Primary location |
|---|---|---|---|
| Stripe | Payment processing, fraud screening, invoicing | Payment tokens, billing address, risk signals | United States, Ireland |
| Shopify | Order management and fulfilment for physical kits | Name, shipping address, order contents | United States, Canada |
| Klaviyo | Transactional and opt-in marketing email | Email address, name, order and engagement events | United States |
| Cloudflare | Content delivery, caching, bot and denial-of-service protection | IP address, request metadata | Global edge network |
| Plausible Analytics | Aggregate, cookie-light site measurement | Page views, referrer, country, device class | European Union |
We also disclose information to carriers to deliver parcels, to our accountants and auditors, to legal advisers where necessary, and to authorities where the law compels us. If MazeCrafts is involved in a merger, acquisition or asset sale, personal information may transfer to the successor entity under the protections of this policy, and we will give notice before any material change of controller.
7. How long we keep information
We keep account records for as long as your account is active, then for twenty-four months after your last order so that guarantees, replacements and warranty claims still work. Order, invoice and tax records are retained for seven years to satisfy accounting and revenue rules. Support tickets are retained for thirty-six months. Server logs are retained for ninety days. Marketing consent records are kept for as long as the consent is relied upon plus three years. Community gallery posts remain published until you or we remove them; on removal we retain a moderation record without the image for twelve months.
8. Your rights and how to exercise them
Depending on where you live you may have the right to access the personal information we hold, to correct inaccuracies, to delete information, to obtain a portable copy, to object to or restrict certain processing, to withdraw consent, to opt out of any sale or sharing of personal information (we do neither), and to be free from discrimination for exercising a right. California residents may also request the categories of information collected, the purposes, and the categories of recipients over the preceding twelve months.
To exercise a right, email [email protected] from the address on your account or write to our Portland office. We will acknowledge within ten days and respond substantively within thirty days, extendable once by a further thirty days where a request is complex, with notice to you. We verify requests by matching the requesting email to the account and, for deletion of order history, by asking for one recent order number. An authorised agent may act for you with written permission that we can confirm with you directly. There is no charge unless a request is manifestly excessive, and we will say so before doing any work.
If you are unhappy with our response you may complain to your supervisory authority. Users in the European Economic Area and the United Kingdom may contact their national data protection authority. We would appreciate the chance to put things right first.
9. International transfers
We operate from the United States, so information you send us is processed there. Where personal information moves out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, and we run a transfer risk assessment for each provider. Copies of the relevant clauses are available on request.
10. How we protect information
Traffic to mazecrafts.com is encrypted in transit with TLS. Databases and backups are encrypted at rest. Access to production systems requires single sign-on with hardware-backed multi-factor authentication and is limited to staff who need it for their role. We log administrative access, review permissions quarterly, patch on a published schedule, and run an annual third-party penetration test. No system is perfect; if a breach affects your personal information we will notify you and the relevant regulators within the timeframes the law requires.
11. Third-party links
Our pages sometimes link to educator blogs, standards bodies and suppliers. Those sites have their own policies and we are not responsible for their practices. Read their notices before sharing information with them.
12. Changes to this policy
When we change this policy we update the effective date at the top of the page and keep the previous version available on request. For changes that materially affect how we use personal information, we email account holders at least fourteen days before the change takes effect and, where consent is required, we ask again rather than assume.
13. Contact
Privacy questions: [email protected]. General enquiries: [email protected]. Schools and districts: [email protected]. Postal mail: MazeCrafts Labs, Inc., 214 Birchwood Ave, Suite 3, Portland, OR 97214, USA. Telephone: +1 (503) 555-0142. Related policies: Terms of Service, Cookie Policy, Subscription and Billing Terms.