Privacy policy

“Lost Mountain Engraving”, “we” and “us” mean Lost Mountain Engraving LLC, the small business in Logan, Utah, USA that runs this website and makes your bottle. We are responsible for the personal information described here.

When you create an account. Your name, email address and, if you add one, your phone number. If you sign in with Google, Google shares your name, email address and profile picture with our sign-in provider. You can use the studio and check out without an account.

When you order. Your name, shipping address, email address and phone number (if given), what you ordered, the price, any discount code, and the order’s status and tracking. Guests who check out without an account get a private link to their order by email. When you tick the boxes at checkout, we record with your order which versions of our Terms of Service and this policy you agreed to, and when.

When you pay. Payment happens on Stripe’s secure checkout page. Your card number and billing details go to Stripe, not to us — they never touch our servers. We receive confirmation that you paid, the amount and a payment reference.

Your designs. The design you build, including photos or graphics you upload, text you add, and the places, dates, coordinates or routes (for example a GPX file) behind a map or night-sky design. See section 5.

When you contact us. Your name, email address and message from the contact form, plus the page you sent it from, your browser type and (if you are signed in) your account ID. If you email us or reply to one of our emails, we keep that conversation with your order.

Company orders. If your employer orders bottles for its team through us, we hold the company’s name, logo and contact person, the names and email addresses of its admins, and the names and email addresses of the employees it invites, along with what each person designed and ordered.

When you send a bug report. Bug reports are off unless you switch them on under “Bug reports” in the site menu; until then nothing is captured. A report holds what you write and, if you give it, your name and email address. If you leave “Include page diagnostics” ticked, it also holds technical details: the page, screen size, browser, language, time zone, recent errors and failed requests, a picture of the bottle on screen, and the design in the studio at the time. Cloudflare Turnstile checks that a person, not a bot, sent it.

Automatically. Like every website, our servers and our network provider see your IP address and basic request details (such as your browser type) when you visit. We use these to deliver pages, stop abuse and keep the site secure.

• To make, engrave, pack and ship your order, and to show you its status.
• To take payment and, when needed, issue refunds.
• To send the emails an order needs: your receipt, your guest order link, shipping notices, and messages about your design (for example if we need to check something before engraving). Company admins and invited employees receive the emails for their company’s program.
• To answer you when you contact us.
• To check uploaded images against our content rules before we engrave them (see section 5).
• To prevent fraud and abuse, keep the site secure, and meet our legal and tax obligations.

We do not send marketing or newsletter email, we do not send text messages, and we do not use your information for advertising. If that ever changes, we will update this policy first and give you a way to opt out.

We do not sell your personal information or share it for advertising. We share it only with the service providers that help us run the business, and only what each one needs:

• Stripe — payment processing. Stripe collects your payment details directly on its checkout page.
• Clerk — account sign-in (and Google, if you choose to sign in with Google).
• Shippo and the shipping carriers — shipping rates, labels and tracking. They receive your name, shipping address and, where given, phone number and email address.
• Zoho Mail — the email service we send and receive our email through.
• Amazon Web Services (Rekognition) — automated screening of uploaded images for sexual content before engraving.
• Cloudflare — our network and security provider. All traffic to the site passes through Cloudflare, which protects it from attacks and delivers it quickly. Its Turnstile check screens bug reports for bots.
• Backblaze — stores our encrypted backups.
• Map, place-search and font services. When you search for a place or move a map in the studio, your search text and the map area are sent to the services that supply those results — the U.S. Census Bureau geocoder, Photon (komoot), Geoapify, OpenStreetMap Nominatim and Overpass servers, OpenFreeMap, Open-Meteo, the U.S. Geological Survey, NASA and Amazon Web Services’ open elevation data. Some of these requests go straight from your browser, so those services also see your IP address. Parts of the studio load typefaces from Google Fonts, which likewise sees your IP address. These services receive no account or order details.

We may also disclose information if the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganization of the business (in which case this policy would continue to apply to it).

Where designs live. Your design files and uploaded images are kept in private storage on our own server; they are not public. The studio also keeps your work-in-progress in your own browser so you don’t lose it.

Screening. Before we engrave an uploaded photo or graphic, it is checked automatically by Amazon Rekognition for sexual content, and a person at Lost Mountain Engraving may review it. When you upload a photo or graphic, we ask you to tick a box certifying that you have the right to use it, and we keep a record of that, and when you ticked it, with your order.

Location data. Map and night-sky designs are built from a place, date, coordinates or a route you choose. A route file can reveal where you live, work or train, so think about the start and end of a route before you order it. We use this data only to make your design.

Shared links. If you are signed in and choose to share a design, we create a link that anyone who has it can open — no sign-in needed. A shared page shows the design image and the details you put on it, such as your first name, a title, a place name, a date and coordinates. Shared links do not expire. You can remove one at any time with “Stop sharing” in the window where you shared it; after that the link no longer opens for anyone. For a link you can no longer reach there, contact us and we will take it down.

You can let an AI assistant you already use, such as ChatGPT or Claude, help design your bottle. You choose to connect it, to one bottle at a time, and you can disconnect it whenever you like with “Reset AI” in the studio.

What the assistant can see. Only the bottle you connect it to: that design and the pictures on it. It cannot see your account, your orders, your address, your payment details or your other bottles, and it cannot place an order or pay. You review and order your bottle on our website yourself.

What we keep. To run the connection we keep a short record: which bottle it is linked to, the assistant’s name (for example “ChatGPT”), when it connected and was last used, and scrambled (hashed) copies of the keys it uses and of the anonymous chat ID its app sends, so that one chat stays on one bottle. We never receive your conversation. We only receive the design changes your assistant asks us to make, such as words to engrave, a place for a map, or a picture it drew or you sent. Pictures are screened like any other upload (see section 5).

What we give AI companies. Nothing beyond what your own assistant asks to see while it works on your bottle. We do not sell or give your information to AI companies, or to anyone else. Your conversation itself is between you and the company that runs your assistant, under that company’s privacy policy.

When it ends. The connection ends when you press “Reset AI”, when the design session ends, or after a while unused. After that the assistant can no longer reach your bottle, and we delete the connection record about a week later.

We use only the cookies the site needs to work. We use no advertising cookies and no third-party tracking cookies.

The site also uses your browser’s local storage to keep your cart, your studio work-in-progress, your recent orders on this device and a few display preferences. That data stays in your browser; clearing your site data removes it.

We don’t run advertising or cross-site tracking tools. Cloudflare, our network provider, may collect aggregate, cookieless page-view analytics (such as how many visits a page gets) that do not identify you.

Because we don’t track you across other websites, we don’t change how the site behaves when your browser sends a “Do Not Track” signal — there is no tracking for it to turn off.

• Orders — we keep order records, including your design, for as long as we need them to support your order and meet our tax and accounting obligations.
• Guest order links expire after 90 days; you can ask us for a new one.
• Accounts — until you ask us to delete yours.
• Deletion requests — when we erase your personal information we remove your name, contact details and street address from our records. We keep the city, state, ZIP code and country of past shipments because tax rules require it, and we may keep records we are legally required to hold.
• Backups — our encrypted backups roll over on a fixed schedule, so deleted information can remain in them for up to about seven months before it is overwritten.
• Shared links — until you ask us to remove them (see section 5).

You can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong;
• delete your information and your account (subject to the records we must keep, above);
• remove a shared design link.

For any of these, contact us. We will confirm the request comes from you (usually by replying to the email address on your account or order) and answer within 30 days. We won’t treat you differently for asking.

This site is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we will delete it.

The site is served only over encrypted connections (HTTPS). Design files are kept in private storage, access to customer records is limited to the people who need it to fill orders, our backups are encrypted, and card details never reach our servers. No system is perfectly secure, though, so we can’t promise that information will never be accessed without permission. If a breach affects your personal information, we will tell you as the law requires.

We are based in the United States and ship to U.S. addresses. Our own servers and our backups are in the United States, and our service providers process data mainly in the United States. By using the site from elsewhere you understand your information will be handled in the United States.

If we change this policy we will post the new version here and update the date at the top. If a change materially affects how we use information we already hold, we will tell you by email or on the site before it takes effect.

Questions or requests about your privacy: use our contact form or email [email protected].

Lost Mountain Engraving LLC · Logan, Utah, USA