Privacy Policy

The Cozy Corner Market is a curated shop for local makers, tucked inside Carlisle's in Alexander City, Alabama. This policy explains what we collect through https://thecozycornermarket.com, why we collect it, who we share it with, and how we look after it.

We are a small local business. We do not sell your personal information, we do not buy it from anyone else, and we do not run advertising networks on this site.

Who we are

This website is operated by Lake Martin Gift Co LLC, doing business as The Cozy Corner Market, at 12 Main St, Alexander City, AL 35010. You can reach us at contact@thecozycornermarket.com or (256) 294-4444. For anything in this policy, email is the fastest way to get a real answer.

What we collect, and when

Almost everything we hold, you typed into a form and pressed send. There are three of them.

The contact form

At /contact we collect your name, your email address, your phone number if you give one, and your message. Your phone number is optional and the form works without it.

The vendor application

At /apply we collect your name, email address, phone number, business name, a description of what you make or sell, how much space you are interested in, any notes you add, and the photos of your work that you upload. We also record how you first arrived at this site (see "How you found us" below).

This is the most detailed information we hold about anyone, and we hold it because we cannot evaluate a booth application without it.

The vendor spotlight survey

At /spotlight, which we send to vendors who have already signed with us, we collect your business name and the name you want to be credited under, your answers to five questions about your work, links to your Facebook page, Instagram, website, or other profile, and a headshot if you choose to upload one.

This survey exists to publish. The form asks you to confirm that we may use your words and photo, and we do not store a response without that confirmation. If you would like something you submitted taken down or changed, email us and we will do it.

How you found us

When you first land on the site, a small script records how you arrived: any campaign tags in the link you clicked, a Google or Facebook click identifier if one was present, the website that referred you if it was an external one, which page you landed on, and the time. This is stored in your browser's local storage under the name cc_attribution, and it is sent to us only if you go on to submit a vendor application. If you never apply, it never leaves your browser.

Clearing your browser's site data for this site removes it. Nothing on the site stops working if you do.

Information collected automatically

Our host and our security tools receive standard technical information with every request, including your IP address, your browser and device type, and the pages you request. This is ordinary web server activity and we use it to keep the site running and to keep spam out.

Cookies and similar technologies

This site uses Google Tag Manager, which loads on every page and may set cookies through the Google services it manages. We use it to understand which pages people visit and to measure whether our advertising reaches makers who go on to apply.

We also use Google reCAPTCHA on all three forms to block automated submissions. reCAPTCHA collects hardware and software information and sends it to Google for analysis, and it operates on every page where a form appears.

The first-touch attribution described above uses local storage rather than a cookie. One cookie is set only for our own staff, when someone signs in to the private admin console. There is no cookie tied to ordinary visitors browsing the site.

You can block or delete cookies in your browser settings, and you can opt out of Google's advertising personalisation at Google My Ad Center. Blocking cookies may affect how some pages behave.

How we use your information

• To answer your message when you contact us.
• To review a vendor application, follow up about it, and arrange a space-selection appointment.
• To administer a vendor's booth, including rent, deposits, and payment reminders.
• To write and publish a vendor spotlight, when a vendor has agreed to one.
• To send vendors news about the market. Vendors can unsubscribe from these at any time, and unsubscribing does not affect any message we need to send about a booth or a payment.
• To understand which marketing brings makers to us, so we spend a small budget sensibly.
• To keep the site secure and to meet our tax and legal obligations.

We do not use your information to make automated decisions about you, and we do not use it to train artificial intelligence models.

Who we share it with

We share personal information with the service providers that run parts of this business for us, and with no one else except as described at the end of this section. Each of them receives only what their job requires.

• Supabase hosts our database and stores the photos you upload. Every form submission is stored here.
• Vercel hosts the website and processes the requests your browser makes.
• Google provides reCAPTCHA and Tag Manager, described above.
• Resend delivers our transactional email, such as your application confirmation and our notifications to ourselves.
• Brevo delivers vendor news and announcements. Only vendor contact details go here, never contact form messages.
• Cal.com handles booking for in-store vendor appointments.
• Stripe processes card and bank payments from vendors. Payment details are entered on Stripe's own secure pages, described below.

We may also disclose information if the law requires it, if we need to enforce our agreements, or if the business is sold or transferred, in which case your information would move with it and this policy would continue to apply until you were told otherwise.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Payments

Vendor deposits and booth rent are processed by Stripe. When you pay, you enter your card or bank details on a page hosted and secured by Stripe. We never see or store your full card number or your bank account number. What we keep is the amount, the date, whether it succeeded, and the last few digits of the payment method so we can tell one payment from another.

Stripe handles your payment details under its own privacy policy, which you can read at stripe.com/privacy. If you pay by bank transfer, Stripe may email you a payment authorisation confirmation directly, because the rules governing bank debits require it.

How long we keep it

Contact form messages are kept while we may still need the thread, and cleared out periodically after that. Vendor applications are kept for as long as we are considering them and, for approved makers, for as long as the vendor relationship lasts. Records tied to money, including deposits, rent, and payments, are kept for as long as tax and accounting rules require. Vendor spotlight responses are kept while the vendor is with us and while the published piece remains online.

If you want your information removed sooner, ask us. Where we are not required to keep it, we will delete it.

How we protect it

The site is served over HTTPS. Our database enforces row level security, which means the public website has no read access to submissions at all; every read happens through a private, authenticated path. Uploaded photos live in private storage and are viewable only through short-lived links we generate. The admin console is password protected, is not linked from anywhere on the public site, and sits behind a session check on every request. Payment credentials never touch our servers.

No system is perfectly secure, and we will not claim otherwise. If we ever discover a breach affecting your information, we will tell you and act quickly.

Your choices

• Ask what we hold. Email us and we will tell you what we have about you.
• Correct it. If something is wrong, tell us and we will fix it.
• Delete it. We will delete what we are not required to keep.
• Unsubscribe. Every marketing email has an unsubscribe link, and it works.
• Clear attribution. Clearing site data in your browser removes the first-touch record described above.

Depending on where you live, you may have additional rights over your personal information. We extend the choices above to everyone who asks, without requiring you to establish that a particular law applies to you. We will not treat you differently for exercising them.

Children

This site is meant for adults, and the vendor application in particular assumes you can enter into a lease. We do not knowingly collect information from children under 13. If you believe a child has sent us something, email us and we will remove it.

Changes to this policy

If we change how we handle your information, we will update this page and change the date at the top. If a change is significant, we will say so rather than leave you to spot it.

Contact us

Lake Martin Gift Co LLC, doing business as The Cozy Corner Market
12 Main St, Alexander City, AL 35010
contact@thecozycornermarket.com
(256) 294-4444