Privacy Policy

Last updated: 3 August 2026

This policy explains what personal information thecowboydrummer.com collects, why it is collected, who it is shared with, and the choices you have. It applies to this website and to the merch store operated through it.

The site is operated by Joe Lana Jr. (“The Cowboy Drummer”, “we”, “us”), based in Rochester, New York, USA. For any privacy question, contact [business email address].

What we collect

When you contact us

The contact form collects your name, email address, an optional subject, and your message. We use these only to read and reply to what you sent.

When you join the mailing list

We collect your email address so we can send occasional updates about merch, tour dates and new content. You can unsubscribe at any time using the link at the bottom of every email, and we act on it immediately.

When you place an order

To fulfil an order we collect your name, email address and shipping address. We never see or store your card details — payment is handled entirely by Stripe, and your card number is never sent to our servers.

Automatically

Our hosting provider records standard server logs, including IP address, browser type and pages requested, for security and reliability. We use short-lived IP-based rate limiting to prevent spam and abuse of our forms.

Cookies and tracking

This site sets no advertising or analytics cookies and does not track you across other websites. Stripe may set cookies necessary for fraud prevention during checkout on Stripe’s own pages.

Who we share information with

We do not sell your personal information. We share it only with the service providers needed to run the site, each acting under their own privacy terms:

• Stripe — payment processing. Receives your name, email, billing and shipping details, and your payment information.
• Printful — printing and shipping your merch. Receives your name, email and shipping address.
• Resend — sending and receiving email. Receives your email address and the contents of messages sent to or from us.
• Vercel — website hosting. Processes server logs as described above.

We may also disclose information where required by law, or to protect our legal rights.

How long we keep it

Contact messages are kept for [retention period, e.g. 2 years]. Mailing list entries are kept until you unsubscribe. Order records are kept as long as needed for tax and accounting obligations, typically seven years under US law.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how it is used, and to withdraw consent at any time.

If you are in California, the CCPA/CPRA gives you the right to know what personal information is collected, to have it deleted, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined by that law.

If you are in the UK or EEA, the UK GDPR and GDPR give you the rights listed above and the right to complain to your data protection authority. We rely on your consent for marketing email, on the performance of a contract for orders, and on our legitimate interests for site security and answering enquiries.

To exercise any of these rights, email [business email address]. We will respond within the timeframe required by the applicable law.

Children

This site is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

International transfers

We are based in the United States, and our service providers process data in the United States and elsewhere. If you are outside the US, your information will be transferred to and processed in the US.

Security

The site is served over HTTPS and payment data is handled by Stripe, a PCI-DSS Level 1 certified provider. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

Changes to this policy

We may update this policy from time to time. The “last updated” date at the top will always reflect the current version.

Contact

Questions about this policy or your information: [business email address] or [business mailing address].