Privacy policy

Last updated: September 29, 2026

This Privacy Policy explains how BOND & GRAIN LLC, a Wyoming limited liability company operating as BOND&GRAIN ("BOND&GRAIN", "we", "us", or "our"), collects, uses, discloses, and protects your personal information when you visit bondandgrain.com, purchase from us, request a made-to-measure jacket, join our affiliate program, subscribe to our communications, or otherwise interact with us (together, the "Services").

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If there is a conflict between this Privacy Policy and our Terms of Service, this Privacy Policy controls with respect to the collection, use, and disclosure of your personal information.

1. Who We Are

BOND & GRAIN LLC is the business responsible for your personal information and, for the purposes of the EU and UK General Data Protection Regulation (GDPR), is the data controller. You can reach us at:

BOND & GRAIN LLC
5830 E 2nd St, Ste 7000 #36559
Casper, WY 82609, United States
Privacy requests: accounts@bondandgrain.com
Order and customer support: support@bondandgrain.com

2. Personal Information We Collect

"Personal information" means information that identifies, relates to, or can reasonably be linked to you. It does not include information that has been de-identified or aggregated so that it can no longer identify you. Depending on how you use the Services, we collect the following:

Information you give us

Contact and order details: your name, billing address, shipping address, email address, phone number, and the products, sizes, and options you order.
Payment information: payment card or wallet details you enter at checkout. Card data is collected and processed directly by our payment processors on a secure checkout; we do not store full card numbers.
Account information: your login email, password, saved addresses, order history, and preferences if you create an account.
Sizing and made-to-measure information: body measurements, height and fit preferences, photos you choose to send for fit review, and design material you submit for a custom jacket, such as reference images, sketches, logos, artwork, patches, embroidery text, and colour choices.
Communications: the content of messages you send through our contact form, by email, by text message, or through social media, including your name, email address, phone number, and any attachments.
Marketing preferences: your email address and/or mobile number when you subscribe to our newsletter or text messages, and your subscription and unsubscribe choices.
Returns, exchanges, and claims: order numbers, reasons for return, photos of you wearing the jacket and your body measurements if you submit a fit verification request, and photos of items, packaging, or shipping labels you send us for damaged, defective, or incorrect items. You do not need to include your face in fit photos.
Affiliate and partner information: if you apply to or join our affiliate program, your name, email address, social media handles and audience details, website, country, PayPal account email for payouts, tax information where we are legally required to collect it, and your referral, sales, and commission records.
Reviews and content: product reviews, photos, or content you submit or tag us in, together with your public profile name.

Information we collect automatically

Device information: IP address, browser type and version, operating system, device type, language settings, and approximate location derived from your IP address.
Usage information: pages and products viewed, items added to your cart, search terms, referring pages, links and emails clicked, time spent on pages, and the dates and times of your visits.
Affiliate referral information: whether you arrived through a partner's link or used a partner's code, so that we can credit the correct partner.
Technical and error data: diagnostic information generated when a page or feature fails to load or function correctly.

Information from third parties

Shopify and payment processors: transaction confirmations, fraud-risk indicators, and, if you use Shop Pay, information you have chosen to share from your Shop account.
Shipping carriers and tracking providers: delivery status, delivery confirmations, and exception notices.
Affiliate partners and social platforms: referral attribution data and information you make available to us when you interact with our social media accounts.

We do not intentionally collect sensitive personal information such as government identification numbers, health information, precise geolocation, or biometric data. Photos and measurements you send for sizing or fit verification are used only to review fit and, where applicable, build your jacket; we do not use them to identify you or to create biometric templates. Please do not send us sensitive information we have not requested.

3. How We Use Your Personal Information

To process and fulfil orders: to take payment, confirm your order, confirm sizing, produce made-to-measure jackets, pack and ship your order, send order and shipping updates, and handle cancellations, returns, exchanges, and refunds.
To provide customer support: to answer questions, review fit requests and damage, delivery, and return claims, and communicate with you about your order or request.
To run our affiliate program: to review applications, track referrals and sales, calculate and pay commissions, share partner resources, and meet tax and reporting obligations.
To send marketing: to send newsletters, new drops, and offers by email or text message where you have subscribed or where the law otherwise permits, and to measure how our messages perform.
To advertise and measure: to understand how visitors find and use the Services and, where permitted, to show you relevant BOND&GRAIN advertising on other websites and platforms.
To operate, secure, and improve the Services: to maintain the website, fix errors, analyse performance, develop products and sizing, and detect, prevent, and investigate fraud, chargebacks, abuse, and security incidents.
To comply with law and protect our rights: to keep tax and accounting records, respond to lawful requests from authorities, enforce our Terms of Service and other policies, and establish, exercise, or defend legal claims.

We do not use automated decision-making that produces legal or similarly significant effects on you.

4. Legal Bases for Processing (EEA and UK Visitors)

If you are in the European Economic Area or the United Kingdom, we process your personal information on the following legal bases:

Performance of a contract: to process your order, produce custom pieces, deliver your purchase, handle returns, and administer your account or affiliate relationship.
Legal obligation: to keep tax, accounting, and transaction records and to respond to lawful requests.
Legitimate interests: to secure the Services, prevent fraud, improve our products and website, provide customer support, and send marketing to existing customers about similar products where the law allows. We balance these interests against your rights, and you may object at any time.
Consent: for non-essential cookies, targeted advertising, and marketing messages where consent is required. You can withdraw consent at any time without affecting processing carried out before withdrawal.

5. How We Disclose Personal Information

We disclose personal information only as described below:

E-commerce platform: our store is hosted by Shopify, which processes personal information to provide checkout, payments, hosting, and related services.
Payment processors: Shopify's payment processing partners, Shop Pay, PayPal, and any other payment method you select at checkout, to process payments, refunds, and fraud checks.
Shipping and tracking: DHL, FedEx, USPS, and our order-tracking provider (17TRACK), to deliver your order and provide tracking updates. For international orders, carriers may share information with customs authorities.
Customer communications and CRM: GoHighLevel (LeadConnector), which we use to manage contact forms, customer and affiliate enquiries, and our email and text-message communications.
Analytics, advertising, and site performance: Google (including Google Tag Manager and Google Merchant Center) and other analytics and advertising partners, to measure site traffic and advertising performance and to show BOND&GRAIN advertising.
Error monitoring: Sentry, to identify and fix technical errors on the website.
Affiliate partners: when you purchase through a partner's link or code, we share limited order information, such as order value and date, with that partner so they can see their commissions. We do not share your name, contact details, or address with affiliates.
Production partners: for made-to-measure orders, we share your measurements and design specifications with the craftspeople who make your jacket, only as needed to produce it.
Professional advisers: accountants, lawyers, and insurers, where necessary for our business.
Legal and safety: law enforcement, regulators, courts, or other parties where required by law, or where necessary to protect the rights, property, or safety of BOND&GRAIN, our customers, or others.
Business transfers: in connection with a merger, acquisition, financing, reorganisation, or sale of all or part of our business, subject to this Privacy Policy.
With your direction or consent: in any other case where you ask us to share information or give your consent.

Our service providers may use your personal information only to perform services for us, except where a provider acts as an independent controller under its own privacy policy, as Shopify does for certain features described in Section 6.

Text messaging: no mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent are not shared with any third party, except with service providers that help us deliver our messages.

6. Our Relationship with Shopify

Shopify hosts our store and processes personal information about your use of the Services to provide and improve them. Information you submit is transmitted to and stored by Shopify and its sub-processors, which may be located outside your country. We also use certain Shopify features that combine information about your interactions with our store with information from other merchants and from Shopify. For those features, Shopify is responsible for the processing of your personal information, including for responding to requests to exercise your rights. To learn more, see the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

7. Cookies and Similar Technologies

We and our partners use cookies, pixels, local storage, and similar technologies to operate the Services and understand how they are used. These fall into the following categories:

Strictly necessary: required for core functions such as your cart, checkout, security, and remembering your privacy choices. These cannot be switched off.
Preferences: remember choices such as your region and currency.
Analytics and performance: help us understand traffic, page performance, and errors.
Marketing: measure advertising performance, attribute affiliate referrals, and help show you relevant BOND&GRAIN advertising.

Where the law requires it, we ask for your consent before placing non-essential cookies, and you can change your choices at any time. You can also block or delete cookies through your browser settings; if you block strictly necessary cookies, parts of the store, including checkout, may not work.

Global Privacy Control: if your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser, and, where we can link it to your customer account, for that account. Other than GPC, we do not currently respond to "Do Not Track" browser signals. Learn more at globalprivacycontrol.org.

8. Email and Text-Message Marketing

Email: you can unsubscribe from marketing emails at any time by clicking the unsubscribe link in any email or by contacting us. After you unsubscribe, we will still send transactional messages about your orders, returns, or account.

Text messages: if you opt in to receive text messages from BOND&GRAIN, you agree to receive recurring automated marketing and order-related messages at the number you provide. Consent is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe at any time, or HELP for help. Carriers are not liable for delayed or undelivered messages.

9. Affiliate Program

If you apply to or participate in our affiliate program, we use your information to review your application, communicate with you, track referrals made through your link or code, calculate commissions, and issue payouts through PayPal. Where tax law requires, we collect and keep the tax information needed to report payments. We may display your public social media content, with credit, on our own channels in line with the affiliate program terms. If your application is declined or you leave the program, we keep your records only as long as described in Section 11.

10. Children's Privacy

The Services are intended for adults and are not directed at children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us at accounts@bondandgrain.com and we will delete it. We do not sell or share the personal information of anyone we know to be under 16.

11. How Long We Keep Your Information

We keep personal information only for as long as needed for the purposes described in this Privacy Policy, including to meet legal, tax, and accounting requirements:

Order, payment, return, and refund records: 7 years from the date of the transaction, to meet tax and accounting obligations and to handle warranty and chargeback matters.
Customer accounts: for as long as your account is active. If you ask us to delete your account, we delete it, except for the order records described above.
Made-to-measure measurements, fit photos, and design files: 3 years after your most recent custom order, so that we can support repairs, adjustments, and repeat orders, unless you ask us to delete them sooner.
Fit verification photos and measurements (returns and exchanges): 3 years after the request is resolved, to support customer service, dispute handling, and legal claims, unless you ask us to delete them sooner and we are not required to keep them.
Customer support messages and claims: 3 years after the enquiry is closed.
Marketing subscriptions: until you unsubscribe. We keep your email address or phone number on a suppression list after you unsubscribe so that we do not contact you again.
Affiliate records: for the duration of your participation and 7 years after your final payout, for tax and accounting purposes. Declined applications are deleted within 12 months.
Analytics and cookie data: according to the lifespan of each cookie or tool, generally no longer than 26 months.

When information is no longer needed, we delete it or de-identify it so that it can no longer be linked to you.

12. How We Protect Your Information

We use reasonable administrative, technical, and physical safeguards to protect personal information, including encrypted (HTTPS) connections, a PCI DSS-compliant checkout provided by Shopify, and access controls that limit personal information to people and providers who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please do not send payment card details or other sensitive information to us by email, text message, or social media.

13. International Transfers

BOND&GRAIN is based in the United States, and we ship worldwide. Your personal information will be transferred to, stored, and processed in the United States and in other countries where our service providers and production partners operate, which may have different data protection laws from your own. When we transfer personal information from the EEA, the United Kingdom, or Switzerland, we rely on an adequacy decision where one applies, including the EU-U.S. Data Privacy Framework and its UK and Swiss extensions for certified recipients, or on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

14. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights:

Access / know: to confirm whether we process your personal information and to obtain a copy of it, including the categories of information, sources, purposes, and recipients.
Correction: to correct inaccurate personal information.
Deletion: to ask us to delete your personal information, subject to legal exceptions such as our tax record obligations and our need to defend disputes and legal claims.
Portability: to receive your personal information in a portable format.
Opt out of sale, sharing, and targeted advertising: to stop us from "selling" or "sharing" your personal information or using it for targeted advertising, as those terms are defined by law.
Restriction and objection (EEA/UK): to ask us to restrict processing, or to object to processing based on our legitimate interests, including direct marketing.
Withdraw consent: where we rely on consent.
Non-discrimination: we will not deny you goods or services, charge you a different price, or provide a different quality of service because you exercised your rights.

How to make a request

Email accounts@bondandgrain.com with the subject line "Privacy Request", stating the right you wish to exercise and the email address you use with us. To opt out of targeted advertising and the sharing of your information, you can also use our Your Privacy Choices page or enable Global Privacy Control in your browser.

To protect your information, we will verify your identity before completing a request, usually by confirming details linked to your orders or account. You may use an authorised agent to submit a request on your behalf; we will require written proof of the agent's authority and may ask you to verify your identity directly with us.

We respond within the time required by applicable law: within 45 days for requests under U.S. state privacy laws, which may be extended once by a further 45 days where reasonably necessary, and within one month for requests under the GDPR, which may be extended by up to two further months for complex requests. We will tell you if we need an extension and why.

Appeals

If we decline your request, you may appeal by emailing accounts@bondandgrain.com with the subject line "Privacy Appeal". We will respond to your appeal in writing within 60 days, explaining our decision. If your appeal is denied, you may contact the Attorney General or data protection regulator of your state.

Complaints (EEA and UK)

If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection authority. A list of EEA authorities is available from the European Data Protection Board, and the UK authority is the Information Commissioner's Office. We would appreciate the chance to address your concern first, so please contact us before you do.

15. Additional Information for U.S. Residents

This section supplements the rest of this Privacy Policy for residents of California and other U.S. states with comprehensive consumer privacy laws.

In the past 12 months, we have collected the following categories of personal information, for the purposes described in Section 3, from the sources described in Section 2:

Category	Examples	Disclosed for business purposes to	Sold or shared for targeted advertising
Identifiers	Name, email, postal address, phone number, IP address, account login	Shopify, payment processors, carriers, GoHighLevel, analytics and error-monitoring providers	Yes (IP address, device and online identifiers, to advertising partners)
Customer records	Billing and shipping details, payment information	Shopify, payment processors, carriers	No
Physical characteristics	Body measurements and fit photos you provide for sizing, fit verification, or made-to-measure orders	Production partners (made-to-measure orders only)	No
Commercial information	Products viewed, purchased, returned, or exchanged; order history	Shopify, carriers, affiliate partners (order value only)	Yes (browsing and cart activity, to advertising partners)
Internet or network activity	Browsing history on our site, links clicked, interactions with emails and ads	Shopify, analytics and error-monitoring providers, GoHighLevel	Yes (to advertising partners)
Geolocation data	Approximate location derived from IP address (not precise location)	Shopify, analytics providers	Yes (approximate location, to advertising partners)
Audio, electronic, or visual information	Photos of items, packaging, or fit that you send us; design files	Production partners, carriers (for damage claims)	No
Professional information	Affiliate audience details, social handles, website	Service providers that help us run the affiliate program	No
Inferences	Product and style preferences drawn from your activity	Shopify, GoHighLevel	Yes (to advertising partners)

We do not sell personal information for money. However, using advertising cookies and pixels to show you BOND&GRAIN advertising on other sites may be considered a "sale" or "sharing" of personal information, or "targeted advertising", under some U.S. state laws. You can opt out on our Your Privacy Choices page or by enabling Global Privacy Control. We do not collect or use sensitive personal information to infer characteristics about you. We do not knowingly sell or share the personal information of consumers under 16.

California "Shine the Light": California residents may ask once a year for information about the personal information we disclosed to third parties for their direct marketing purposes in the prior calendar year. We do not disclose personal information to third parties for their own direct marketing purposes.

16. Third-Party Websites and Social Media

The Services contain links to third-party websites and platforms, including Instagram, Facebook, TikTok, YouTube, and PayPal. We are not responsible for the privacy practices of those services, and we encourage you to read their privacy policies. Information you post publicly on social media, including content that tags BOND&GRAIN, can be seen by others and is governed by that platform's terms.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, services, or legal requirements. When we do, we will post the updated version on this page and change the "Last updated" date above. If the changes are material, we will provide additional notice, such as a notice on our website or an email to customers, where required by law.

18. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

BOND & GRAIN LLC
5830 E 2nd St, Ste 7000 #36559
Casper, WY 82609, United States
Email: accounts@bondandgrain.com