Privacy Policy

What we collect

• Your account. Your name, email address, phone number and mailing address. Your password is stored only in scrambled (hashed) form, never as the password itself.
• Your orders. What you rented or bought and when, what you paid, and for DVD orders the name and address the disc ships to.
• Educational tax exemption. If you apply to buy tax-exempt for an institution, your organization’s name, its EIN and the exemption certificate you upload. Our staff review these to approve the exemption.
• Messages you send us. The contact form emails your name, email address, phone number (if you give one) and message to our staff. Messages aren’t stored on the website itself.
• Sign-ins and downloads. When you sign in, we note the type of browser you used, so your sign-ins can be managed. When an educational MP4 is downloaded, we record the time, IP address and browser, to enforce the download limit.

Payments

Payments are handled by Stripe. You enter your card details on Stripe’s secure checkout page; they never pass through or get stored on our servers. Stripe tells us your name, email address, billing details (and shipping address, for DVDs) and what you paid, and calculates sales tax. See Stripe’s privacy policy.

Google Analytics

We use Google Analytics to understand how the site is used: which pages are visited, how visitors found us (a search engine, another website or a campaign link), what kind of device and browser they use, their approximate location, how they interact with pages (such as scrolling and clicks to other sites), and when someone starts a checkout or completes a purchase (the film, format and price). It helps us see which films people are interested in and where checkout isn’t working.

Before anything is sent to Google, we remove private details from page addresses: viewing links, password-reset and account-setup links, and payment references. Google’s advertising features (Google signals and ad personalization) are turned off, and our staff pages aren’t measured. Google says Google Analytics doesn’t log or store IP addresses. Google Analytics sets cookies to recognize repeat visits. You can opt out with Google’s opt-out browser add-on.

Other services that handle information for us

• Resend sends our emails: order confirmations, viewing links, rental reminders, shipping and refund notices, password resets, tax-exemption requests and decisions (including your organization’s name and EIN, to our staff), and contact-form messages.
• Railway hosts the website and its database.
• Cloudflare streams our films, delivers educational downloads, and runs our domain name.
• USPS delivers DVD orders, so it receives the name and address each disc ships to.
• YouTube plays our free films and trailers. We use YouTube’s privacy-enhanced mode, but a page with a video loads its preview image from Google, so Google receives your IP address even before anything plays, and YouTube may set cookies or collect more information once a video or preview plays, under Google’s privacy policy.
• Zeffy processes donations. Donating happens on Zeffy’s site, under Zeffy’s own privacy policy, not this one.

Cookies

The site sets one cookie of its own: the one that keeps you signed in to your account. It isn’t used for anything else. (Our staff have a separate sign-in cookie for the admin pages.) Google Analytics sets its own cookies, as described above, and YouTube, Stripe’s checkout page and Zeffy may set theirs.

What we don’t do

We don’t sell or rent your personal information, or share it with anyone for their own marketing. We share it only with the services above, as far as they need it to run the site, and when the law requires it.

How long we keep it

We keep account and order records so you can keep watching what you’ve bought, and for our nonprofit’s accounting and tax records. Google Analytics keeps detailed visit data for a limited period (at most 14 months); summary reports are kept longer.

Seeing, changing or deleting your information

You can update your account details on your account settings page. To ask for a copy of what we hold about you, or to have your account and information deleted, reach us through our contact page or by mail at Willow Mixed Media, Inc., PO Box 194, Glenford, NY 12433. We may need to keep some order records for tax and accounting purposes after deleting an account.

Children

This site isn’t directed at children under 13, and we don’t knowingly collect information from them.

Changes to this policy

If we change this policy, we’ll update this page and the date at the top.