Privacy Policy

Effective date: October 22, 2026

This policy explains what personal information the G Paper Craft website (gpapercraft.com) collects, why, who else handles it, and what you can ask us to do with it. G Paper Craft is a small handmade paper craft brand based in Houston, Texas. Today the website does one thing with personal information: it runs our email list.

If you have a question about this policy or your information, write to [email protected].

What we collect

When you join the email list, we store:

  • your email address;
  • the language you chose (English or Spanish), so our emails reach you in it;
  • the date and time you signed up, the IP address and the browser description (user agent) your request came from;
  • the date and time you confirmed, and the IP address the confirmation came from;
  • the date you unsubscribed, if you do.

We keep the sign-up and confirmation details as the record that you asked to join and confirmed it, which is how we show that we email only people who said yes.

When you visit the website, our servers and the services listed below receive the technical information every website receives: your IP address, your browser and device type, the page you asked for and when. We use it to deliver the page, keep the site secure and fix problems.

We do not ask for your name, phone number, postal address or payment details, and the website does not sell anything yet.

How we use it

  • To send you the email that asks you to confirm your address, and, once you confirm, a message that says your subscription is confirmed.
  • Later, to send you news from G Paper Craft. We will only do this to people who confirmed.
  • To limit abuse of the sign-up form: we limit how often the form can be sent from the same IP address and how many emails one address can receive, and a bot check runs in your browser before the form is accepted.
  • To keep the website running, secure and free of errors.

We do not use your information for advertising, we do not build profiles of you, and we do not sell or share your personal information with anyone for their own purposes.

Double opt-in, and how to leave

Joining the list takes two steps: you enter your address, then you click the link in the email we send. The link works for 48 hours. If you never click it, nothing else is sent, and the address is deleted automatically about a week after that email.

Every email from our list includes a link to a page where you can unsubscribe or change the language of our emails, and supports your email app's own unsubscribe button. When you unsubscribe we stop emailing you and keep the record that you said no, so you are not added back by mistake. That record stays until you ask us to delete it, or until the address is signed up again, which starts a new confirmation from the beginning.

Who else handles your information

We use a few service providers to run the website. Each one receives only what it needs to do its job for us:

  • Mailgun (United States) sends our emails. It receives your email address and the content of the email. We have turned off its open and click tracking, so it does not record whether you open our emails or which links you click.
  • Cloudflare (United States) provides our domain's DNS and sits in front of the website to deliver it quickly and protect it from attacks, so it sees the technical information of every visit. It also runs Turnstile, the bot check on the sign-up form, and forwards email sent to our @gpapercraft.com addresses to our inbox.
  • Our hosting provider runs the server where the website, its database, its backups and its logs live.

These providers handle the information under their own privacy policies and the agreements they have with us. We may also disclose information if the law requires it.

Cookies and similar technologies

The website uses only the cookies it needs to work. We do not use advertising cookies, and we do not use analytics today. If we add analytics, we will update this policy first.

  • g-paper-craft-session keeps your visit working between pages, for example the form's messages. It lasts 2 hours after your last visit.
  • XSRF-TOKEN protects forms from being sent by another site in your name. It lasts 2 hours after your last visit.
  • appearance remembers the light or dark theme, the one you chose or the default. It lasts 1 year.

Your browser also keeps the theme in its local storage, on your device only. Cloudflare may set its own strictly necessary security cookies when it checks that a visitor is not a bot.

You can delete or block cookies in your browser settings. Blocking them stops the sign-up form from working, because the form needs the first two, and makes the site forget your theme.

Do Not Track. Some browsers send a "Do Not Track" signal. The website does not track you across other sites, no other company collects information about your activity across sites through it, and it does not change its behavior in response to that signal.

How long we keep it

  • An address that is never confirmed: deleted about a week after its last email.
  • A confirmed subscriber: for as long as you stay on the list. After you unsubscribe, we keep the record that you said no until you ask us to delete it or sign up again.
  • Failed email jobs: deleted after 7 days. Technical logs: deleted after 14 days.
  • Backups of the database keep a copy of what was deleted for as long as the backup lasts, and Mailgun keeps its own records of the emails it sent and of addresses that bounced, under its own policy.

Your choices and requests

You can, at any time:

  • unsubscribe or change the language of our emails from the link in any email from our list;
  • ask us what information we hold about you;
  • ask us to correct it;
  • ask us to delete it.

Write to [email protected] from the address in question. We will answer within 30 days. We may ask you to confirm the request from that address, so that nobody else can make it in your name.

Security

The website is served only over HTTPS. Links in our emails are signed, so they cannot be changed or guessed, and they identify you by a random code, never by your email address. Access to the server and the database is limited to us. No system is perfectly secure, but we take reasonable care to protect what we hold.

Children

The website is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has joined our list, write to us and we will delete the address.

Changes to this policy

When we change this policy, we update the effective date at the top of this page. If a change affects how we use the information of people on our list in a significant way, we will tell them by email before it applies.

Governing law

This policy is governed by the laws of the State of Texas and of the United States.