Data Security – Grumbleberry

Effective Date: August 1, 2026

Grumbleberry takes the privacy and security of our customers seriously. This Data Security page explains the measures we use to help protect personal information when you visit Grumbleberry.com (the “Site”), place an order, purchase a physical or digital product, create an account where available, or contact us.

Grumbleberry is a Becca Bleu site offering physical and digital art-based products. Our physical products are currently manufactured and shipped through third-party production and fulfillment partners, which means certain customer information must be securely transmitted to outside service providers in order to process payments, produce products, fulfill orders, and deliver purchases.

We take reasonable precautions to safeguard the information entrusted to us. However, no website, computer system, electronic transmission, database, or method of electronic storage can be guaranteed to be completely secure.

How We Protect Your Information

Grumbleberry uses reasonable technical, administrative, and organizational measures intended to protect personal information from unauthorized access, disclosure, alteration, loss, misuse, or destruction.

Depending on the information and systems involved, these measures may include:

• Secure website connections using SSL/TLS encryption
• Secure ecommerce and checkout technology
• Reputable third-party payment processors
• Password-protected administrative systems
• Limited access to customer information
• Website security and fraud-prevention tools
• Secure hosting infrastructure
• Software and system updates
• Access controls for administrative functions
• Use of established third-party providers for services involving customer information
• Monitoring or protective measures intended to identify suspicious or unauthorized activity

The particular technologies and service providers used by Grumbleberry may change as the Site and business develop.

Secure Website Connections

Grumbleberry.com uses secure website technology intended to encrypt information transmitted between your browser and the Site.

When properly configured and supported by your browser, HTTPS and SSL/TLS technology help protect information while it is being transmitted over the internet.

You should normally see your browser indicate that the connection to Grumbleberry.com is secure.

Although encryption significantly improves the security of information transmitted online, no internet transmission method can be guaranteed to eliminate every possible security risk.

Payment Security

Payments made through Grumbleberry.com are processed using secure third-party payment services.

Grumbleberry does not directly store your complete credit or debit card number.

When you provide payment information during checkout, the applicable payment provider processes the financial information necessary to complete the transaction.

Grumbleberry may receive information such as:

• Confirmation that payment was successful
• Transaction identifiers
• Payment status
• Payment method type
• Limited payment information necessary for transaction records
• Information necessary to process a refund when applicable
• Fraud or payment-verification information made available by the payment provider

We do not ordinarily receive or maintain your complete card number, card security code, or other complete payment credentials.

Third-Party Payment Providers

Payment processors maintain their own security systems, privacy policies, terms, and legal obligations.

Depending on the payment methods available on Grumbleberry.com, payment transactions may involve independent payment providers.

Those providers are responsible for securing payment information processed through their systems according to their own practices and applicable requirements.

Grumbleberry does not control the internal security systems of independent payment providers.

Information We May Maintain

Grumbleberry collects and maintains information reasonably necessary to operate the business and provide products and services.

Depending on how you interact with the Site, this may include:

• Name
• Email address
• Billing address
• Shipping address
• Telephone number when required for fulfillment or delivery
• Order history
• Products purchased
• Transaction information
• Shipping and tracking information
• Customer service communications
• Return information
• Replacement information
• Photographic evidence submitted for damage or defect claims
• Digital product delivery or access information
• Account information, when customer accounts are available
• Technical information associated with Site usage
• Information reasonably necessary to investigate fraud, misuse, or payment disputes

We do not intentionally collect more personal information than we reasonably need for our business operations.

Production and Fulfillment Partners

Grumbleberry currently uses third-party production and fulfillment partners to manufacture and ship physical products.

When you purchase a physical product, certain information must be transmitted to the applicable production or fulfillment partner so that your order can be produced and delivered.

This may include:

• Your name
• Shipping address
• Products ordered
• Product variations
• Order details
• Information necessary to produce your purchase
• Information necessary to ship your purchase

Production and fulfillment partners are independent service providers and maintain their own systems, security measures, privacy practices, and legal obligations.

We provide information reasonably necessary for them to perform the services required to fulfill your order.

Shipping Carriers

When a physical product is shipped, information necessary to complete delivery may be provided to the applicable shipping carrier.

This may include your name, delivery address, package information, and other information reasonably necessary to transport and deliver your order.

Once information has been transmitted to an independent shipping carrier, that carrier handles the information according to its own systems, policies, and legal obligations.

Grumbleberry does not control the internal computer systems, databases, or security practices of USPS, UPS, FedEx, or other independent shipping carriers.

Digital Product Security

Grumbleberry may sell digital products, including Procreate brushes and other downloadable creative resources.

We may use reasonable measures intended to protect digital products and customer access to them.

Depending on the digital delivery system being used, information may be maintained concerning:

• Purchase confirmation
• Download access
• File delivery
• Download attempts
• Customer account access
• Order information associated with a digital product
• Technical information reasonably necessary to provide or protect the download

Such information may be used to deliver purchased products, troubleshoot access problems, investigate unauthorized distribution, prevent misuse, or protect Grumbleberry's intellectual property.

Customer Accounts

If Grumbleberry.com offers customer account functionality, customers are responsible for maintaining the confidentiality and security of their account credentials.

You should:

• Use a strong and unique password
• Avoid sharing your password with other people
• Avoid reusing the same password across multiple websites
• Protect access to the email account associated with your Grumbleberry account
• Log out when using a shared or public device
• Notify us if you reasonably believe your Grumbleberry account has been accessed without authorization

Grumbleberry will never need you to send us your complete credit card number or account password by ordinary email for customer-service purposes.

Email Security

Email is a convenient method of communication, but ordinary email should not be treated as a completely secure method of transmitting highly sensitive information.

When contacting hello@grumbleberry.com, please do not send:

• Complete credit or debit card numbers
• Card security codes
• Online banking passwords
• Account passwords
• Social Security numbers
• Other highly sensitive information that is unnecessary for us to resolve your request

For ordinary order support, your name, order information, email address, photographs when relevant, and a description of the problem are generally sufficient.

If additional information is necessary, we will let you know.

Photographs Submitted for Product Claims

Our Refunds & Returns Policy requires photographic evidence when a customer reports certain damaged, defective, misprinted, or incorrect physical products.

Photographs submitted for these purposes may be retained or shared with the applicable production or fulfillment partner when reasonably necessary to:

• Evaluate the claim
• Document a manufacturing or printing problem
• Request a replacement
• Investigate possible fraud or misuse
• Resolve a dispute
• Maintain appropriate business records

Please avoid including unrelated personal or sensitive information in photographs submitted for product claims.

Website Security

We may use security technologies and services intended to help protect Grumbleberry.com from:

• Unauthorized access
• Malicious traffic
• Fraudulent transactions
• Account abuse
• Automated attacks
• Spam
• Malware
• Attempts to interfere with Site functionality
• Other suspicious or harmful activity

These security systems may process technical information such as IP addresses, browser information, device information, request activity, or other information necessary to identify and respond to potential threats.

Fraud Prevention

Grumbleberry reserves the right to use transaction, order, account, shipping, technical, and communication information reasonably necessary to identify or investigate suspected fraud or abuse.

This may include suspected:

• Fraudulent purchases
• Stolen payment information
• Chargeback abuse
• False damage claims
• Manipulated photographic evidence
• Repeated replacement abuse
• Unauthorized digital product distribution
• Account misuse
• Attempts to circumvent Site security
• Other deceptive or unlawful conduct

Where reasonably necessary, relevant information may be shared with payment processors, financial institutions, production partners, security providers, professional advisers, or appropriate authorities.

Cookies and Similar Technologies

Grumbleberry.com may use cookies and similar technologies for Site functionality, security, ecommerce operations, analytics, and fraud prevention.

These technologies may help:

• Maintain shopping carts
• Support checkout
• Maintain customer sessions
• Remember preferences
• Identify suspicious activity
• Understand general Site usage
• Improve website performance

Additional information about these technologies is available in our Cookie Policy.

Third-Party Services

Grumbleberry relies on third-party services to operate portions of the Site and business.

These may include:

• Payment processors
• Website hosting providers
• Ecommerce software
• Production and fulfillment partners
• Shipping carriers
• Security services
• Fraud-prevention services
• Analytics providers
• Email and transactional communication services
• Digital product delivery services
• Other business technology providers

These companies maintain their own systems and security practices.

While we aim to use established and appropriate service providers, Grumbleberry cannot guarantee or control the security of independent third-party systems.

Access to Personal Information

Access to customer information under Grumbleberry's direct control is intended to be limited to information reasonably necessary to operate the business.

Personal information should not be accessed merely out of curiosity or for purposes unrelated to legitimate business operations.

Where third-party services are involved, their personnel and systems may process information according to their own access controls and contractual or legal responsibilities.

Data Retention

Personal information may be retained for as long as reasonably necessary for the purpose for which it was collected and for legitimate business or legal purposes.

Information may be retained to:

• Fulfill orders
• Maintain transaction records
• Provide customer support
• Process returns or replacements
• Maintain accounting records
• Comply with tax requirements
• Resolve disputes
• Respond to chargebacks
• Prevent fraud and policy abuse
• Protect Grumbleberry's intellectual property
• Enforce agreements and policies
• Comply with legal obligations

Different types of information may be retained for different periods.

We do not promise immediate deletion of information when a transaction is completed because certain records may need to be retained for legitimate business or legal reasons.

Data Backups

Information maintained through Grumbleberry's website or third-party systems may be included in system backups or recovery processes.

Backup systems are intended to protect against accidental data loss, system failure, or other technical problems.

Information contained in backups may remain for a period after information has been removed from an active system, depending on the applicable backup and retention process.

Your Role in Data Security

Security is also affected by how customers protect their own devices, accounts, and information.

Customers are responsible for taking reasonable steps to protect:

• Their computers, phones, and tablets
• Email accounts
• Passwords
• Customer account credentials
• Downloaded digital products
• Saved order records
• Payment accounts
• Home or public network connections

Grumbleberry cannot protect information after it has been downloaded to, stored on, or exposed through a device or account controlled by the customer.

Protect Yourself From Impersonation and Phishing

Customers should be cautious of emails, messages, websites, or social media accounts falsely claiming to represent Grumbleberry.

Grumbleberry will not ask you by ordinary email to provide your complete credit card number, card security code, banking password, or Grumbleberry account password.

If you receive a suspicious communication claiming to be from Grumbleberry, do not provide sensitive information or click suspicious links.

You may contact hello@grumbleberry.com to ask whether a communication is legitimate.

No System Is Completely Secure

Although we take reasonable precautions, no method of internet transmission, electronic storage, website security, or computer security is completely risk-free.

Security threats and technologies continually change.

It is therefore impossible for Grumbleberry or any other online business to guarantee that unauthorized access, data loss, cyberattack, technical failure, or other security incidents will never occur.

Our commitment is to use reasonable safeguards appropriate to our operations, not to promise absolute security that no online system can guarantee.

Security Incidents

If Grumbleberry becomes aware of a security incident involving personal information under our control, we may investigate the incident and take reasonable steps appropriate to the circumstances.

Depending on the nature and scope of an incident, these steps may include:

• Investigating what occurred
• Securing affected systems
• Working with relevant service providers
• Changing credentials or access controls
• Preserving relevant records
• Taking steps intended to reduce additional risk
• Providing notices when required by applicable law

The specific response will depend on the circumstances of the incident.

Third-Party Data Breaches

Because Grumbleberry uses independent service providers, a security incident could potentially occur within a third party's systems rather than within systems controlled directly by Grumbleberry.

We do not control the internal cybersecurity operations of independent providers.

If we become aware of a relevant third-party incident affecting Grumbleberry customer information, we may take reasonable steps based on the information made available to us and any obligations imposed by applicable law.

Your Privacy Rights

Depending on where you live and the laws that apply to Grumbleberry, you may have rights concerning personal information maintained about you.

These may include rights to request:

• Access to certain personal information
• Correction of inaccurate information
• Deletion of certain information
• Information concerning how certain personal information is used or disclosed
• Other rights provided by applicable privacy law

Some information may need to be retained despite a deletion request when retention is permitted or required for legal, tax, accounting, fraud-prevention, dispute-resolution, transaction-recordkeeping, or other legitimate purposes.

Privacy requests may be sent to hello@grumbleberry.com.

We may need to verify your identity before processing certain requests.

Children's Information

Grumbleberry.com is not directed toward children under the age of 13.

We do not knowingly seek to collect personal information directly from children under 13.

If you believe that a child under 13 has provided personal information to Grumbleberry, please contact hello@grumbleberry.com so that we can review the situation and take appropriate action where required.

What to Do if You Believe Your Information Has Been Compromised

If you believe your Grumbleberry account or information associated with Grumbleberry has been accessed or used without authorization, please contact us as soon as reasonably possible.

When contacting us, provide enough information for us to understand the concern, but do not send passwords or complete financial information by email.

Depending on the circumstances, you may also need to contact your payment provider, financial institution, email provider, or other relevant service.

Relationship to Our Privacy Policy

This Data Security page explains our general security practices and the responsibilities associated with protecting information.

Our Privacy Policy provides additional information concerning:

• What information Grumbleberry may collect
• How information is used
• When information may be shared
• Data retention
• Cookies and technical information
• Privacy rights
• Third-party services

This Data Security page should be read together with our Privacy Policy.

Changes to This Data Security Page

We may update this Data Security page as Grumbleberry's website, products, services, security practices, technology providers, fulfillment processes, or legal requirements change.

When changes are made, the updated version may be posted on Grumbleberry.com with a revised effective or updated date.

We encourage visitors to periodically review this page.

Contact Information

If you have questions about data security, believe there may be a security issue involving your information, or have a privacy-related concern, please contact:

Grumbleberry
A Becca Bleu Site
Email: hello@grumbleberry.com
Website: Grumbleberry.com

Please do not include passwords, complete payment-card numbers, card security codes, or other unnecessary sensitive financial information in an email.

Business Ownership and Brand Information

Grumbleberry is a Becca Bleu site.

Becca Bleu is the company and creative identity behind Grumbleberry. Grumbleberry offers physical and digital art-based products featuring primarily original artwork and illustrations by Becca Bleu.