Privacy Policy
Last updated October 11, 2026.
Chicago Hat Club is a trade name of Doodle House LLC, 1175 Tower Rd, Schaumburg, IL 60173. Doodle House LLC is responsible for the personal information described in this policy.
Who we are
We're a small hat shop in Schaumburg, Illinois. This policy covers chicagohatclub.com, our shop emails, the Hat Club membership and our live chat. We don't sell, rent or trade your personal information. The only advertising measurement on the site is Google's, described below, and you can turn it off.
What we collect and why
We collect only what we use. Here's every kind of personal information the site keeps, why, who else sees it, and how long we keep it.
| What | Why | Shared with | How long |
|---|---|---|---|
| Name, email, phone, shipping address, what you ordered | Take, pack, ship and support your order; send receipts and tracking; check the shipping address is deliverable | Square or PayPal (payment), Shippo and the carrier, USPS or UPS (shipping), Google or Shippo (address check — the address only, not your name or email), our email provider | 7 years (tax and legal records) |
| Payment records (amounts, refunds, last 4 digits and card brand) | Charge, refund and resolve disputes | Square or PayPal | 7 years |
| Account (email, name, password hash, saved details, wishlist, store credit) | Sign-in, faster checkout, rewards | No one | Until you delete your account (store-credit history: 7 years) |
| Passkeys (a public key and the device name; your fingerprint or face never leaves your device) | Sign in with Face ID, Touch ID or a security key | No one (Apple, Google or your device keep the private key) | Until you remove it or delete your account |
| Signed-in devices (browser type, IP address, sign-in times) | Keep you signed in; show your devices on your account page; spot account takeovers | No one | Until you sign out or the session ends (8 hours) |
| Your cart while you're signed in | Remember your cart and send one reminder if you leave items behind (a marketing email) | Our email provider | Until you order or delete your account |
| Hat Club membership and the record of your agreement (time, the terms shown, your IP address and browser) | Run the membership and prove you agreed to auto-renewal | Square (subscription billing) | 7 years |
| Newsletter and marketing emails | Send drops, restocks and offers you asked for | Our email provider | Until you unsubscribe (we then keep your address on our do-not-email list) |
| Reviews (your rating, words, display name, an optional photo) | Show real customer reviews; pay the review credit | Everyone (your words post right away; a photo once we approve it) | While published; anonymized if you delete your account |
| Live chat, contact form and support emails (your messages, name, phone or email, photos) | Answer you and follow up | OpenAI (the automated assistant), Cloudflare Images (photos), our email provider | 7 years (support records) |
| Payments that didn't go through (your email, the order number, the amount, the payment method and the reason the bank or our security check gave) | Spot checkout problems and help you finish your order | No one | 90 days, or until you delete your account |
| Site analytics (pages viewed, clicks, a random visitor ID, browser type, a shortened IP address) | Understand which pages help shoppers; spot problems | No one (first-party). Google Analytics and Google Ads also measure visits unless you opt out (see below) | 90 days; the last part of your IP address is removed before we store it |
| Business (wholesale) account activity (sign-ins and sign-outs, failed sign-ins, pages and products viewed, searches, cart changes, quote and order requests, account changes, with the time, IP address, device and browser, and an approximate city) | Account security and serving your business account | No one | 90 days (details) |
| Missing-page log (the address you tried, the referring page, browser type) | Fix broken links | No one | The latest 2,000 entries only |
| Server security logs (IP address, the page requested) | Keep the site running and secure | Cloudflare and DigitalOcean (our hosting) | Rotated automatically (the oldest entries are deleted as new ones arrive) |
Business (wholesale) accounts. If you have a business (wholesale) account, we keep a log of that account's activity on our site for account security and to serve your account: when you sign in or out (and failed sign-in attempts), the pages and products you view, your searches, items you add to or remove from your cart, quote and order requests and orders, and changes to your account (like a password reset). Each entry records the time, your IP address, a short description of your device and browser and, when our hosting provider already supplies it, an approximate city. We never log passwords, sign-in links or card details. Only the people who run the shop see this log, and we keep it for 90 days, then delete it. It's included when you ask us for a copy of your data, and it's deleted with the rest of your account's data when you ask us to close your business account. Retail shopper accounts aren't part of this log.
The companies that help us run the store only get what they need for their job: Square (cards, Apple Pay, Google Pay, Cash App Pay, Afterpay and Hat Club billing), PayPal (PayPal and Venmo), Shippo and the carriers (shipping labels and tracking), Google (Google Workspace email, Google Analytics, Google Ads), Cloudflare (keeps the site fast and secure, the "are you human" check at checkout, chat photos), DigitalOcean (our server and encrypted backups), OpenAI (the live chat assistant), and depending on how a message is sent, Postmark, Resend or Microsoft (email delivery). We may also share information if the law requires it or to protect against fraud.
Payments
Your card number goes straight from your browser to Square or PayPal in their own secure fields. It never touches our servers, and we never see or store your full card number or security code. We keep only what Square or PayPal sends back: the amount, the status, and the card brand and last 4 digits.
Cookies and analytics
We use a sign-in cookie to keep you signed in, and your browser's storage to remember your cart, saved hats and a random visitor ID for our own first-party analytics. Our own analytics never use your name or email.
We also use Google Analytics and Google Ads to measure how people find us and whether our ads lead to purchases (for example, that an order was placed and its total, never your card details). Google sets cookies to do this. If our site design uses a Google font, your browser loads it from Google Fonts.
Your privacy choices
If your browser sends a Global Privacy Control signal, we automatically turn off Google analytics cookies and ad tracking and personalization for you. You can also opt out on this browser with the button below, or across Google with Google's ad settings and the Google Analytics opt-out.
Other choices: unsubscribe from marketing email with the link in any of them, download or delete your data from your account page (see Your rights), and clear your saved cart any time by clearing this site's data in your browser.
Emails
Order and account emails (receipts, shipping updates, sign-in links, Hat Club receipts and renewal reminders, security notices) are part of the service, so they keep coming while you have an order or account with us. Marketing emails (the newsletter, drops, cart reminders, "how's the hat?" and win-back offers) only go to people who signed up or bought from us, and every one has a one-click unsubscribe link and our postal address. Unsubscribing takes effect immediately. We don't send marketing text messages.
Live chat
The chat bubble is answered first by our automated assistant (an AI service from OpenAI), and a person on our team can step in at any time. It's told the shop's facts, not your email or phone number. Chats are saved so our team can follow up, and we get a text alert when you ask for a person. Photos you send in chat go straight to Cloudflare Images (your browser removes location data first) and are only viewable through short-lived private links. Please don't share card numbers or passwords in chat.
Reviews
Only signed-in customers who bought a hat can review it. Your review shows the display name and city you choose. Photos are cleaned of hidden data such as GPS location before we store them, and stay private until we approve the photo. See our review rules. If you delete your account, your reviews stay up as "Former customer" and their photos are removed.
Children
This site isn't meant for children under 13, and we don't knowingly collect personal information from them. Hat Club membership is for adults 18 and older. If you think a child under 13 gave us information, email us and we'll delete it.
Your rights: see, copy, correct or delete your data
- Get a copy. Signed in, open your account page and choose Download my data.
- Correct it. Update your details on your account page or at checkout, or ask us.
- Delete it. Choose Delete my account on your account page. We erase your account, saved details, passkeys, sign-ins, wishlist, saved cart and newsletter signup right away, and take you off marketing email for good (we keep only a scrambled fingerprint of your address so we never email you again). Your reviews stay as "Former customer" without photos. Hat Club members cancel their membership first.
- What we have to keep. Orders, payments, refunds, the record of your Hat Club agreement and store-credit history are kept for 7 years because tax and consumer laws require it. They're no longer linked to an account, and we use them only for those legal purposes.
You can also email [email protected] or call (847) 847-4070 to ask for any of these. We'll confirm it's really you (usually by replying to the email address on the account), then answer within 30 days. We won't treat you differently for using your rights.
Data security and breaches
The site only runs over HTTPS. Passwords are stored as salted hashes, emailed sign-in links expire, and our backups are encrypted. Only the people who run the shop can see customer records. No system is perfect: if a breach ever affects your personal information, we'll tell you as the law requires (including the Illinois Personal Information Protection Act), without unreasonable delay, and tell you what happened and what to do.
How long we keep it
- Orders, payments, refunds, Hat Club agreement records, store-credit history and support conversations: 7 years.
- Your account, saved details, passkeys, wishlist and saved cart: until you delete your account.
- Site analytics: 90 days, with shortened IP addresses.
- Business (wholesale) account activity log: 90 days.
- Sign-in sessions: 8 hours, or until you sign out. Emailed sign-in links: 15 minutes (links in order and review emails: 7 days).
- Newsletter: until you unsubscribe or delete your account.
- Encrypted backups: deleted data can remain in them until they expire (about 13 months). We use backups only to recover from an outage.
Changes to this policy
When we change this policy we update the date at the top and keep the old version on file. If a change is significant, we'll email account holders and Hat Club members before it takes effect.
Contact
Doodle House LLC d/b/a Chicago Hat Club, 1175 Tower Rd, Schaumburg, IL 60173 · [email protected] · (847) 847-4070. A real person on our team reads every privacy question.