Privacy Policy

Last updated: 5/3/2026

This Privacy Policy describes how Minva Tabletop Design Co. (operating minvarpg.com, the “Site” or “we”) collects, uses, and discloses your Personal Information when you visit or make a purchase from the Site.

Contact

After reviewing this policy, if you have additional questions, want more information about our privacy practices, or would like to make a complaint, please contact us by e-mail at sales@minvathemes.com or by mail using the details provided below:

Minva Tabletop Design Co.
440 Monticello Ave Ste 1802 PMB 31142
Norfolk, VA 23510, United States

Collecting Personal Information

When you visit the Site, we collect certain information about your device, your interaction with the Site, and information necessary to process your purchases. We may also collect additional information if you contact us for customer support. In this Privacy Policy, we refer to any information about an identifiable individual (including the information below) as “Personal Information”.

If you sign up to receive our newsletter or other emails, we will collect your email address (and any name you provide) to send you the communications you requested.

See the list below for more information about what Personal Information we collect and why.

  • Device information
    • Purpose of collection: to load the Site accurately for you, and to perform analytics on Site usage to optimize our Site.
    • Source of collection: collected automatically when you access our Site using cookies, log files, web beacons, tags, pixels, and similar technologies (including the Meta Pixel and TikTok Pixel where applicable).
    • Disclosure for a business purpose: shared with our processors Shopify, Netlify (our hosting provider), and Google (Google Analytics 4) for site operation and analytics.
    • Personal Information collected: version of web browser, IP address, time zone, cookie information, what sites or products you view, search terms, and how you interact with the Site.
  • Order information
    • Purpose of collection: to provide products or services to you, fulfill our contract, process your payment information, arrange shipping, and provide you with invoices and/or order confirmations, communicate with you, screen our orders for potential risk or fraud, and — in line with the preferences you have shared with us — provide you with information or advertising relating to our products or services.
    • Source of collection: collected from you.
    • Disclosure for a business purpose: shared with Shopify (e-commerce platform), Stripe (subscription payments), CrateJoy (subscription-box management for Dragon’s Hoard and Dice Arcana), and our shipping carriers as needed to fulfill your order.
    • Personal Information collected: name, billing address, shipping address, payment information (including credit card numbers, processed by Shopify or Stripe), email address, and phone number.
  • Customer account information
    • Purpose of collection: to allow you to log in to your account, view your order history, manage subscriptions, and access digital downloads you’ve purchased.
    • Source of collection: collected from you when you create an account or log in via passwordless email link.
    • Disclosure for a business purpose: stored with Shopify and our hosting provider; passwordless login emails are delivered via Resend.
    • Personal Information collected: email address and authentication tokens.
  • Newsletter and marketing email information
    • Purpose of collection: to send you the newsletter you signed up for, including new releases, weekly discounts, and TTRPG content.
    • Source of collection: collected from you when you subscribe via our website footer, at checkout (if you opt in), via Meta Lead Ads, or by other opt-in source. We never add you to marketing email without an opt-in.
    • Disclosure for a business purpose: shared with Resend (our email service provider) and, during a 2026 transition, Mailchimp.
    • Personal Information collected: email address, opt-in source, and engagement metrics (opens, clicks).
  • Customer support information
    • Purpose of collection: to provide customer support, respond to inquiries, and resolve issues with orders.
    • Source of collection: collected from you (typically by email or contact form).
    • Disclosure for a business purpose: stored in our email system and shared internally with team members supporting the request. May be shared with Shopify or Stripe to resolve order or billing issues.
    • Personal Information collected: name, email address, order details, and the content of your message.
  • Product reviews
    • Purpose of collection: to publish customer reviews on our product pages.
    • Source of collection: collected from you when you submit a review.
    • Disclosure for a business purpose: shared with Judge.me, our reviews platform.
    • Personal Information collected: name (display name), email, and review content.

Minors

The Site is not intended for individuals under the age of 18. We do not intentionally collect Personal Information from children. If you are the parent or guardian and believe your child has provided us with Personal Information, please contact us at the address above to request deletion.

Sharing Personal Information

We share Personal Information only with service providers who help us deliver our products and services. These providers act as our processors and use Personal Information only as needed to perform services for us. We share with the following categories of service providers:

  • E-commerce platform (currently Shopify) — to operate the storefront, process orders, and manage customer accounts.
  • Payment processors (Shopify Payments and Stripe) — to securely process transactions and recurring subscription billing.
  • Subscription-box fulfillment partners — to manage and ship recurring physical subscription orders.
  • Email service providers — to send transactional emails (order confirmations, shipping updates, account login links) and to deliver the marketing newsletter you opted into.
  • Hosting and infrastructure providers — to operate the website itself.
  • Analytics and advertising providers — to understand how customers use our Site and to deliver relevant ads on platforms where we advertise. Current partners include Google, Meta, and TikTok.
  • Customer-review platform — to collect and display product reviews.
  • Marketplace and sales channels — including TikTok Shop, where we list products for sale.

A current named list of subprocessors is available on request by emailing sales@minvathemes.com.

We may also share Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request, or to protect our rights.

Behavioural Advertising

As described above, we use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you. For example:

  • We use Google Analytics to help us understand how our customers use the Site. You can read more about how Google uses your Personal Information here: https://www.google.com/intl/en/policies/privacy/. You can opt-out of Google Analytics at https://tools.google.com/dlpage/gaoptout.
  • We run advertising campaigns on Meta (Facebook/Instagram) and TikTok and use their pixels to measure and optimise those campaigns.
  • We share information about your use of the Site, your purchases, and your interaction with our ads on other websites with our advertising partners. We collect and share some of this information directly with our advertising partners, and in some cases through cookies or similar technologies (which you may consent to, depending on your location).
  • We use Shopify Audiences to help us show ads on other websites with our advertising partners to buyers who made purchases with other Shopify merchants and who may also be interested in what we offer.

For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s educational page at https://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.

You can opt out of targeted advertising by:

Additionally, you can opt out of some of these services by visiting the Digital Advertising Alliance’s opt-out portal at: https://optout.aboutads.info/.

Using Personal Information

We use your Personal Information to provide our services to you, which includes: offering products for sale, processing payments, shipping and fulfillment, providing customer support, and — with your consent — keeping you up to date on new products, services, and offers via our newsletter.

Lawful basis

Pursuant to the General Data Protection Regulation (“GDPR”), if you are a resident of the European Economic Area (“EEA”), we process your Personal Information under the following lawful bases:

  • Your consent;
  • The performance of the contract between you and the Site;
  • Compliance with our legal obligations;
  • To protect your vital interests;
  • To perform a task carried out in the public interest;
  • For our legitimate interests, which do not override your fundamental rights and freedoms.

Retention

When you place an order through the Site, we will retain your Personal Information for our records unless and until you ask us to erase this information. Newsletter subscribers’ emails are retained until they unsubscribe. For more information on your right of erasure, please see the ‘Your rights’ section below.

Automatic decision-making

If you are a resident of the EEA, you have the right to object to processing based solely on automated decision-making (which includes profiling), when that decision-making has a legal effect on you or otherwise significantly affects you.

We do not engage in fully automated decision-making that has a legal or otherwise significant effect using customer data.

Our processor Shopify uses limited automated decision-making to prevent fraud that does not have a legal or otherwise significant effect on you. Services that include elements of automated decision-making include:

  • Temporary blacklist of IP addresses associated with repeated failed transactions. This blacklist persists for a small number of hours.
  • Temporary blacklist of credit cards associated with blacklisted IP addresses. This blacklist persists for a small number of days.

Categories of Personal Information We Collect (CCPA/CPRA)

In the past 12 months we have collected the following categories of Personal Information, as defined by the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • Identifiers — name, email, postal address, phone number, IP address, account login.
  • Customer records — billing and shipping addresses, payment information (processed by Shopify or Stripe; we do not store full card numbers).
  • Commercial information — products purchased, subscription history, browsing and search behaviour on the Site.
  • Internet or network activity — pages viewed, links clicked, referring URLs, device and browser information.
  • Geolocation — approximate location derived from IP address (we do not collect precise GPS data).
  • Inferences — preferences and characteristics derived from the categories above for personalised marketing.

We do not knowingly collect “Sensitive Personal Information” as defined by the CPRA (e.g. social security numbers, precise geolocation, racial/ethnic origin, religious beliefs, biometric data, contents of private messages, financial account credentials, or genetic data). If we ever begin collecting such data, we will update this Policy and provide a separate notice and opt-out.

Sale or Sharing of Personal Information

We do not sell Personal Information for money. However, under the broad definition of “sale” or “sharing” in CPRA and similar laws, our use of advertising cookies (Meta Pixel, TikTok Pixel) and audience-matching tools (Shopify Audiences, Google Ads custom audiences) may qualify as a “sale” or “share” of Personal Information for cross-context behavioural advertising. You have the right to opt out at any time by following the instructions in the “Behavioural Advertising” section above or by emailing sales@minvathemes.com with the subject line “Do Not Sell or Share My Personal Information.”

We honor Global Privacy Control (GPC) signals from your browser as an opt-out of sale/sharing where required by law.

Your rights

GDPR

If you are a resident of the EEA, you have the right to access the Personal Information we hold about you, to port it to a new service, and to ask that your Personal Information be corrected, updated, or erased. If you would like to exercise these rights, please contact us through the contact information above.

Your Personal Information will be initially processed in Ireland and then transferred outside of Europe for storage and further processing, including to Canada and the United States. For more information on how data transfers comply with the GDPR, see Shopify’s GDPR Whitepaper: https://help.shopify.com/en/manual/your-account/privacy/GDPR.

CCPA / CPRA (California)

If you are a California resident, you have the right to:

  • Right to Know — access the Personal Information we hold about you.
  • Right to Delete — request that we delete your Personal Information.
  • Right to Correct — request that inaccurate Personal Information be corrected.
  • Right to Opt Out — opt out of the “sale” or “sharing” of Personal Information (see “Sale or Sharing” section above).
  • Right to Limit Use of Sensitive PI — we do not collect Sensitive PI, but you may exercise this right against us regardless.
  • Right to Non-Discrimination — we will not discriminate against you for exercising any of these rights.

To exercise these rights, contact us at sales@minvathemes.com or by mail at the address above. We will verify your identity using the email address associated with your account or order. You may also designate an authorized agent in writing to submit requests on your behalf.

Other US State Privacy Laws

If you are a resident of Virginia, Colorado, Connecticut, Utah, or another US state with a comprehensive privacy law, you have rights similar to those above — access, deletion, correction, portability, and opt-out of targeted advertising. To exercise these rights, contact us at sales@minvathemes.com.

Cookies

A cookie is a small amount of information that’s downloaded to your computer or device when you visit our Site. We use a number of different cookies, including functional, performance, advertising, and analytics cookies. Cookies make your browsing experience better by allowing the website to remember your actions and preferences (such as login and region selection). This means you don’t have to re-enter this information each time you return to the site or browse from one page to another. Cookies also provide information on how people use the website.

We use the following cookies to optimize your experience on our Site and to provide our services:

Cookies Necessary for the Functioning of the Store

Shopify sets a number of cookies on our storefront to enable secure login, session handling, cart, and checkout. The current list is maintained at shopify.com/legal/cookies.

Reporting and Analytics

  • Google Analytics 4 sets cookies (e.g. _ga, _ga_<container-id>) to track aggregate site usage. Used by us to understand which pages and products drive interest.
  • Meta Pixel sets cookies (e.g. _fbp, _fbc) when our advertising tags are loaded. Used to measure and optimise Meta ads.
  • TikTok Pixel sets cookies (e.g. _ttp) when TikTok ad campaigns are running. Used to measure and optimise TikTok ads.

The length of time that a cookie remains on your computer or mobile device depends on whether it is a “persistent” or “session” cookie. Session cookies last until you stop browsing and persistent cookies last until they expire or are deleted. Most of the cookies we use are persistent and will expire between 30 minutes and two years from the date they are downloaded to your device.

You can control and manage cookies in various ways. Please keep in mind that removing or blocking cookies can negatively impact your user experience and parts of our website may no longer be fully accessible.

Most browsers automatically accept cookies, but you can choose whether or not to accept cookies through your browser controls, often found in your browser’s “Tools” or “Preferences” menu. For more information on how to modify your browser settings or how to block, manage, or filter cookies, please see your browser’s help file or visit www.allaboutcookies.org.

Additionally, please note that blocking cookies may not completely prevent how we share information with third parties such as our advertising partners. To exercise your rights or opt-out of certain uses of your information by these parties, please follow the instructions in the “Behavioural Advertising” section above.

Do Not Track

Please note that because there is no consistent industry understanding of how to respond to “Do Not Track” signals, we do not alter our data collection and usage practices when we detect such a signal from your browser.

Changes

We may update this Privacy Policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons.

Complaints

If you would like to make a complaint, please contact us by e-mail or by mail using the details provided under “Contact” above.

If you are not satisfied with our response to your complaint, you have the right to lodge your complaint with the relevant data protection authority.

Privacy Policy | Minva Tabletop Design Co.