Your words are yours.

Privacy.

Updated 6 September 2026. Tiny Triumph Ribbon Co. is operated by Criminal Org Pty Ltd, ABN 69 662 814 182.

What we collect.

When you order, we collect your ribbon wording, lettering direction, colour, quantity, gift note, email, recipient name and delivery address, payment reference and order status. We use this to make, deliver and support your order. Please avoid including sensitive personal information in your ribbon wording or gift note.

Payments and hosting.

If you claim an invited promotional gift, we collect your ribbon design, contact email, recipient and Australian delivery address to make and send it. We keep its invitation, claim and dispatch record separately from paid orders. Invitation codes are stored as one-way hashes, not readable codes. Claiming a gift does not join our marketing list or give permission to publish your personal details. Gift pages are excluded from analytics.

Stripe processes card payments and provides us with a payment reference and the information needed to fulfil your order. We do not receive or store your full card number. This website and its order database use OpenAI Sites and Cloudflare. Those providers may process data outside Australia. Delivery details are shared with the postal service where needed to deliver the order.

Your basket.

Your unfinished basket is stored in this browser until you clear it or complete the corresponding order. It is not a customer account and will not follow you to another device. Essential hosting and payment security features may use cookies.

Optional website analytics.

If you allow analytics cookies, Google Analytics measures visits, general traffic sources, designer use, basket activity, accepted email signup requests and confirmed purchases. Purchase reporting includes amounts in Australian dollars and an unrelated, one-way transaction reference so repeat visits are not treated as extra purchases. We send generic ribbon product names, colours, layouts and quantities—not your custom wording, gift notes, email address, name or delivery details.

Google may receive cookie identifiers, device and browser information and connection information when your browser contacts its service, and may process this outside Australia. See how Google uses information from sites that use its services. We do not enable Google Signals, advertising personalisation, automatic form tracking, or session recordings. No Meta advertising pixel is active.

Analytics is off until you choose it. Declining does not affect shopping or email subscriptions. Use Cookie settings at the bottom of the page to change your choice; withdrawing permission stops future measurement and clears our analytics cookies. It does not erase data already sent to Google. We remember your cookie choice for up to six months on this browser and respect its Global Privacy Control or Do Not Track signal. Private operator and unsubscribe pages are excluded from measurement.

Email and sharing.

If you join our email list, we store your email address, the form used, the time you gave permission and the version of that permission. With your permission, we may send launch news, ribbon ideas and occasional offers, including after the shop opens. We do not send an automatic email when you submit the form, and we have not verified ownership of the address. Only authorised shop operators can view or export these requests.

You can leave the email list using the unsubscribe link included in our emails, or contact us at any time. We keep an opt-out record so duplicate form submissions do not put you back on the list. If you want to change an earlier opt-out, contact us.

Buying a ribbon does not automatically sign you up for marketing. If you opt in, we record that choice and may send occasional ribbon ideas and offers. You can opt out by the unsubscribe instructions in an email or by contacting us. We do not publish your wording, gift note, name or photograph as customer marketing without separate permission.

Signup security.

Gift claims also use expiring request counters and a daily-changing hash of the connection address to limit repeated attempts. These counters are kept for up to 24 hours and cleared when further claims are attempted.

To limit repeated signup attempts, we use request counters and a daily-changing hash of the connection address where available. The signup database does not store the full connection address. These counters expire after 24 hours and are cleared when another signup is processed. Hosting providers may keep their own security logs.

Keeping and accessing information.

We keep order information while it is needed for fulfilment, support and applicable business-record requirements, and restrict access to authorised operators. You may ask to access or correct your information, opt out of marketing, or request deletion of information no longer required. Some transaction records may need to be retained.

We retain your subscription for the email updates you agreed to, not just until launch. We periodically review inactive subscriptions and remove records no longer needed. If you opt out, we stop marketing and retain a suppression record to honour that choice. We never expand an earlier, narrower permission without your agreement.

Contact.

Our support email will appear before checkout opens. For now, contact @tinytriumphribbons on Instagram.