Who we are
Trunkville (trunkville.com) is a directory of bespoke makers — tailors, shoemakers, shirtmakers and others — and the trunk shows where they see clients. It is operated by Trunkville LLC (“Trunkville”, “we”, “us”). We are the controller of the personal information described here. For anything about this policy or your information, write to christian@trunkville.com.
This policy covers the website, the public JSON API (described at /openapi.json), the MCP server at /api/mcp used by AI assistants, and the emails we send. It does not cover makers’ own websites, Substack, or the AI assistant you may use to reach us; they have their own policies.
What we collect
When you request an appointment or send a maker a message
Whether you use the form on a maker’s page, the API, or an AI assistant acting for you, we collect what you or your assistant send: your name, email address, phone number (optional), the city and times you prefer, what you would like made, whether you are new to bespoke or a returning client, your message, and the name of the assistant if one sent it. We also keep the conversation that follows — the maker’s answers and your replies, including replies sent by email to the request’s thread address — and the status of the request (pending, accepted, declined, withdrawn or expired).
When you browse
- Page-view counts. When a maker’s page is viewed we record the page, the time, whether the visitor looks like a person, an AI assistant or a bot (from the browser’s user-agent), and a short pseudonymous code made by hashing your IP address and user-agent together with a secret that changes every day. We do not store your IP address or user-agent in these records, and the code cannot be linked across days. Makers see the totals in their monthly page report.
- Google Analytics and Google Ads. The site loads Google Analytics and a Google Ads conversion tag. Google sets cookies and receives information such as your IP address, device and browser details, and the pages you visit, to give us visit statistics and to measure visits from our ads. See how Google uses information from sites that use its services. You can block these cookies in your browser or install Google’s Analytics opt-out add-on; the directory works without them.
- Server logs. Our hosting provider, Vercel, processes the technical details of each request (such as IP address, user-agent and the address requested) to deliver the site and keep it secure.
- Your browser’s storage. We save a small note in your browser’s local storage so the newsletter pop-up and giveaway banner do not keep reappearing after you close them.
Newsletter, alerts and follows
Our newsletter is published on Substack: when you subscribe there, Substack holds your email address under its own privacy policy. If you ask to be told when a maker announces a trunk show, or follow a maker or show with an account, we keep your email address and what you asked to follow.
Accounts
If you create a Trunkville account, we keep your email address, your password (stored by our authentication provider, Supabase, and never visible to us), the location you give us, what you follow, and any reviews you post.
Makers
For makers we keep the profile shown on their page (name, story, crafts, prices, ateliers, trunk shows, photos, links), contact details we use to reach them (email address and phone number), a login password stored only as a one-way hash, and how they use their dashboard. Much of a profile is compiled from the maker’s own public website and social media, or sent to us by the maker. Makers can also use Trunkville to keep their own list of clients, commissions and appointments; we store that on the maker’s behalf and use it only to provide those tools to them.
When you write to us or submit a trunk show
We keep the emails you send us and any trunk-show submission (maker name, venue, dates, contact email, Instagram handle and comments).
Why we use it
- To pass your request or message to the maker and run the conversation: sending it, holding a proposed time for up to 72 hours while the maker decides, emailing you and the maker at each step, relaying replies, and sending a calendar invite when the maker accepts. (This is necessary to do what you asked.)
- To run and improve the directory: publishing maker profiles and trunk shows, counting page views, producing makers’ monthly reports, and understanding which pages are useful. (Our legitimate interest in operating a useful directory.)
- To keep the service safe: preventing spam and abuse — for example, a client can have at most three open requests with the same maker — and investigating misuse. (Legitimate interest.)
- To send emails you asked for: trunk-show alerts and, for makers, request notices, digests and the monthly report. Each alert and report email has an unsubscribe link. (Your request or consent.)
- To measure our advertising, through Google Analytics and the Google Ads tag described above. (Our legitimate interest, or your consent where the law requires it.)
- To meet legal obligations and to establish or defend legal claims.
We do not sell personal information. We do not use what you send in a request or message — whether through the site, the API or an AI assistant — for advertising or profiling, and we do not use it to train AI models.
Requests made by AI assistants
AI assistants can search the directory and send requests or messages for you through our API and MCP server. We treat a request sent by an assistant exactly like one sent through the form: it contains what the assistant sends on your behalf, and the maker sees the assistant’s name alongside it. An assistant should only send a request you have approved.
Nothing is booked when a request is sent. Every appointment is a request until the maker accepts it; your assistant can check the status, and you can read and reply to the conversation at the private link we email you. The assistant’s provider (for example Meta for Muse, or OpenAI, Anthropic or Google) handles the conversation you have with it under its own privacy policy; we receive only what it sends to us.
How long we keep it
- Appointment requests, messages and their conversations: 24 months after the last activity on the request. After that we delete them or remove the details that identify you. If a maker accepts, the entry in that maker’s client list stays while the maker keeps it there or until you ask us to delete it.
- Page-view records: up to 24 months. They contain no IP address or user-agent.
- Alerts, follows and accounts: until you unsubscribe, delete your account or ask us to remove them.
- Maker profiles and dashboard data: while the maker is listed. If a maker asks to be removed, we take the listing down and delete their account data within 30 days, apart from records we need to keep for legal reasons.
- Emails and submissions you send us: as long as needed to deal with them, and no longer than 24 months unless an ongoing matter requires it.
You can ask us to delete your information sooner at any time (see below). Deleted information can remain in our providers’ routine backups for a short time until those backups are replaced. Google keeps analytics data under the retention settings of its services.
Your choices and rights
Write to christian@trunkville.com to see the information we hold about you, correct it, have it deleted, get a copy of it, or object to how we use it. We will answer within 30 days and may ask you to confirm the request from the email address involved. Deleting a request removes it from Trunkville; if a maker already received it, ask the maker too, as they keep their own records.
If you are in the European Economic Area, the United Kingdom or Switzerland, you have these rights under the GDPR, including the right to withdraw consent and to complain to your local data protection authority. If you live in California or another US state with a privacy law, you have the right to know, access, correct and delete your personal information and to opt out of its sale or of its sharing for targeted advertising. We do not sell personal information; the Google Ads tag described above is the only advertising technology on the site, and you can opt out of it by blocking its cookies or writing to us. We will not treat you differently for using any of these rights.
Security and where your information is stored
The site is served only over HTTPS. Database access is restricted with row-level security, maker passwords are stored as one-way hashes, and each request’s conversation is reachable only through a long, unguessable link. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.
Our database and hosting are in the United States. If you use Trunkville from elsewhere, your information is transferred to and processed in the United States; where the law requires it, we rely on the safeguards in our providers’ data processing terms, such as the European Commission’s Standard Contractual Clauses.
Children
Trunkville is not directed to children, and we do not knowingly collect information from anyone under 16. If you believe a child has given us information, write to christian@trunkville.com and we will delete it.
Changes to this policy
We will update this page when our practices change and change the date at the top. If a change is significant, we will say so on the site or by email before it takes effect.
Contact
Trunkville LLC · christian@trunkville.com. See also our Terms of Service.