MessyBunMade

Privacy Policy

Last updated: . This policy describes how MessyBunMade (“we,” “us,” or “our”) handles personal information when you use messybunmade.com and related brand pages.

Who we are

MessyBunMade is a creator brand operated in connection with TikTok @MessyBun.Made (Amanda). The public website is hosted on Cloudflare Pages. This policy applies to personal information processed in connection with the website and brand communications described below.

Scope

This policy covers messybunmade.com (including preview and production hostnames such as *.pages.dev used for deployment review) and information you choose to send us through channels we control. It does not control TikTok’s own platform privacy practices—those are governed by TikTok’s policies when you use that service.

Important operational note (current state): At this time, the only ways to intentionally submit personal information to Amanda / MessyBunMade through channels we operate are:

We do not currently operate newsletter signups, account registration for the public site, paid checkout on this domain, or third-party advertising pixels on this site. If that changes, we will update this policy and any required notices or consent mechanisms before collecting new categories of data for those purposes.

Information we collect

Information you provide

Information collected automatically

We do not intentionally collect sensitive personal information categories (as defined under CCPA/CPRA) through the public site, and we ask that you not include sensitive data (such as government IDs, health details, or financial account numbers) in contact messages.

How you can contact Amanda

For brand questions and personal messages intended for Amanda, use only:

  1. Contact page on messybunmade.com; or
  2. TikTok @MessyBun.Made.

Privacy rights requests (access, deletion, etc.) should use the Privacy contact methods below so we can verify and track your request appropriately.

Cookies and similar technologies

Cookies are small text files stored on your device. Similar technologies include local storage, pixels, and server logs that can recognize a browser or session.

What we use today

Your cookie choices

California and some other jurisdictions require disclosure of online tracking. We do not respond to every browser “Do Not Track” signal in a uniform industry way (there is no single standard), but we honor Global Privacy Control (GPC) signals as an opt-out of sale/sharing where those concepts apply and where we process data that would constitute a sale or share. See Your choices.

How we use information

We use personal information to:

GDPR legal bases (when GDPR applies): performance of a request you initiate (responding to contact), legitimate interests (site security, basic operations, fraud prevention) balanced against your rights, and consent where we rely on consent (for example non-essential cookies if introduced). You may withdraw consent at any time without affecting prior lawful processing.

Sharing and service providers

We do not sell your personal information for money. We also do not currently share personal information for cross-context behavioral advertising as those terms are used under CCPA/CPRA.

We use service providers (“processors”) that process data on our behalf, which may include:

Providers may only use personal information as needed to perform services for us, subject to contractual and technical controls appropriate to the service. We may also disclose information if required by law, legal process, or to protect vital interests and security.

International transfers

Our infrastructure may process data in the United States and other locations where Cloudflare or other providers operate. If you are in the EEA, UK, or Switzerland, transfers of personal data outside your region (when applicable) rely on appropriate safeguards such as Standard Contractual Clauses or the provider’s approved transfer mechanisms, together with supplementary measures where required.

Retention

We keep personal information only as long as needed for the purposes described in this policy, including legal, accounting, or security requirements. Contact messages are retained for a reasonable period to complete the conversation and for legitimate record-keeping, then deleted or de-identified when no longer needed. Server logs are retained according to our providers’ defaults and our operational needs (typically short- to medium-term for security and debugging).

Security

We use reasonable administrative, technical, and organizational measures appropriate to the risk, including HTTPS, least-privilege access for Admin, and provider security features. No method of transmission or storage is 100% secure; please use the contact form judiciously and avoid sending highly sensitive information.

Your rights under the GDPR

If you are in the European Economic Area, United Kingdom, or another jurisdiction where the General Data Protection Regulation (GDPR) or UK GDPR applies, you may have the right to:

To exercise GDPR rights, see Privacy contact. We may need to verify your identity before fulfilling a request. We will respond within the timeframes required by applicable law (generally within one month under GDPR, extendable where permitted).

California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, “CCPA/CPRA”) may provide rights regarding personal information, subject to applicability thresholds and exceptions. Categories of personal information we may collect are described above (identifiers such as name and email if you contact us; internet / network activity such as IP and logs via hosting; and inferences we do not currently create for advertising profiles).

California residents may have the right to:

Sale / sharing: We do not sell personal information for monetary consideration. We do not currently share personal information for cross-context behavioral advertising. If that changes, we will provide a “Do Not Sell or Share My Personal Information” mechanism and honor opt-out preference signals such as GPC as required.

Shine the Light / other California notices: We do not disclose personal information to third parties for their own direct marketing based on a site visit alone in the manner addressed by California Civil Code §1798.83 beyond what is described in this policy. For metrics, contact us as below.

Authorized agents may submit requests where permitted; we may require proof of authorization and identity verification. Submit CCPA/CPRA requests via Privacy contact.

Other US state privacy rights

As of 2026, many US states have comprehensive consumer privacy laws in effect (for example Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others, in addition to California). These laws generally provide residents with rights to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, sale of personal data, and certain profiling, subject to each law’s scope and thresholds.

If you are a resident of a state with such a law and it applies to us, we will honor applicable rights requests in accordance with that law. Use Privacy contact and specify your state of residence. We will not discriminate against you for exercising privacy rights. Where a state law requires an appeal process after a denial, we will provide appeal instructions in our response.

Universal opt-out mechanisms: Where required, we treat recognized opt-out preference signals (including Global Privacy Control) as a valid request to opt out of sale / sharing / targeted advertising for that browser or device, to the extent those processing activities occur.

Children’s privacy

The site is not directed to children under 13 (or under 16 where relevant under GDPR). We do not knowingly collect personal information from children under 13. If you believe a child provided personal information, contact us and we will take appropriate steps to delete it. We do not have actual knowledge that we sell or share personal information of consumers under 16.

Your choices (DNT, GPC, marketing)

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. Material changes may be highlighted on the site or communicated by other appropriate means. Continued use of the site after an update constitutes notice of the revised policy to the extent permitted by law; where consent is required for new processing, we will request it.

Privacy contact

For privacy questions or to exercise your rights under GDPR, CCPA/CPRA, or other applicable laws:

We may request additional information to verify your identity and, for authorized agents, proof of authority. If we deny a request in whole or in part, we will explain the reasons and any appeal rights required by law.

This policy is provided for transparency and compliance orientation for MessyBunMade’s website. It is not formal legal advice. Thresholds under CCPA/CPRA and other US state laws may mean some obligations apply only when statutory criteria are met; we still aim to honor reasonable privacy requests consistent with this policy.