Your privacy
Privacy Policy
Effective date: October 16, 2026 · Last updated: October 16, 2026
Messy Nessie is operated by Bad Keyboard LLC, doing business as Messy Nessie (“Messy Nessie,” “we,” “us”). This policy explains what information we collect when you visit creatureclean.com, buy from us, or contact us; how we use it; and the choices you have.
Summary
- We collect what we need to sell and ship your order, answer your questions, and keep the site secure.
- We use Google Analytics to understand how our site is used. We don’t use it for advertising.
- We use Hotjar session recording only if you choose to allow it.
- We do not sell your personal information, and we do not share it for targeted advertising.
- You can change your choices at any time using at the bottom of every page.
Information we collect
When you place an order
Checkout is handled by our payment processor, Stripe. Stripe collects your payment details, name, shipping address and email address. We never see or store your full card number. We receive and keep your email address, what you ordered, order totals, shipping and tracking details, and order status, and we use your shipping address, provided through Stripe, to fulfill your order.
When you contact us
Our contact form collects your name, email address and message, and an order number and subject if you provide them. We also record the page you sent it from, your IP address and your browser’s user-agent string, to help prevent spam and abuse.
When you request wholesale pricing or business samples
These forms collect your business or organization name, your name, email address and how you plan to use Messy Nessie, and—depending on the form—your phone number, website or social media, business type, estimated quantity, message and (for sample requests) a shipping address. We also record the page you submitted from, your IP address and your browser’s user-agent string. If we approve a sample request, we may email you a secure link to provide or update your shipping address.
Business contacts
We may contact businesses about wholesale opportunities using business contact information that is publicly available, such as a business’s published email address. We keep a record of these messages.
Emails we send
We send order confirmations, shipping updates and replies to your requests using our email provider, SendGrid.
Information collected automatically
Server logs. Like most websites, our web server automatically records requests to it, including your IP address, the page requested, the date and time, the referring page and your browser’s user-agent string. We use these logs for security, troubleshooting and keeping the site running. They are kept for about 14 days and then deleted.
Country lookup. To decide which privacy choices to show you, our server looks up the country associated with your IP address in a database stored on our own server (IP Geolocation by DB-IP). Your IP address is not sent to another company for this, and we don’t store the result beyond your browser session.
Analytics and session recording. See “Analytics and session recording” below.
Cookies and browser storage
Necessary (always on)
These are needed for the site to work, so they can’t be turned off.
| Name | Type | Purpose | Duration |
|---|---|---|---|
messyNessieCart | Browser storage | Remembers what’s in your cart | Until you clear it |
mn_privacy | Browser storage | Remembers your privacy choices | Until you clear it |
mn_region | Browser session storage | Remembers whether your location requires consent before analytics | Until you close your browser |
messy_contact_csrf, messy_wholesale_csrf | Cookie | Protects our forms against forged submissions; set only when you submit a form | 2 hours |
| Google reCAPTCHA | Google cookies and signals | Protects our contact, wholesale and sample forms from bots; used only on pages with those forms | Set by Google |
| Stripe | Cookies on Stripe’s checkout pages | Payment processing and fraud prevention | Set by Stripe |
Optional (you control these)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga, _ga_FDXSMYQQCP | Google Analytics | Distinguishes visits for site statistics | Up to about 13 months |
_hjSessionUser_6802324 | Hotjar | Recognizes a returning visitor (only if you allow session recording) | 1 year |
_hjSession_6802324 | Hotjar | Keeps the current session together (only if you allow session recording) | 30 minutes |
Hotjar may set other short-lived _hj cookies or browser storage for its own operation, but only after you allow session recording. If you turn an optional tool off, we delete its cookies from our site.
Analytics and session recording
Google Analytics. We use Google Analytics 4 to see how many people visit, which pages they view, and how they move through the shop—such as viewing products, adding to cart, starting checkout and completing a purchase. Google Analytics collects information such as pages visited, approximate location, device and browser type, and referring site. We have turned off Google’s advertising features, Google Signals and ad personalization, and we do not use Google Analytics for cross-site advertising. We keep Google Analytics data for 14 months. If you are in a place that requires your consent first (the European Economic Area, the United Kingdom and Switzerland)—or if we can’t determine where you are—Google Analytics does not load until you allow it. Elsewhere it runs by default, and you can turn it off in Privacy Choices.
Hotjar (session recording). With your permission, we use Hotjar to understand how people use our site. Hotjar records how you interact with pages—mouse movements, clicks, scrolling and the pages you visit—along with device, browser and approximate location information. Hotjar does not run unless you choose to allow it. We configure Hotjar to mask information entered into form fields, and we do not run Hotjar on our contact, wholesale or sample request pages, our checkout result pages, or our order status and shipping address pages. Checkout itself takes place on Stripe’s site, where Hotjar does not run. We keep Hotjar data for 90 days. You can turn Hotjar off at any time in Privacy Choices.
How we use information
- To process, ship and support your orders, including returns and refunds
- To respond to your messages and wholesale or sample requests
- To send you service emails about your order or request
- To understand and improve our website and products
- To protect our site and customers from fraud, spam and abuse
- To meet legal, tax and accounting obligations
We do not use your information for automated decisions that have legal or similarly significant effects on you.
Who we share information with
We share information only with service providers that help us run Messy Nessie, and only for the purposes above:
| Provider | What they do |
|---|---|
| Stripe | Payment processing and checkout |
| SendGrid (Twilio) | Sending our emails |
| Google Analytics (site statistics); reCAPTCHA (bot protection on our forms); Google Maps Places (address suggestions on our sample request and shipping address forms, which sends what you type in the address field to Google) | |
| Hotjar | Session recording, only if you allow it |
| Amazon Web Services | Hosting for our website and database |
| Shipping carriers | Delivering your order or samples |
We may also disclose information if required by law, to protect our rights or the safety of others, or as part of a sale or reorganization of our business.
We do not sell personal information, and we do not share personal information for cross-context behavioral (targeted) advertising.
How long we keep information
- Orders: as long as needed to fulfill and support them and to meet tax and accounting requirements (generally up to 7 years).
- Contact messages, wholesale requests and sample requests: as long as needed to respond and manage the business relationship, then deleted on request or when no longer needed.
- Server logs: about 14 days.
- Google Analytics: 14 months.
- Hotjar: 90 days.
Your choices and rights
Privacy Choices. Turn Google Analytics and Hotjar on or off at any time using , also linked at the bottom of every page.
Global Privacy Control (GPC). If your browser sends a Global Privacy Control signal, we treat it as a request to opt out: Hotjar will not run, and advertising and personalization storage stays off. Privacy Choices shows that your signal was recognized. We treat the browser “Do Not Track” setting the same way.
Your rights. Wherever you live, you can ask us to tell you what personal information we have about you, give you a copy, correct it or delete it, subject to information we must keep by law (such as order records). Residents of some states and countries have these rights under law; we extend them to all of our customers, and we will not treat you differently for exercising them. To make a request, email nessie@creatureclean.com. We may need to verify your identity before acting on a request, and you may use an authorized agent. We respond within 45 days. If we decline a request, you may appeal by replying to our decision.
Emails. Service emails about your order can’t be turned off while the order is active.
Children’s privacy
Messy Nessie is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.
Security
We use reasonable safeguards, including encrypted (HTTPS) connections and access controls. No method of transmission or storage is completely secure.
Where we process information
We are based in the United States, and our providers process information in the United States. If you visit from outside the U.S., your information will be transferred to and processed in the U.S.
Changes to this policy
We will post any changes here and update the “Last updated” date. If we make a material change to how we use analytics or session recording, we will ask for your choices again.
Contact us
Messy Nessie (Bad Keyboard LLC, doing business as Messy Nessie)
Email: nessie@creatureclean.com