Privacy policy

Who we are

Loftstead LLC, 10358 E Wood Dr, Scottsdale, AZ 85260, United States. Questions about this policy go to contact@loftstead.com.

What we collect

• Order details. Name, email address, phone number and shipping address, entered by you at checkout. These are needed to take payment and deliver the parcel.
• Payment records. Stripe processes the payment and returns a session reference, the amount, the payment status and the last four digits of the card. We never receive or store a full card number.
• Support messages. If you email us, we keep the thread so the next person to help you has the history.
• Site analytics. Google Ads conversion tags record which visits led to a purchase, using the Stripe session reference as the transaction id.

What stays on your device

Your cart and your wishlist are stored in this browser using local storage. They are never sent to our servers, are not tied to an account, and are gone as soon as you clear site data. We do not require an account to place an order.

Why we are allowed to hold it

Order and payment data is processed to perform the contract you enter into when you buy something. Support history and fraud prevention rest on our legitimate interest in running the shop. Advertising measurement rests on consent, which you can withdraw through your browser or ad settings at any time.

Who processes data for us

• Stripe, Inc. Payment processing, checkout hosting, receipts, refunds. Stripe is the controller of card data it collects on its own page.
• Google LLC. Conversion measurement through gtag.js, only when a Google Ads identifier is configured for this site.
• Vercel Inc. Hosting and content delivery, which involves standard server logs including IP address.
• Shipping carriers. Name, address and phone number, passed only so a parcel can be delivered.

We do not sell or share personal information for cross context behavioural advertising, and we have never done so.

How long we keep it

Order records are retained for seven years to meet United States tax and accounting requirements. Support email is kept for three years. Analytics data follows the retention configured in the Google Ads account, which is 14 months by default.

Your choices

Wherever you live, you can ask us to confirm what we hold about you, send you a copy, correct it, or delete it. Residents of California, Colorado, Connecticut, Virginia and other states with comparable laws have these rights in statute, along with the right not to be discriminated against for using them.

Email contact@loftstead.com from the address on the order. We reply within 45 days. We may need to keep records that tax law requires us to retain, and we will tell you when that is the case.

Cookies and similar technology

The site sets no advertising cookies of its own. Local storage is used for the cart and wishlist as described above. When a Google Ads identifier is configured, gtag.js sets its own cookies for conversion measurement, and blocking them does not affect your ability to buy anything.

Children

This shop is not directed at children under 13 and we do not knowingly collect their information. If you believe a child has provided us data, contact us and we will remove it.

Security

Traffic is served over HTTPS. Payment pages are hosted by Stripe and are PCI DSS Level 1 compliant. Access to order data inside the company is limited to the people who pack orders and answer support.

Changes

If this policy changes materially we update the effective date at the top and describe the change here. Continuing to use the site after a change means you accept the current version.