01 Plain English summary
I run a small workshop, not an ad network. The only data I collect is the data I need to ship you a product, deliver a digital download, send you an order confirmation, or — if you opt in — send you the monthly newsletter. I don't sell your data, ever.
The short list of what we actually have on you:
- Name, email, shipping address (if you ordered a physical product)
- Order history (what you bought, when, for how much)
- Payment info — only Stripe sees your card; we see the last 4 digits
- Basic analytics (page views, device type) — no personal identifiers
02 What we collect
Information you give us
- Order data: name, email, billing & shipping address, phone (for physical orders), product selections.
- Payment data: processed entirely by Stripe. We receive: card brand, last 4 digits, expiration month/year, and a Stripe customer ID. We do NOT receive or store your full card number, CVC, or PIN.
- Newsletter signup: email address only.
- Quote form / contact form: name, email, phone, and any details you choose to share.
- Support messages: whatever you write to us via email.
Information collected automatically
- Server logs: IP address, browser type, pages visited, timestamps. Used for security monitoring and basic traffic analysis. Auto-deleted after 30 days.
- Cookies: minimal — see Section 5.
- Analytics: if we use a privacy-focused analytics tool (Plausible, Fathom, or similar), it collects anonymized counts only. No Google Analytics, no Meta Pixel, no advertising trackers.
03 How we use it
We use your information only for the following purposes:
- Fulfilling your order — shipping the kit, delivering the digital file, processing payment, handling returns.
- Customer support — answering your questions, troubleshooting issues.
- Communicating about your order — confirmation, shipping updates, refund notifications.
- Newsletter — only if you signed up; you can unsubscribe with one click.
- Legal & tax compliance — keeping records as required by U.S. and Georgia law.
- Improving the site — looking at aggregated, anonymized traffic to understand which pages are useful.
We will never:
- Sell your data to anyone, for any reason.
- Share your contact info with advertisers, data brokers, or marketing companies.
- Use your data to retarget you with ads across the internet.
04 Third parties & processors
We rely on a small number of trusted vendors to operate the site. Each handles a specific job and is contractually bound to protect your data:
| Vendor | What they do | What they see |
|---|---|---|
| Stripe | Payment processing | Full payment details, billing/shipping address, order amount |
| Netlify | Web hosting & serverless functions | IP, server logs (30-day retention) |
| Resend (or equivalent) | Sending order & newsletter emails | Your email address, message contents |
| USPS / shipping carriers | Delivering physical orders | Shipping address, package contents |
| Formspree | Quote & contact form submissions | Form data you submit |
We do not use Google Analytics, Meta Pixel, or any advertising-network trackers.
05 Cookies & tracking
We use only the minimum cookies required to operate the site:
- Essential cookies: needed for the site to function (e.g., cart contents during a single session).
- Stripe checkout cookies: set by Stripe during checkout for fraud prevention; governed by Stripe's cookie policy.
We do not use advertising cookies, retargeting pixels, or third-party trackers. You can disable cookies in your browser settings, though some site features may not work.
06 Data retention
- Order records: retained for 7 years (required by Georgia tax law).
- Customer emails: retained as long as you're a customer, plus 3 years for support reference.
- Newsletter subscribers: retained until you unsubscribe, then deleted within 30 days.
- Server logs: auto-deleted after 30 days.
- Form submissions: retained for 2 years.
07 How we protect data
We take reasonable, industry-standard precautions:
- Encryption in transit: the entire site uses HTTPS/TLS.
- Encryption at rest: Stripe and our other processors encrypt stored data.
- No card data on our servers: Stripe handles all sensitive payment information.
- Limited access: only the workshop owner has access to customer data.
- Two-factor auth: required on all admin accounts (Netlify, Stripe, email).
No security system is perfect. If we discover a data breach affecting your information, we will notify you within 72 hours where required by law.
08 Your rights
Regardless of where you live, you have the right to:
- Access the data we have about you.
- Correct inaccurate information.
- Delete your data (subject to legal retention requirements; e.g., we must keep tax records).
- Export your data in a portable format.
- Opt out of marketing communications at any time.
For California residents (CCPA/CPRA)
You also have the right to know what categories of personal information we collect, opt out of any "sale" of your data (we don't sell data), and not be discriminated against for exercising these rights.
For EU/UK residents (GDPR)
Our legal bases for processing your data are: (a) contract — to fulfill your order; (b) consent — for the newsletter; (c) legitimate interest — to operate the site and support customers; (d) legal obligation — to comply with tax law. You also have the right to lodge a complaint with your local data-protection authority.
To exercise any of these rights, email sales@customhydroponicsolutions.com. We respond within 30 days.
09 Children's privacy
This site is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe we have inadvertently collected such data, contact us and we will delete it immediately.
School-affiliated orders (STEM kits) are placed by adult staff, who are responsible for any onward use of materials in classrooms.
10 International users
We ship within the United States. If you access this site from outside the U.S., your data will be transferred to and processed in the U.S. By using the site, you consent to this transfer.
11 Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be announced via email to active customers and on the homepage. Continued use of the site after changes means you accept the updated policy.
12 Contact
Privacy questions or data-rights requests:
- Email: sales@customhydroponicsolutions.com
- Subject line: "Privacy Request" (helps us respond faster)
If you've read this far, you care about your privacy. Good. So do I. If something here is unclear or you want me to delete your data right now, just ask. — Scott