Skip to content

Legal

Privacy Policy

Last updated: October 10, 2026

The short version

Retrofit Creations is a small custom fabrication shop. We collect only what we need to make, ship and support your order or answer your quote request, and we treat it the way we'd want our own treated.

  • We never sell your information, and we never share it for advertising.
  • No ads and no tracking. The site has no advertising cookies or tracking pixels. We count visits anonymously, without cookies, so we know which pages are useful; nobody can be identified or followed from it (see Cookies and browser storage).
  • Your card number never reaches us. You type it into Square's secure payment form, and Square processes the payment.
  • We only email you about your order or your quote. No newsletters or marketing emails.
  • You're in control. Email hello@retrofitcreations.com at any time to get a copy of your information, correct it, or have it deleted. These rights apply to everyone, wherever you live.

Who we are

This website is run by Retrofit Creations, LLC, based in Lakeside, California, in San Diego County (“we”, “us”). We are responsible for the personal information described here. Questions or requests about your privacy go to hello@retrofitcreations.com, and a real person — the owner — reads and answers them.

What we collect, and why

We collect information in these situations, and only these:

When you place an order

Your name, email address, shipping address, and phone number if you choose to give one; the items you ordered and what you paid. We use this to make and ship your order, send your confirmation and shipping updates, and keep the business records the law requires.

Payment cards: you enter your card details into a payment form provided by Square, not into our website. Square processes the payment and tells us whether it succeeded. We never see or store your full card number, expiry date or security code. Square may show us limited details, such as the card type and last four digits, in our Square account.

Photos you add to an order to be engraved

Some products let you add photos for us to engrave. They are sent straight to private storage as soon as you pick them, before you check out, and used only to make your order. We also note the internet (IP) address they came from, only to stop anyone uploading endlessly. Very large photos are made smaller on your own device first; others are kept exactly as you took them, so the engraving comes out sharp.

When you request a quote

Your name, email address, phone number if you give one, how you'd like us to contact you, and what you tell us about your project — the service, quantity, budget, deadline and description — plus any photos or documents you attach. Large photos are made smaller on your own device before they are sent, so they upload quickly. We use this only to understand your project and reply to you.

When you create an account

Your email address and a password, plus your name. You can also save a phone number and shipping address to make checkout faster. Your password is stored scrambled (hashed) by our account provider; nobody at Retrofit Creations can see it. If you place an order while signed in, it is linked to your account so you can see your order history.

If you leave Create an account for me ticked at checkout, we create the account with the name and email address on your order and email you a link to choose a password. Orders placed with that email address while you weren't signed in are added to your order history only once you've proven the address is yours (by setting your password from that link, or by confirming your email when you sign up). Untick the box and no account is created.

When you email us

Your email address and whatever you choose to include, so we can reply.

Reviews and project photos (when these features open)

If you submit a review or a photo of your project for our community page, we'll collect your name, email address, the review or photos, and the details you add. Your email address is never shown publicly. Nothing is published until we have reviewed it, and you can ask us to take it down at any time.

Automatically, when you use the site

To stop abuse: when someone places an order or requests a quote, we record the internet (IP) address and email address used, so we can block anyone making repeated fraudulent attempts. These records are temporary: the system clears out any that are more than 24 hours old each time someone checks out or requests a quote.

To keep the site running: like every website, our hosting provider briefly records technical details of each visit, such as IP address, browser type and the page requested. If something goes wrong with an order, our error logs may include the order's email address so we can put it right. These logs are kept for a short time and used only to fix problems.

What we don't collect

  • We don't track what you do on other websites, and we don't build profiles about you.
  • We don't collect your precise location. The only location we have is the address you give us for shipping.
  • We don't ask for Social Security numbers, government ID, financial account details or health information.
  • We don't buy information about you from anyone else.

Cookies and browser storage

The site stores only what it needs to work. There are no advertising or analytics cookies, so there is nothing to opt out of — but here is everything, so you know.

Sign-in cookie (only if you sign in)

Keeps you signed in to your account as you move between pages. It is removed when you sign out.

Your shopping cart (stored on your device)

What's in your cart is saved in your own browser, so it's still there if you come back later. It isn't sent to us until you check out. Clearing your browser's data removes it.

Checkout safety record (stored on your device, 15 minutes)

While you pay, your browser briefly remembers the payment attempt so that, if your connection drops and you press “Place Order” again, you can't be charged twice. It holds a one-time payment code from Square that is useless to anyone else, not your card details, and it is deleted when the payment completes, when the tab is closed, or after 15 minutes.

Anonymous visit counts (no cookies)

We use Vercel Web Analytics, from the company that hosts this site, to count page visits: which page, which page you came from, your country, and the kind of device and browser. It stores nothing on your device. A visit is counted using a code that changes every day and is deleted after 24 hours, so it can't identify you or follow you from one day to the next or to other websites. Your account and order pages are never counted, and web addresses are counted without anything after a “?”, so codes in our email links are never sent. See Vercel's analytics privacy details (opens in a new tab).

Square's payment form (checkout page only)

Square's secure card form may use its own cookies or collect information about your device to prevent fraud. That is covered by Square's Privacy Notice (opens in a new tab).

“Do Not Track” and Global Privacy Control: we don't track visitors across websites, so these signals don't change anything we do. We still honor them: if your browser sends a Global Privacy Control signal, we treat it as a request not to sell or share your information — which we already don't do.

Our fonts and images load from our own site and our storage provider, not from advertising networks, so viewing a page doesn't tell anyone else what you looked at.

How we use your information

  • To make, ship and support what you ordered, and to answer your quote request.
  • To send the emails you'd expect: order confirmations, shipping updates, replies to your quote, and account emails such as password resets.
  • To prevent fraud and abuse, and keep the site and your account secure.
  • To keep the records that tax and accounting law require.
  • To comply with the law, and to protect our rights if there is ever a dispute.

We don't send marketing emails. If that ever changes, it will only be to people who ask for them, and every one will have an unsubscribe link. We don't use your information to make automated decisions about you.

Who helps us handle it

We don't sell your information, rent it, or trade it. To run the shop we use a handful of trusted companies, and each receives only what it needs to do its job for us:

Square — payments

Processes your card payment. Square receives the details you type into its payment form, the amount, and your email address with the order.

Supabase — our database, accounts and file storage

Stores orders, quote requests, accounts and uploaded files, on servers in the United States (Ohio).

Vercel — website hosting

Runs the website and keeps the short-lived technical logs described above.

Resend — email delivery

Sends our order, quote and account emails on our behalf, using Amazon Web Services.

Cloudflare — web address and incoming email

Manages our web address and forwards email sent to any @retrofitcreations.com address, including hello@retrofitcreations.com, to our business inbox.

Google (Gmail) — our business email inbox

The one inbox where every email sent to our @retrofitcreations.com addresses arrives, along with our order and quote notifications.

Shippo — shipping prices

Works out the postage for your order at checkout. Shippo receives only your ZIP code, state and country and the parcel's weight: not your name, street, email or phone number.

Shipping carriers — USPS, UPS and FedEx

Whichever one carries your order receives your name, shipping address and, where the carrier requires it, phone number, to deliver it.

The people who build and maintain this website

May see information in our systems only when it is needed to keep the site working or fix a problem.

We may also disclose information if the law requires it, to protect someone's safety, or to protect our rights. If the business is ever sold or merged, your information would pass to the new owner only under this policy's promises, and we would tell you first.

How long we keep it

We keep information only as long as there's a good reason to:

Orders

Seven years from the order date, for tax and audit purposes.

Photos added to an order for engraving

Deleted automatically 90 days after your order is delivered, cancelled or refunded. Photos added but never ordered (a cart you didn't check out) are deleted after 7 days. Ask us and we'll delete yours sooner.

Quote requests and the files you attach

While we're working on your project, and for a reasonable time afterwards so we can answer follow-up questions or make the part again. Ask us and we'll delete them sooner.

Your account

Until you ask us to delete it.

Abuse-prevention records

About a day (see above).

Hosting and error logs

A short period set by our hosting provider, typically days.

Emails

In our inbox for as long as they're useful for your order or project.

How we protect it

  • Every page is served over an encrypted connection (HTTPS).
  • Card details go straight to Square and never touch our systems.
  • Database rules mean a signed-in customer can only ever see their own orders and quotes.
  • Only the owner's administrator account can see customer orders and quote requests.
  • Files you attach to a quote, and photos you add to an order for engraving, are stored privately. They are only ever shown to us through links that expire after an hour.
  • Passwords are stored scrambled (hashed) and must meet strength rules.
  • The website's security has been reviewed, and fixes are checked before they go live.

No system is perfectly secure. If a breach ever affects your personal information, we will tell you promptly and as the law requires, explain what happened, and tell you what we're doing about it.

Your rights and choices

Whoever you are and wherever you live, you can ask us to:

  • See it — what we have about you, where it came from, and who we've shared it with.
  • Get a copy in a common format you can take elsewhere.
  • Correct it if anything is wrong. Signed-in customers can also update their name, phone number and address on their account page.
  • Delete it, including your account.
  • Stop any sale or sharing for advertising — which we already never do.
  • Withdraw consent for anything that relies on it.

How to ask

Email hello@retrofitcreations.com with “Privacy request” in the subject. To protect you, we'll check the request really comes from you — usually by replying to the email address on your order or account, or by asking for an order or quote number. Someone you authorize, such as a family member, can ask on your behalf with your written permission.

We'll confirm we received it within 10 business days, and complete it within 30 days. If a request is complicated we may need longer, up to the time the law allows, and we'll tell you why. It's free.

Sometimes the law requires us to keep something — for example, order records for tax purposes. If so, we'll tell you what we must keep and why, delete everything else, and keep the rest only for that purpose.

We will never treat you differently — in price, service or anything else — for using any of these rights. If you disagree with how we handled your request, reply and ask us to look again; the owner will review it personally.

California residents

California law gives you specific privacy rights. We give them to everyone (see above), and this section adds the details California asks businesses to spell out.

In the last 12 months we have collected these categories of personal information:

  • Identifiers — name, email address, postal address, phone number, IP address.
  • Customer records — the same contact and shipping details, and payment status (not card numbers).
  • Commercial information — what you ordered or asked us to quote.
  • Internet activity — the short-lived technical logs described above.
  • Photos and documents you choose to send us.
  • Account sign-in details — your email address and password, used only to let you sign in.

It comes directly from you, and from Square about whether your payment succeeded. We use it for the purposes in “How we use your information”, share it only with the companies in “Who helps us handle it”, and keep it as described in “How long we keep it”.

We do not sell or share personal information, as California law defines those terms, and haven't in the last 12 months. We don't knowingly sell or share the information of anyone under 16. We use sensitive information (your password) only to let you sign in.

“Shine the Light”: we don't give personal information to anyone for their own marketing.

Visitors outside the United States

We're based in the United States, and your information is stored and handled here. If you're in the European Union, the United Kingdom or somewhere with similar laws: we use your information because we need it to fulfil your order or answer your request (a contract), to keep legally required records (a legal obligation), and to keep the site secure and prevent fraud (our legitimate interests). You have the rights listed above, and you can also complain to your local data protection authority — though we'd appreciate the chance to put things right first.

Children

This site is not meant for children under 13, and we don't knowingly collect information from them. If you believe a child has given us personal information, email hello@retrofitcreations.com and we'll delete it.

Changes to this policy

If we change how we handle personal information, we'll update this page and the date at the top first. If a change is significant, we'll also say so on the website, and email account holders before it takes effect. We will never use information we already hold in a new way without telling you first.

Contact us

Retrofit Creations, LLC
11872 Lakeside Ave
Lakeside, CA 92040
Email: hello@retrofitcreations.com

See also our Terms of Service and Shipping & Returns.