Privacy policy

The short version

• We never see your full card number. Stripe handles payment.
• We do not sell, rent or trade your information, and we do not run ads.
• There are no advertising or cross-site tracking cookies on this site.
• Your order in progress is stored in your own browser, not on our servers.
• Want your details deleted? Email info@mlabedh.com and we will do it.

What we collect

When you place an order

Checkout runs on Stripe. You enter your details on Stripe's page, not ours. Stripe passes us what we need to send the parcel and answer questions about it:

• Name and shipping address
• Email address
• What you ordered — the sizes and how many packs
• Amount paid, and the last four digits and brand of the card

We never receive or store your full card number, its expiry or its security code. If you use a discount code, we see which code you used.

When you use the contact form

The form asks for your name, email address, what the message is about, an optional order number, and the message itself. It is protected by Cloudflare Turnstile, which checks that you are not a bot. Submissions reach us as a Telegram notification.

When you just visit

Our host, Vercel, keeps standard server logs, which include IP addresses and browser user-agent strings. We also use Vercel Web Analytics, which reports aggregate page views and referrers and does not build a profile of you across sites.

Your order in progress

When you add a size, that choice is written to your browser's local storage under the key mlab-cart-v1, so that checking a measurement on another page does not lose it. It holds only sizes and quantities, never anything personal, it never leaves your device, and clearing your browser data removes it.

Cookies

We do not set advertising cookies, and there are no third-party ad or social tracking scripts on this site. The only thing we keep in your browser is the order described above, which is local storage rather than a cookie. Stripe sets its own cookies on Stripe's checkout pages for fraud prevention; that is covered by Stripe's privacy policy.

Why we have it

• To take payment, pack the right sizes and post them to you
• To email you a receipt and tracking
• To answer your questions, including putting a wrong size right
• To spot fraud and keep spam off the contact form
• To see which pages get used, in aggregate, so the sizing guide gets better
• To meet our tax and record-keeping obligations

We do not send marketing email, and buying from us does not sign you up for anything. The one exception is opt-in: Stripe's checkout page shows a tick box asking whether we may email you promotional content. If — and only if — you tick it, and you leave before paying, we may send you one email with a link back to your order. Leave it unticked and Stripe does not even pass us your address. Every such email has an unsubscribe link.

Who else touches it

Each of these gets only what it needs to do its job, and none of them may use your information for their own marketing.

• Stripe — payment processing and fraud checks
• Vercel — hosting, server logs and aggregate analytics
• Cloudflare — the bot check on the contact form
• Telegram — how contact-form messages and order notifications reach us
• USPS — carriage, through the shipping label we buy
• Etsy or Amazon — only if you bought there rather than here, in which case their policies also apply

We may also disclose information if the law requires it, or if the business is ever sold or merged — in which case we will say so here before it changes hands.

How long we keep it

Order records are kept for seven years, because tax rules require it. Contact-form messages are kept while they are useful for support, then deleted. Server logs and analytics follow our providers' own schedules, which are measured in months rather than years.

Your rights

Wherever you live, you can ask what we hold about you, ask us to correct it, or ask us to delete it. Email info@mlabedh.com and we will act on it. There is no charge, and we will not treat you differently for asking.

If you are in California

The CCPA and CPRA give you the right to know what is collected and why, to have it deleted, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those laws define it, so there is nothing to opt out of — the other rights apply, and the email above is how to use them.

If you are in the UK or EU

Our lawful bases are performing the contract when you order, our legitimate interest in keeping the site working and free of fraud, and legal obligation for tax records. You can also ask for a copy of your data in a portable form, or object to processing.

Security

The site is served over HTTPS, and payment is handled by Stripe, which is PCI-compliant and the reason we do not hold card numbers. Access to order records is limited to the person who packs and posts them. No system is perfectly secure, and we would rather say that plainly than claim otherwise.

Children

This is a replacement part for camp chairs, not a product aimed at children, and we do not knowingly collect information from anyone under 13. If you believe a child has sent us their details, email us and we will delete them.

Changes

If this policy changes, the date at the top of the page changes with it. Anything material will be described here rather than slipped in quietly.