Privacy policy

We collect two kinds of data: what you type into the site, and what the server records while you use it.

You give us:

• Contact details — first and last name, company, email, phone.
• Delivery and billing details — street address, city, state or province, postal code, country.
• Order content — the configuration, quantity and price of the units you ask for, and any note you add.
• Account data, if you create one — email, password (stored only as a bcrypt hash), your saved addresses and favourites.
• Anything you send us by email, the contact form or messaging, including files such as site photos or floor plans.

We record automatically:

• Order and account records: timestamps, order status, the payment provider and transaction reference.
• The IP address an order was placed from, kept with the order as an anti-fraud and audit trail.
• Aggregated visit counts. For these we store a salted hash of the IP address, not the address itself.
• Your browser’s user-agent string, for troubleshooting and for keeping the site usable across devices.

We do not knowingly collect special-category data (health, biometrics, political opinions) and we do not build advertising profiles.

Card payments are handled by Stripe on its own hosted checkout page, and PayPal payments by PayPal on paypal.com. Your card number, CVC and bank credentials are entered on their pages and never reach our servers, and we never store them.

What we receive back is limited to: the payment status, the amount, the currency, the provider’s transaction or order reference, and the last four digits plus card brand in some Stripe reports. We store that reference against your order so we can reconcile payments, handle refunds and answer a dispute.

Payments are also possible by company invoice or wire transfer. For those we keep the bank reference and the invoice we issued.

We use the minimum needed to run the shop. There is no advertising or cross-site tracking cookie.

• Session cookie — set only when you sign in, to keep you signed in. Removed when you sign out or after seven days of inactivity.
• Cart in local storage — the items you put in the cart are kept in your browser, keyed bothaus.cart.v1, so the cart survives a refresh. Clearing your browser storage removes it.
• Last order snapshot — the summary of your most recent order is held in the same browser storage so the confirmation page can render it. It never leaves your device.

Payment providers set their own cookies on their own domains when you are redirected there; those are governed by the Stripe and PayPal privacy policies.

We share data only with the suppliers that make the order work, and only what they need:

• Payment providers — Stripe and PayPal, to take the deposit or full payment and to process refunds.
• Carriers and freight forwarders — name, address, phone and the unit’s shipping details, so the machine can be delivered.
• Manufacturing partners — where a unit is configured or commissioned to order, the configuration and delivery address.
• Hosting and email providers — who store the site, its database and our mail, under contract and only on our instructions.
• Authorities — where we are legally required to respond, including export-control and sanctions checks.

We do not sell personal data and we do not share it for anyone else’s marketing.

• Order, invoice and payment records — seven years, because tax and warranty obligations require it.
• Account profile, addresses and favourites — until you delete the account, then removed within 30 days.
• Contact-form and email enquiries that never became an order — 24 months.
• Server and security logs — 90 days.

When a retention period ends we delete the record or, where it is embedded in an accounting file we must keep, we keep the minimum and restrict access to it.

Depending on where you live, you may ask us to:

• confirm what we hold about you and give you a copy;
• correct anything that is wrong;
• delete what we no longer have a legal reason to keep;
• restrict or object to a particular use;
• send you a portable copy of the data you gave us;
• withdraw a consent you gave earlier — for example for a newsletter.

Write to support@bothaus.com from the address on the account, or tell us the order number, and we will action it within 30 days. We may ask one question to confirm it is you. If you are in the EU or UK you also have the right to complain to your local supervisory authority; in California you may ask us not to sell or share personal information — we do neither.

The site runs over TLS. Passwords are stored as bcrypt hashes, never as text. Card data never touches our servers because payments are completed on the provider’s hosted pages. Access to order data is limited to the people who quote, ship and support your machine, and administrative access is logged.

No system is perfect. If a breach ever affects your data, we will notify the affected customers and the relevant authority as required by law.

The site sells industrial machinery to businesses and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, write to us and we will delete it.

When this policy changes we update the date at the top of the page. If the change materially affects how we use data we already hold, we will email customers with an open order or an account.

BOTHAUS · Austin, Texas, United States
Email support@bothaus.com — or use the contact form.