Legal
Privacy Policy
This explains what we collect, why, who we share it with and what you can ask us to do about it. We sell laser cut hypotubes to businesses. We do not sell personal information, we do not run advertising trackers, and we do not build profiles for marketing.
1. Who we are
Stratos Laser, a California business at Davis, CA, is the controller of the information described here. Contact sales@stratoslaser.com.
2. What we collect
You give us
- Account: name, work email, password (stored only as a salted hash, never in readable form), and optionally company, job title and phone.
- Orders: contact name, email, phone, company, shipping address, PO number, and what you ordered.
- Messages you send us, including requirements you submit through the site.
We collect automatically
- A session cookie when you sign in. It holds a signed token, not your password, and it is strictly necessary: without it you cannot stay signed in.
- Browser storage on your own device for your cart. This stays in your browser and is never sent to us.
- Server logs with IP address, timestamp, page and user agent, kept for security and troubleshooting.
- Site activity such as which catalog pages were viewed, used to understand demand. Kept for 12 months.
We do not collect
Card numbers or bank details never reach our servers. Payment happens on our processor's hosted invoice page. We see only that an invoice was paid, the amount, and the last-four/brand the processor reports.
We do not use advertising cookies, third-party analytics, pixels, session recording or cross-site tracking.
3. Why we use it, and our legal basis
- To quote, build and ship your parts — performance of a contract.
- To run your account, including sign-in, password reset and order history — performance of a contract.
- To send transactional email such as order confirmations, invoices, payment notices and shipping notifications — performance of a contract. These are not marketing and you cannot opt out of them while you have an active order.
- To keep the site secure, including rate limiting and abuse prevention — legitimate interest.
- To meet legal, tax and quality-system obligations — legal obligation.
- Marketing email, if we ever send it, only with your consent, and every message will carry an unsubscribe link.
4. Who we share it with
We do not sell personal information and we do not share it for anyone else's marketing. We use a small number of service providers, each bound to use the data only to provide their service:
- Stripe — payment processing and invoicing. Stripe receives your name, email, company, billing/shipping address and the invoice contents, and is an independent controller for fraud and compliance. See Stripe's privacy policy.
- Microsoft 365 — the mailbox that sends and receives our email.
- Our hosting provider, which stores the site and its data in the United States.
- Carriers (FedEx, UPS or the carrier you nominate) — the name, address and phone needed to deliver.
- Manufacturing subcontractors, where a finishing step is not run in house, under confidentiality obligations.
- Professional advisers, and authorities where the law requires it.
If the business is sold or merged, information may transfer as part of it; we will say so beforehand where we can.
5. How long we keep it
- Account — while the account is open, then 12 months after you close it.
- Orders, invoices and tax records — 7 years, as California tax and federal accounting rules require.
- Quality records — for the period our quality system requires, which can be longer than the commercial relationship.
- Server and security logs — 90 days.
6. Your rights
Depending on where you live you may have the right to access a copy of your information, correct it, delete it, object to or restrict how we use it, receive it in a portable format, and withdraw consent where we relied on it.
California (CCPA/CPRA): you have the rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we do not process it for cross-context behavioural advertising. We will not discriminate against you for exercising a right.
EU/UK (GDPR): where these rights apply you may also complain to your supervisory authority. If we transfer information out of your region we rely on the European Commission's Standard Contractual Clauses.
To exercise any right, write to sales@stratoslaser.com. We will verify who you are before acting, and respond within the time the law allows. Some information we must keep, such as invoices and quality records; we will tell you when that applies and why.
7. Security
Sign-in uses a signed, expiring session token over HTTPS; passwords are stored only as salted hashes; sign-in attempts are rate limited; quoting tools require an account and are enabled individually; and administrative access is a separate application that is not reachable from this website. No system is perfectly secure, and we cannot guarantee absolute security.
8. Children
This is a business-to-business site and is not directed at children. We do not knowingly collect information from anyone under 16.
9. Changes
If we change this policy we will update the date above and, for material changes, tell account holders by email.
10. Contact
Stratos Laser
Davis, CA
sales@stratoslaser.com