Privacy policy

This policy explains what happens to your personal information when you use cavyconcepts.co.nz.

Cavy Components is a sole trader business run by Carl Cavanagh in Tauranga, New Zealand. Carl is the person responsible for your personal information, and he is the person you deal with directly. There is no team and no call centre.

The business does not publish a street address, so all contact is by email: carl@cavyconcepts.co.nz

This policy is written to meet the Privacy Act 2020.

The short version

This website is a static website. It has no customer accounts, no logins, and no customer database. Nothing on this site profiles you or follows you around the internet.

Your shopping cart never leaves your own browser until you choose to submit an order. When you do submit one, the details are turned into two emails, one to Carl and one to you, and then the website forgets them. The only copies that exist after that are in Carl’s mailbox and in yours.

There are no analytics, no advertising, no tracking pixels, and no marketing cookies on this site.

What stays in your browser and never reaches us

Your shopping cart is stored in your own browser, using a feature called local storage, under the name cavy-cart-v1. It holds the items you have added and the quantities.

This is important, so to be clear about it: that cart sits on your device. It is not sent to us as you shop, it is not a cookie, and it is not sent anywhere for analytics or advertising. Nobody but you can see it. It is only transmitted at the moment you fill in the order form and press the button to submit your order request.

One other thing is stored in the same place. If you choose a light or dark colour theme for the site, that choice is saved under the name cc-theme so the site looks the way you left it next time. That is all it does.

Those two items are the only things this website stores in your browser. You can clear both at any time by clearing your browser’s site data for cavyconcepts.co.nz. Clearing them empties your cart and resets the theme, and nothing else is affected.

What you send us when you place an order

When you submit an order request, the following information is sent to our server-side code:

• your name
• your email address
• your phone number
• whether you have chosen local pickup or shipping
• your shipping address, if you chose shipping
• any order notes you chose to write, which are optional
• the contents of your cart

That information is used for one purpose: to send two plain-text emails. One goes to Carl so he knows what you want, and one comes back to you confirming what you asked for, with your order reference.

Once those emails have been sent, the website itself keeps none of it. There is no order database and no customer record. The remaining copies are the one in Carl’s mailbox, the one in yours, and whatever logs our email provider keeps in the course of delivering the messages.

What you send us when you make an enquiry

If you send an enquiry, either by emailing Carl directly or through the contact form on this site, it works the same way. The message becomes an email. The website stores nothing.

What our systems record automatically

Two things happen automatically and you should know about them.

Our host processes your IP address in order to send you the pages you asked for. That is how the internet works and it cannot be avoided.

We also limit how many times forms can be submitted from one place, to stop spam and abuse. To do that, our own code converts your IP address into a one-way SHA-256 hash before it is used. Our code does not store your raw IP address.

Our own operational logs record only an order reference, the number of items, the order total, and whether you chose pickup or shipping. They deliberately leave out your name, your email address, and your phone number.

There is one deliberate exception. If your confirmation email fails to send, your email address is written to that log so Carl can send your confirmation again by hand. Without it, you would simply never receive your copy.

What we do not collect

To be explicit, this site does not have any of the following:

• analytics of any kind
• advertising or advertising networks
• tracking pixels or beacons
• social media embeds or share widgets
• marketing cookies
• customer accounts, logins, or passwords
• any profiling, scoring, or behavioural tracking of visitors
• card numbers, bank login details, or any payment credentials

Why we collect what we collect

We collect your details for one reason: so we can actually do the thing you asked us to do. That means fulfilling your order, quoting your shipping, arranging payment and pickup or delivery, and replying to your enquiry.

Under the Privacy Act 2020, we may only collect personal information for a lawful purpose connected with what we do, and only where we genuinely need it for that purpose. Every field on the order form is there because it is needed to complete an order: your name and email so we can reply and confirm, your phone number so we can reach you quickly if something about your order is unclear, and your address only if you have asked us to ship to it. Order notes are optional and entirely up to you.

We do not collect anything for marketing, and we do not add you to a mailing list.

Who your information is shared with

Two service providers are involved. They act as processors, which means they handle information on our behalf and to our instructions.

Cloudflare hosts this website and delivers it to you. Cloudflare processes your IP address to serve the site, to keep it online, and to help protect it from attack and abuse.

Cloudflare also provides Turnstile, the spam check you may see on our forms. Turnstile is a privacy-preserving alternative to a traditional CAPTCHA. It is designed not to track users across websites. Because the Turnstile check is loaded from Cloudflare, your browser connects to Cloudflare when a form page loads.

Resend is the transactional email provider that delivers the two order emails and any enquiry email. Resend sends the messages and keeps its own delivery logs as part of doing that.

That is the complete list. Nobody else receives your information.

We do not sell your personal information. We do not rent it, trade it, or share it with advertisers or data brokers. We do not use it for marketing.

We may disclose information if the law requires it, for example in response to a lawful request from a New Zealand authority. That has nothing to do with commercial use.

Where your information is held

Cloudflare and Resend are international companies operating global networks. This means your information may be processed or stored on servers outside New Zealand.

Carl’s own mailbox and email records are held in New Zealand, though the email provider behind them may also operate internationally.

Where your information goes overseas, we rely on providers that are contractually committed to protecting it to a comparable standard, as the Privacy Act 2020 requires when personal information is sent outside New Zealand.

How long it is kept

The website keeps nothing. There is no database to hold your details in.

Carl keeps order emails as business records. New Zealand tax law requires a business to retain its records for a set period, so order correspondence is kept for [TO BE SUPPLIED: retention period, likely seven years] and then deleted. General enquiries that do not lead to an order are not kept indefinitely and are deleted once the conversation is finished and there is no longer a reason to keep it.

Resend retains delivery logs for its own operational periods, which are set by Resend and not by us.

Payment

Payment is by bank transfer, arranged directly with Carl by email after he has confirmed your order and any shipping cost.

There is no payment gateway on this website. The site never sees, handles, or stores your card details or your bank login credentials, because it never asks for them. When you make the transfer, you are using your own bank, not this site.

If you ever receive an email claiming to be from us that asks for card details or bank passwords, it did not come from us. Contact Carl directly at the address above.

Cookies and browser storage

This website does not set tracking cookies. It does not set advertising cookies. It does not set analytics cookies. There is no cookie banner because there is nothing to consent to.

What the site does use is local storage in your browser, which is a different mechanism and stays on your device. There are exactly two entries:

• cavy-cart-v1 holds your shopping cart so it survives if you close the tab and come back.
• cc-theme holds your light or dark theme preference.

Neither is used to identify you, and neither is transmitted for analytics.

Cloudflare may set strictly necessary cookies where its security systems need to verify that a visitor is a real browser rather than an automated attack. Those are security measures, not tracking, and they are not used for advertising.

Security

We would rather be honest about this than impressive.

The whole site is served over HTTPS, so the connection between your browser and the site is encrypted. We never take card details or bank credentials, so there are none to lose. There is no customer database, no stored order history, and no user accounts, which means there is no store of customer data on this site for anyone to break into. Form submissions are rate limited and protected by Turnstile to keep abuse down.

What we cannot promise is that email is perfectly secure. Email is not an encrypted channel end to end, and once your order email reaches a mailbox it is only as safe as that mailbox. Please do not send us anything highly sensitive by email, and never send bank passwords or card numbers to anyone, including us.

No system can be guaranteed completely secure. We take reasonable steps, which is what the Privacy Act requires, and we have deliberately designed the site to hold as little as possible.

Your rights under the Privacy Act 2020

Under the Privacy Act 2020 you have the right to ask for access to the personal information we hold about you, and the right to ask us to correct it if it is wrong.

To do either, email Carl at carl@cavyconcepts.co.nz. Tell us what you are asking for and give us enough detail to find it, such as your order reference or the email address you used. We may need to check that you are the person the information relates to before we release anything, so that we do not hand your details to somebody else.

We will respond as soon as we reasonably can, and in any case within 20 working days of receiving your request, which is the timeframe the Privacy Act sets.

You can also ask us to delete information we hold. If it forms part of a business record we are legally required to keep, we will explain that and tell you when it will be deleted.

If you are not happy with how we have handled your personal information or your request, please raise it with Carl first so he has a chance to put it right. If you are still not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or on 0800 803 909.

The Privacy Commissioner will normally expect you to have raised the issue with us first.

Children

This site is not directed at children. Our products are engineering components sold to adults, and we do not knowingly collect personal information from children. If you believe a child has given us their details, email Carl and we will remove them.

Changes to this policy

If we change how the site handles personal information, we will update this page and change the date below. Substantial changes will be described plainly rather than buried.

Because the site holds no customer database, there is no mailing list to notify, so please check this page if it matters to you.