Privacy policy
In force from October 21, 2026
Data controller: Colverro LLC, 1900 Tamiami Trail North, Naples, FL 34102, United States.
The previous version of this page was well written and almost entirely unanswerable. Retention "depends on different factors." Your rights exist "depending on where you live." Safeguards are used "where required by applicable law." Every paragraph was formally complete and operationally empty.
So this version is a list of questions, and every answer is a number, a name, or a date. Where we cannot give one, we say why rather than reaching for "may."
Do you have my card number?
No.
The old page listed "credit card, debit card, and financial account numbers" among the information it collects. We do not collect them. Card details are entered into our payment processor's own hosted fields and never reach our systems.
What we receive is three things: the last four digits, the card type, and whether the payment succeeded.
A store that cannot see your card number cannot leak it, which is why this is the first question on the page.
What do you have, exactly?
From you: name, billing address, shipping address, email address, phone number, order contents, order history, and the text of anything you send us.
From your device: IP address, browser and version, device type, the pages and products you viewed, how you arrived at the site, and timestamps.
What we do not collect at all: health information, religion, precise geolocation, biometrics, or anything else in the sensitive categories under California law. We sell lamps and heaters. We have no interest in why you want one, and if you mention something personal in an email because it bears on your question, we answer the question and do not build a record of it.
Who else sees it?
Five, named.
| Who | What they get | Why |
|---|---|---|
| Shopify | Order and account data, site usage | The platform the store runs on; a service provider acting on our instructions under contract, which may not use it for its own purposes |
| Our payment processor | What is needed to authorize the transaction | Taking payment, and its own regulatory obligations |
| USPS | Recipient name, address, ZIP, and a contact for delivery notices | Delivery. Not payment details, not order history, not correspondence |
| Google Analytics | Site usage | Measuring how pages perform — with your consent |
| Our accountant | Financial records | Bookkeeping and tax, under contract |
If we add a recipient that materially affects you, we will name it here and tell you directly rather than relying on you to re-read the page.
Do you sell my information, or share it for advertising?
We do not sell your personal information. Under Cal. Civ. Code § 1798.140 that covers disclosure for monetary or other valuable consideration, not just for money, and we do neither.
On "sharing," the old page disclosed something it then gave you no way to control, so this needs saying plainly.
It said Shopify is used to "support personalized advertising with third-party services based on your online activity with different merchants and websites." Advertising based on your activity across other merchants' sites is cross-context behavioral advertising, which is exactly what "share" means in § 1798.140(ah) — and a policy disclosing it while offering no opt-out is the gap, not the disclosure.
So:
No advertising or profiling identifier is set unless you opt in. If you decline, no audience list is built from your visit and nothing is passed to an advertising partner for its own purposes.
We honor Global Privacy Control. If your browser or extension sends GPC, you are opted out of any sale or sharing — no banner interaction required, and whatever state you live in. Under the CCPA regulations an opt-out preference signal is a valid request, and we treat it as one for everybody.
You can also opt out by emailing us, and we will confirm it in writing.
How long do you keep it?
The old answer was "depends on different factors." Here are the factors, with numbers.
| What | How long | Why |
|---|---|---|
| Financial and tax records: name, address, amounts | 7 years | Federal and state tax record-keeping |
| Order records for claims purposes | 5 years | Fla. Stat. § 95.11(2)(b) — the limitation period for an action on a written contract in Florida |
| Correspondence attached to an order | with the order | Same |
| Correspondence with no order attached | 2 years | Continuity of service |
| Marketing consent records | until you opt out — then we keep the record of the opt-out | So we do not contact you again by mistake |
| Analytics and advertising data | as stated in our cookie settings, and no longer | Consent |
| Account data | until you close the account, then 30 days | Reversing an accidental closure |
Can I make you delete it?
Yes, and there is exactly one boundary.
We delete on request: marketing data, browsing and analytics data, correspondence not attached to an order, and your account.
We cannot delete a tax record inside its 7 years. Keeping it is a legal obligation, not a preference.
When we decline a deletion on that ground, we tell you which record it is and the date it goes. A refusal without a date is not an answer.
What rights do I have, and do I have to live somewhere particular?
No. We apply one standard to every customer, whichever state you are in.
| Right | What it means |
|---|---|
| Know and access | A copy of what we hold, and why |
| Correct | Fix anything inaccurate |
| Delete | As above |
| Portability | Receive it in a readable, portable format |
| Opt out of sale or sharing | As above, including by GPC |
| Limit use of sensitive information | We collect none, so there is nothing to limit — stated for completeness |
| No retaliation | Same prices, same products, same service |
| Appeal | If we refuse a request, ask us to reconsider and get a written answer |
These are modeled on Cal. Civ. Code §§ 1798.100–1798.125, with the appeal right taken from the Virginia and Colorado statutes.
One note of accuracy, since this page is about specifics: we are not telling you the CCPA applies to us. It has revenue and volume thresholds, and a store this size may fall under them. We honor these rights because we have decided to — a weaker guarantee than a statute, which is exactly why we are saying so rather than implying coverage.
How: email support@colverro.com, subject line "privacy request." You do not need to cite a statute or use any particular wording.
We answer within 45 days, with one extension of up to 45 more where a request is genuinely complex — and we tell you inside the first 45 days if we are extending, with the reason. It is free. An authorized agent may act for you with proof of authorization.
How old do I have to be?
13 for us to collect anything. 18 to place an order.
The old page said it does not knowingly collect information about children "under the age of majority in your jurisdiction." That conflates two different thresholds and commits to neither. The age of majority is 18 and governs contracts; the data-collection threshold is 13, under the Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.; 16 C.F.R. Part 312).
So, specifically: we do not knowingly collect personal information from anyone under 13, and ordering requires an adult.
And one stricter rule: under Cal. Civ. Code § 1798.120(c), selling or sharing the information of a consumer under 16 requires opt-in consent rather than opt-out. We do not sell or share, so it does not arise — but if it ever did, we would apply the opt-in standard to every under-16 customer, not only Californian ones.
If you believe a child's information has reached us, tell us and we will delete it.
When would you tell me about a breach?
Within 30 days, to everyone.
The old page said only that no security measures are perfect. True, and not an answer.
Under the Florida Information Protection Act (Fla. Stat. § 501.171) we must notify affected individuals within 30 days of determining that a breach of personal information occurred, and notify the Florida Attorney General where 500 or more Florida residents are affected.
Other states set different deadlines. We use 30 days for every customer, consistent with the single-standard approach above.
What the notice will contain: what happened, which information was involved, what we have done, and what you should do. We will not call it a "technical issue." If your information was exposed, that is what the message will say.
What we do to prevent one: access controls, encryption in transit, and vendors contractually held to equivalent standards. No system is perfect, and a policy claiming otherwise would be the first thing in it you should not believe — but "not perfect" is a reason to tell you our deadline, not a substitute for having one.
Will you email or text me?
Only if you ask us to.
Texts: marketing texts require your prior express written consent under the Telephone Consumer Protection Act (47 U.S.C. § 227). That consent is separate from placing an order and is never a condition of buying anything. Reply STOP to opt out, or HELP for assistance; we act on a STOP the same day. Standard message and data rates may apply, depending on your carrier plan.
Email: under CAN-SPAM (15 U.S.C. § 7704), every commercial email we send carries a working unsubscribe, identifies us, and includes our physical postal address — the one at the top of this page — and we must honor an opt-out within 10 business days. We act on them the same day.
Opting out of marketing does not stop order emails — shipping confirmations, tracking, and refund notices still come, because those are about a transaction you entered into.
What if a court or the police asks for my information?
We disclose where we are legally required to — a subpoena, court order, search warrant, or other lawful process.
We require it in writing and we check it. An informal request by phone or email, with no legal process behind it, gets a refusal and a note of who asked.
We tell you, unless telling you would itself be unlawful or we are specifically prohibited.
We do not volunteer information, and there is no standing arrangement with anyone.
Where does my information physically go?
Our providers' infrastructure is international, so your information may be processed outside the state or country you live in.
Where a transfer out of a jurisdiction requires a safeguard, we rely on the European Commission's standard contractual clauses or an adequacy decision, depending on the destination. Ask about a specific flow and we will tell you which applies rather than repeating that we use safeguards "where required."
Who do I complain to?
Us first — support@colverro.com, reply within 2 business days. If you are not satisfied, say so, and a different person reviews it.
Then, or instead:
- The Federal Trade Commission — ReportFraud.ftc.gov
- The Florida Attorney General's Consumer Protection Division
- Florida Department of Agriculture and Consumer Services — 1-800-HELP-FLA (1-800-435-7352)
- The California Privacy Protection Agency, if you are a California resident
- Your own state's attorney general, several of whom now enforce a consumer privacy statute
You never have to come to us first.
What happens when this policy changes?
The date at the top is the version in force. If we change something that materially affects you — a new recipient, a new purpose, a longer retention period — we tell you directly, rather than posting it and relying on you to notice. Previous versions are available on request.
WHERE THINGS ARE WRITTEN DOWN
Terms and Conditions — the contract, where our responsibility ends and yours begins, installation and safety, and what we will not claim. Shipping Policy — times, tracking, and who picks the remedy when something goes wrong in transit. Returns Policy — the two halves of a return, and how refunds run.
CONTACT
| Store name | Colverro |
| Company name | Colverro LLC |
| Address | 1900 Tamiami Trail North, Naples, FL 34102, United States |
| support@colverro.com | |
| Phone | +1 239-262-7100 |
| Customer service | Mon–Fri: 9:00 AM–5:00 PM |
| Sat, Sun & public holidays | Closed |
| Response time | Within 2 business days |