Privacy Policy

Shopping cart

We keep the public listing references in your cart in this browser so your selections survive navigation and refreshes. Cart storage does not contain your contact details, shipping address, prices, or payment credentials. If browser storage is unavailable, the same listing references can travel in the site's cart links. You can remove selections or clear your cart at any time. A cart does not reserve inventory.

Contact and inquiry information

Our inquiry forms collect your name, email address, optional phone number, topic, subject, message, and optional custom-work reference images. We use this information to review your request, answer you, associate the inquiry with a piece or project when appropriate, and preserve the resulting business correspondence.

Orders and fulfillment

When Production payments are enabled, we may keep order, shipping, fulfillment, provider transaction identifiers, return, and service information needed to complete and reconcile a purchase. We do not collect or store full payment-card numbers or card security codes. Payment entry takes place in provider-hosted Square or PayPal flows, and those providers process payment information under their own privacy policies.

Google API data and Gmail permission

Rough Cut Lapidary uses the Gmail API to send owner notifications about new website inquiries and plain-text replies composed by the owner. The application requests only Google's gmail.send permission. It does not use the Gmail API to read, scan, analyze, or download the owner's mailbox or unrelated messages.

The reply recipient is derived by the server from the email address in the original customer inquiry. Google authorization data is used only for these outbound messages. Owner notifications go to the owner-controlled mailbox, and private uploaded files are not attached. OAuth credentials and tokens are kept in protected server-side secret storage, are not exposed publicly, and are not sold or shared for advertising. Google API data is not used for advertising, marketing lists, or user profiling. Learn more on the Rough Cut Lapidary Owner Replies information page.

Reference images and private uploads

Custom-project reference images are checked for allowed type, size, and count, then stored privately under randomized names. They are not published automatically. The system records a retention review date for each inquiry attachment. We retain inquiry, reply, order, and security records as reasonably needed for the related business purpose, dispute or transaction history, legal obligations, and backups; we do not promise automatic deletion on a shorter fixed schedule.

Cloudflare Turnstile and security

We use Cloudflare Turnstile on appropriate public forms to distinguish ordinary use from automated abuse. We also use limited rate controls and reasonable technical safeguards. Network addresses used for application abuse controls are transformed with a private keyed one-way function rather than stored directly in our inquiry records.

Privacy-friendly analytics

The website records first-party daily aggregate counts for useful events such as product or gallery views, inquiry starts, checkout starts, and show-page interest. These records use the event type and a public page or record identifier where relevant. We do not build visitor profiles, fingerprint browsers, use advertising trackers, or use cross-site identifiers.

Service providers and disclosure

Cloudflare provides website infrastructure and abuse protection. Google sends inquiry notifications to the owner and owner-composed replies. Square or PayPal will process provider-hosted payments when Production payments are enabled. We provide each service only the information needed for its role. We do not sell customer information or share it for third-party advertising.

Questions and requests

Use our contact form for privacy questions or a reasonable request concerning information you submitted. We may need enough information to locate the record and verify that the request concerns you.