Privacy policy

This policy explains what personal information CarbonFG collects, why we collect it, who we share it with, and what you can do about it. It applies to carbonfibergear.com and to orders, emails, and text messages we handle.

We are dpitMedia, LLC, a Virginia limited liability company doing business as CarbonFG and Carbon Fiber Gear, with its principal place of business in Maryland. In this policy, “we,” “us,” and “CarbonFG” mean that company.

---

1. The short version

• We collect what we need to sell you products, ship them, prevent fraud, and market responsibly.
• We do not sell your personal information for money.
• We do use advertising and analytics cookies, which some state laws treat as “sharing” or “targeted advertising.” You can turn that off in Your privacy choices.
• We honor Global Privacy Control (GPC) browser signals.
• Any US customer can request access to, correction of, or deletion of their information, regardless of what state you live in.

---

2. Information we collect

Information you give us

Payment cards. We do not store or have access to your full card number. Card data goes directly to Shopify Payments and our other payment providers, including but not limited to PayPal, Shop Pay, Apple Pay, Google Pay, and Amazon Pay, depending on what you choose. We receive only a confirmation, the card type, and the last four digits.

Information collected automatically

• IP address, browser type and version, operating system, device type, and screen size
• Pages viewed, products viewed, time on site, referring website, and search terms that brought you here
• Cart contents, including carts you abandon
• Cookie and device identifiers, including identifiers used for fraud scoring and advertising measurement
• Interaction recordings, meaning mouse movement, clicks, scrolling, and page navigation, captured by our site analytics tools. See Session analytics below.

Information from others

• Advertising and analytics platforms may tell us that an ad led to a visit or a purchase.
• Our fraud provider may return a risk score based on signals from its own network.
• Shipping carriers give us delivery status.

What we do not collect. We do not intentionally collect precise geolocation (GPS-level location), biometric data, government ID numbers, health information, or any of the categories that state privacy laws define as “sensitive personal data.” We do not knowingly collect personal information from children under 13.

---

3. Why we use it

• To take, process, ship, and support your order
• To send order confirmations, shipping notices, and other transactional messages
• To answer your questions and handle returns, warranty claims, and complaints
• To screen orders for fraud and chargeback risk
• To send marketing emails and texts, if you asked for them
• To measure and target advertising on Google, Meta, and similar platforms
• To understand how the site is used and to improve it
• To keep records we are required to keep, and to establish or defend legal claims

We do not use automated decision-making that produces legal or similarly significant effects about you. Our fraud scoring may flag an order for manual review, and a person makes the final call.

---

4. Who we share it with

We share personal information with service providers who need it to do a job for us. They are contractually limited to that job. We share it by category, and the providers we currently use in each category are listed below as examples.

This list reflects our providers as of the effective date above, and it is not exhaustive. We add, replace, and remove service providers as the business changes, and we may use others in the same categories without updating this page immediately. What does not change is the rule: we only share what a provider needs to do its job for us, and we do not authorize any of them to use your information for their own purposes.

Other disclosures

We may also disclose personal information to comply with a law, regulation, subpoena, warrant, or other lawful request; to enforce our terms; to protect the rights, property, or safety of CarbonFG, our customers, or others; and to a buyer or successor in the event of a merger, acquisition, or sale of assets, in which case we will post notice on this page before your information becomes subject to a different policy.

---

5. Do we sell your information?

No, we do not sell your personal information for money, and we never have.

However, several state privacy laws define “sale” and “sharing” broadly enough to include the use of advertising cookies and pixels, because data flows to advertising platforms in exchange for advertising services. Under those definitions, our use of Google and Meta advertising tags may be treated as “sharing for cross-context behavioral advertising” or “processing for targeted advertising.”

We would rather tell you that plainly than argue about definitions. If you do not want it, turn it off in Your privacy choices below.

We do not sell or share the personal information of anyone we know to be under 18, and we do not use it for targeted advertising.

---

6. Cookies, tracking, and your browser signals

We use cookies and similar technologies (pixels, tags, local storage, and web beacons) for four purposes:

1. Strictly necessary. Keeping you logged in, remembering your cart, processing checkout, and security. These cannot be turned off.
2. Fraud prevention. Device recognition used to score order risk.
3. Analytics. Understanding traffic, site performance, and how people actually use the site.
4. Advertising. Measuring ad performance and showing you our ads on other sites.

Session analytics

We use Microsoft Clarity and similar tools to understand how people use our site. These tools record how you interact with pages, including mouse movement, clicks, scrolling, and the path you take through the site, and they combine that with usage and device information. We use this to find broken layouts, confusing navigation, and checkout problems.

These recordings are about page interaction, not about reading what you type. We configure these tools to mask the contents of form fields, so information you enter at checkout, such as your address or payment details, is not captured in recordings. You can opt out of this along with other analytics in Your privacy choices. Microsoft describes its own handling of this data in the Microsoft Privacy Statement.

Third parties may track you across sites

Google and Meta set cookies and identifiers through our site that they may use to build a profile of your activity across other websites and over time. That is the point of remarketing, and you should know it is happening.

Global Privacy Control and Do Not Track

We honor the Global Privacy Control (GPC) signal. If your browser or extension sends a GPC signal, we treat it as a request to opt out of advertising cookies and targeted advertising for that browser, and we apply it automatically without you needing to do anything else. We do not respond to the older, unstandardized “Do Not Track” (DNT) header, because it has no agreed meaning. Use GPC instead, or use the controls below.

---

7. Your privacy choices

Turn off analytics and targeted advertising

Use the controls below to change what this browser allows. Your choice applies to this browser on this device.

You can also turn on Global Privacy Control in your browser, which we honor automatically. Browsers and extensions that support it are listed at globalprivacycontrol.org.

Opting out does not stop you from seeing ads. It stops them from being targeted using your activity on our site.

You can additionally block or delete cookies in your browser settings, opt out of Google Analytics with the Google opt-out add-on, and use the industry opt-out portals at optout.aboutads.info and optout.networkadvertising.org.

Access, correct, or delete your information

We extend the following rights to every customer and site visitor in the United States, regardless of which state you live in. Some states require this of us and some do not. We would rather run one process than twenty.

You may ask us to:

• Know what personal information we have about you and who we have shared it with
• Get a copy of it in a portable format
• Correct it if it is wrong
• Delete it, subject to the exceptions below
• Opt out of targeted advertising and of any “sharing” or “sale” as those terms are defined by state law
• Opt out of marketing emails and texts

We will never discriminate against you for exercising these rights. You will get the same products, prices, and service either way.

How to make a request: send us a privacy request through our contact form. Tell us what you want us to do and include the email address you use with us. Any clear request works, whatever words you use and whatever channel you send it through.

What happens next: we will acknowledge your request within 10 business days and respond substantively within 45 calendar days. If a request is complex we may extend once by another 45 days, and we will tell you why before we do. There is no charge unless a request is excessive or repetitive, in which case we will tell you the cost before doing anything.

Verification: to protect your information, we need to confirm you are who you say you are. Usually that means matching the email address on file with an order. If we cannot match it, we may ask for an order number or the shipping ZIP code from a recent order. We will not ask for more than we need, and we will not ask for a government ID.

Authorized agents: you may use an agent to make a request. We will ask for written proof of their authority and may still ask to verify your identity directly.

When we may say no: we may decline to delete information we need to complete a transaction, provide a warranty, detect or prevent fraud, comply with a legal obligation (including tax and accounting records), or establish or defend a legal claim. If we decline, we will tell you which exception applies and delete everything else.

Appeals: if we deny your request and you think we got it wrong, reply to our decision and say you are appealing. A different person will review it and respond within 45 days with a written explanation. If we deny the appeal, we will tell you how to contact your state Attorney General.

Unsubscribe from marketing

Email: click “unsubscribe” at the bottom of any marketing email, or ask us through the contact form.

Text messages: reply STOP to any message. See section 9 for the full list of words that work.

Unsubscribing from marketing does not stop order confirmations, shipping notices, or replies to a support request you started.

---

8. Marketing emails

Every marketing email we send includes a working unsubscribe link and our physical mailing address. Unsubscribe links stay live for at least 30 days after we send the message, and we process opt-outs within 10 business days. Unsubscribing from marketing does not stop transactional messages about an order you actually placed.

---

9. Text messages

We only text you if you gave us your number and opted in. Specifically:

• Consent is never a condition of purchase.
• Message frequency varies. Message and data rates may apply.
• Reply HELP for help. Reply STOP to cancel.
• We honor STOP, END, QUIT, CANCEL, UNSUBSCRIBE, REVOKE, and OPT OUT, and we honor any other reasonable way you tell us to stop, including replying in plain words or emailing us. You do not have to use a magic keyword.
• We process opt-outs within 10 business days, and in practice almost always immediately.
• After you opt out we may send one confirmation message and nothing further.
• We do not share or sell mobile numbers or SMS consent data with anyone for their own marketing. Numbers go only to the provider that delivers the messages for us.

If you use our site’s cart features, we may use cart data to decide when to send an abandoned cart reminder to a number you already opted in with.

---

10. How long we keep it

We keep personal information for as long as we have a business or legal reason to. The table below is a general guide to how long that usually is, not a fixed deletion schedule.

We may keep information longer where we are required to by law, where it relates to an unresolved dispute, or where it is needed to establish or defend a legal claim. When we no longer need information, we delete it or irreversibly anonymize it. If you want your information deleted sooner, see Your privacy choices.

---

11. Security

We use HTTPS across the site, rely on PCI-compliant payment processors so that we never hold full card numbers, limit employee access to customer data to those who need it, require multi-factor authentication on our administrative systems, and contractually require our vendors to maintain reasonable security.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information, we will notify you and the relevant authorities as required by law, including the Maryland Personal Information Protection Act.

---

12. Children

This site is meant for adults. We do not knowingly collect personal information from anyone under 13, and we do not direct marketing to children. We also do not knowingly use the personal information of anyone under 18 for targeted advertising or disclose it in any way that would count as a sale. If you believe a child has given us personal information, tell us through our contact form and we will delete it.

---

13. Where your information goes

We are based in the United States, and our service providers primarily process data in the United States and Canada. If you order from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

We do not ship to, market to, or accept orders from the European Union, the European Economic Area, the United Kingdom, or Switzerland. Our site is not directed to residents of those regions, we do not price in euros or pounds, and we do not advertise there.

---

14. Changes to this policy

We may update this policy. When we make a material change, we will update the effective date at the top, post the change on this page, and, if the change significantly affects how we use information we already hold about you, notify you by email before it takes effect. We keep prior versions available on request.

---

15. Contact us

dpitMedia, LLC d/b/a CarbonFG and Carbon Fiber Gear
Millersville, Maryland, United States

Privacy questions and requests: send us a privacy request through our contact form.

Our mailing address appears in the footer of our marketing emails, as required by the CAN-SPAM Act.

If you are not satisfied with how we handled your request, you may contact the Maryland Attorney General’s Consumer Protection Division or the Attorney General of your own state.