Privacy
My Shop Supply is operated by Calco Industries LLC. This notice describes information used to build, purchase and fulfill your customized kit. Questions or requests: support@myshopsupply.com.
Building and saving your kit
Your browser can remember work categories and stocking preferences. Use “Start over” to replace those local preferences. No vehicle identifiers, email addresses, or names are requested in the builder.
A saved customized kit link can be opened by anyone who has the link. Links expire after 90 days; expiration does not itself delete the server record. The server stores quotes, supply selections, operator sessions and pseudonymous usage events. A random identifier in browser session storage groups a visit, expires after 30 minutes of inactivity and is not a customer identity. We record public page names, coarse device category, referral category, allowlisted campaign labels, work categories, quantities, displayed price and pricing/checkout outcomes. Private saved-kit and order pages are not measured. We do not record full URLs, private-link tokens, raw referrers, keystrokes, session videos or card details. A private server-side link associates checkout with authorization and captured-payment events without copying order references into event data. Usage events and those links are removed after 30 days during normal collection. Operational order records and backups have separate retention. We hash rate-limit identifiers derived from network addresses to protect the service. The storefront does not use advertising trackers or sell personal information.
Limited usage measurement
Short-lived visit events help us find pricing errors and confusing steps. No advertising, cross-site tracking or session recordings. Do Not Track and Global Privacy Control are respected.
Orders and payments
Stripe handles payment and address collection. We store payment references, order status, customer email and shipping details needed to fulfill and support your order, not card numbers. Suppliers ship to our assembly location; we do not automatically send your address to suppliers. A carrier receives the details needed to deliver your kit. Our support mailbox is hosted by Zoho. Authorized operator access uses an eight-hour essential session cookie.
Order and payment records are retained for fulfillment, support, returns, disputes, bookkeeping and applicable recordkeeping obligations. Saved-link expiry is not a promise of immediate deletion. You can ask us to review, correct or delete your information; we will verify your request and explain any records we must retain. We do not ask you to email card numbers or other payment credentials.
Access and recovery
Access to order details is restricted to authenticated operators and the private order-link holder. Keep saved kit and order links private. We host the application at OVH and keep encrypted recovery copies in Cloudflare storage. Backup copies are not instantly changed when a record is corrected or deleted; requests must also be considered during any restoration. No system can promise perfect security.
Last updated September 30, 2026.