Privacy Policy

1Information We Collect

We collect information you provide directly to us:

• Contact information (name, company, phone number)
• Shipping and billing addresses
• Order history and product preferences
• Communications you send to us

2How We Use Your Information

• Process and fulfill your wholesale orders
• Communicate about orders, products, and services
• Send promotional materials (with your consent)
• Improve our website and customer experience
• Comply with legal obligations

3Information Sharing

We do not sell your personal information for money. We may share information with:

• Shipping carriers to deliver your orders
• Payment processors for secure transactions (Stripe, see Section 6)
• Analytics and advertising-measurement providers (Google and Microsoft), only if you accept cookies (see Sections 6 and 7)
• Legal authorities when required by law

4Data Security

We implement industry-standard security measures to protect your information. All transactions are encrypted using SSL technology. We regularly review our security practices to ensure your data remains protected.

5Your Rights

You have the right to:

• Access your personal information
• Request correction of inaccurate data
• Request deletion of your data
• Opt-out of marketing communications

6Cookies and Similar Technologies

We use cookies and browser storage for analytics, to measure our advertising, to attribute enquiries and orders to the page or campaign that brought you here, and to make the site work. The analytics and advertising-measurement tools below are optional: they are loaded only after you click "Accept" in the cookie banner. If you click "Decline" or make no choice, they are not loaded at all.

Optional, loaded only after you accept:

• Google Analytics 4 (Google LLC): measures page views and site events such as product views, add-to-cart, checkout, purchases (order value and items) and form submissions, so we can see how the site is used. Cookies: _ga, _ga_*. Google's advertising features are turned off (ad storage, ad user data and ad personalization are set to "denied").
• Microsoft Clarity (Microsoft Corporation): session replay and heatmaps. It records how pages are used (clicks, scrolling, mouse movement and page content) so we can find usability problems. Cookies: _clck, _clsk. On our site Clarity is loaded by the Microsoft Advertising tag, so it is also off whenever that tag is off.
• Microsoft Advertising Universal Event Tracking (UET) (Microsoft Corporation): measures which Microsoft Advertising (Bing) ads lead to visits and conversions on our site. Cookies: _uetsid, _uetvid (and matching browser storage entries); Microsoft may also set its own cookies, such as MUID, on its domains. This may count as "sharing" for cross-context behavioral advertising under California law, which is why it is never loaded when you decline or when your browser sends a Global Privacy Control signal (Section 7).

Always on (not optional):

• Lead and campaign attribution (first-party, our own data): the cookies lead_sid (a random visit ID), lead_lp (the first page you landed on) and lead_utm (campaign parameters such as utm_source, ad click IDs gclid/fbclid, and the referring site), each kept for 30 days; session storage chestnut_utm_data (first-touch campaign, landing page and referring site) plus short session-only counters (lead_arrival_ts, lead_pv, lead_scroll, lead_returning, lead_cta); and local storage lead_first_seen (marks a returning visitor). They are read only by us. When you submit a contact, quote, sample or document request, or send a chat message, these values are sent with your message together with your device type, browser, screen size, time zone and language, so we can see where the enquiry came from and prioritize it. When you place an order, the visit ID and first-touch campaign data are attached to the order at Stripe so we can attribute the sale. They are not shared with Google or Microsoft.
• Stripe (Stripe, Inc.): processes payments on Stripe-hosted checkout pages, where Stripe may set its own cookies for payment security and fraud prevention. We do not receive or store your full card number.
• Cloudflare Web Analytics (Cloudflare, Inc.): cookieless page-load and performance measurement added by our hosting network, which also protects the site against attacks. It sets no cookies or browser storage.
• Site functions: local storage remembers your cookie choice (cookie-consent), keeps the chat assistant's conversation (chestnut_visitor_id, chestnut_chat_state_v2), records that you accepted our terms at checkout (chestnut_terms_accepted) and prevents a purchase from being counted twice.

You can change your choice at any time with the "Your Privacy Choices / Cookie settings" link at the bottom of every page. If you withdraw an earlier "Accept", the optional tools stop loading and the cookies they set on our domain are deleted (cookies Google or Microsoft set on their own domains can only be removed in your browser). You can also block or delete cookies in your browser settings.

7Your Privacy Choices and Global Privacy Control

Use Your Privacy Choices (also linked at the bottom of every page) to accept or decline the optional tools in Section 6. Declining is your opt-out of the "sale" or "sharing" of personal information through those tools.

We honor the Global Privacy Control (GPC) signal. If your browser sends it, we treat it as a request to opt out of sale and sharing: Microsoft Advertising UET and Microsoft Clarity are never loaded, even if you click "Accept". Google Analytics, which is used for analytics only with Google's advertising features turned off, still loads if you accept. The cookie banner tells you when the signal has been detected.

8California Residents

If you live in California, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to:

• Know what personal information we have collected about you, where it came from, why we use it and whom we disclose it to
• Request deletion of your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of your personal information, via "Your Privacy Choices" or a Global Privacy Control signal (Section 7)
• Not be discriminated against for exercising these rights

We do not sell personal information for money. The only disclosure that may count as "selling" or "sharing" under California law is the Microsoft Advertising measurement described in Section 6, which runs only if you accept cookies and never when your browser sends GPC. The categories of personal information we collect are described in Sections 1 and 6.

To make a request to know, delete or correct, email [email protected] or use our contact form. We will verify your request using the contact details we hold for you. An authorized agent may submit a request on your behalf with your written permission.