Privacy

Updated September 26, 2026. This policy explains what personal information Catalyst Surplus collects through catalystsurplus.com, our checkout and our emails, how we use it, who sees it, and your choices, including rights under California law.

What we collect

What you give us: when you order, your name, email, phone number, shipping and billing address, the items you buy and your confirmation that you're 18 or older and allowed to own body armor. When you contact us, the details and message you send. When you ask for a restock alert or sign up for new-stock emails, your email address and the item you asked about. If you sell to us, the details you send about your gear.

Payments are handled by Shopify and its payment partners at checkout. We never see or store your full card number.

What we collect automatically: basic device and log data (IP address, browser, pages viewed, times and errors) through our hosting provider, cookie-free visit statistics from our host (Vercel Web Analytics, which counts visits without identifying you), and a bot check on our forms. Your browser also stores your cart, your answer to our 18+ question and your cookie choice on your device.

Cookies and ads

We use the Meta Pixel to measure and improve our ads on Facebook and Instagram. It sets cookies and can connect your visit with your activity on other sites, so it only loads if you click Allow on our cookie notice. If you click No thanks, or your browser sends a Global Privacy Control signal, it doesn't load. To change your choice, use Cookie choices at the bottom of any page. Meta explains how it uses this data at facebook.com/privacy/policy. Microsoft Advertising (Bing) and Google Ads work the same way: their ad cookies are only set after you click Allow. Microsoft's tag also runs Microsoft Clarity, which records how pages are used (clicks, scrolling, page views) so we can improve the site; it also only loads after you click Allow. If you allowed them and then place an order, we also tell Meta about that purchase from our own server (order value, items, and your email, phone and address in scrambled, hashed form) so our ad results stay accurate.

We use Google Analytics to understand how people use the site. Until you click Allow it runs in a limited mode that sets no cookies and sends only anonymous signals; after you allow cookies it measures visits normally. A Global Privacy Control signal turns it off. When an order is placed we tell Google Analytics the order total and items, without your name, email or address.

If you click Allow, we also send the pages and products you view to Shopify's store analytics (with Shopify cookies), so we can see how shoppers move from browsing to checkout. The same choice turns it off.

How we use it

To process and ship your orders, handle returns and refunds, and send order and shipping updates; to answer your messages and restock requests; to send new-stock emails if you signed up (each has an unsubscribe link); to check eligibility for age- and state-restricted items; to prevent fraud, spam and abuse; to meet legal, tax and accounting obligations; and to run and improve the site.

We never sell or rent your personal information or our email list.

Who sees it

Service providers that process data for us and only for that: Meta (ad measurement, only with your consent), Crisp (live chat, if you use it), Shopify (store, checkout, payments, customer and order records, and store analytics with your consent), Vercel (website hosting and visit statistics), Google (site analytics and ads, ad cookies only with your consent), Microsoft Advertising and Clarity (ads and site usage, only with your consent), Resend (sending site emails), Cloudflare (the bot check on our forms), and the shipping carriers that deliver your order (who get your name and address).

We also share information when the law requires it, to respond to lawful requests from authorities, to protect our customers and the public from fraud or harm, to enforce our policies, with a buyer or successor as part of a merger, acquisition or sale of the business, and with your consent.

Your California privacy rights

This section applies to California residents and adds to the rest of this policy. In the last 12 months we have collected these categories of personal information, from the sources and for the purposes above: identifiers (name, email, phone, IP address); customer records (contact, shipping and billing details); commercial information (orders and requests); internet activity (pages viewed on our site); and approximate location (from your IP address or address). We disclose them for business purposes to the providers listed above. If you click Allow on our cookie notice, the Meta Pixel may collect identifiers and browsing activity on our pages, which California law may treat as "sharing" for cross-context advertising. You can opt out any time with Cookie choices, and we treat a Global Privacy Control signal as an opt-out. We do not knowingly sell or share the information of anyone under 16.

You have the right to know what personal information we have about you and get a copy, to have it corrected or deleted, and not to be treated differently for asking. To make a request, email us at contact@catalystsurplus.com and say it's a privacy request. We'll confirm who you are by matching information we already have (such as your order email), confirm receipt within 10 business days and respond within 45 days. Some records may be kept where the law allows, for example to complete an order, prevent fraud or meet tax obligations. Residents of other states with similar laws can make the same requests.

Shine the Light: we don't share personal information with third parties for their own direct marketing.

Security

We use reasonable safeguards, such as encryption in transit and limited access to customer data. No system is perfectly secure, so we can't guarantee it. If a breach affects your personal information, we'll notify you as the law requires.

Children

Our site is for adults. Armor may only be purchased by people 18 or older, and we don't knowingly collect information from children under 13. If we learn we have, we delete it.

Keeping it

We keep order records as long as tax and accounting laws require. Contact messages and restock requests are kept as long as they're useful to answer you. Newsletter emails are kept until you unsubscribe.

Changes and contact

We may update this policy; the date at the top shows the latest version. Questions: contact@catalystsurplus.com.