Privacy

Updated September 26, 2026. This policy explains what personal information Catalyst Surplus collects through catalystsurplus.com, our checkout and our emails, how we use it, who sees it, and your choices, including rights under California law.

What we collect

What you give us: when you order, your name, email, phone number, shipping and billing address, the items you buy and your confirmation that you're 18 or older and allowed to own body armor. When you contact us, the details and message you send. When you ask for a restock alert or sign up for new-stock emails, your email address and the item you asked about. If you sell to us, the details you send about your gear.

Payments are handled by Shopify and its payment partners at checkout. We never see or store your full card number.

What we collect automatically: basic device and log data (IP address, browser, pages viewed, times and errors) through our hosting provider, and a bot check on our forms. Your browser also stores your cart and your answer to our 18+ question on your device; we don't use advertising or tracking cookies.

How we use it

To process and ship your orders, handle returns and refunds, and send order and shipping updates; to answer your messages and restock requests; to send new-stock emails if you signed up (each has an unsubscribe link); to check eligibility for age- and state-restricted items; to prevent fraud, spam and abuse; to meet legal, tax and accounting obligations; and to run and improve the site.

We never sell or rent your personal information or our email list.

Who sees it

Service providers that process data for us and only for that: Shopify (store, checkout, payments, customer and order records), Vercel (website hosting), Resend (sending site emails), Cloudflare (the bot check on our forms), and the shipping carriers that deliver your order (who get your name and address).

We also share information when the law requires it, to respond to lawful requests from authorities, to protect our customers and the public from fraud or harm, to enforce our policies, with a buyer or successor as part of a merger, acquisition or sale of the business, and with your consent.

Your California privacy rights

This section applies to California residents and adds to the rest of this policy. In the last 12 months we have collected these categories of personal information, from the sources and for the purposes above: identifiers (name, email, phone, IP address); customer records (contact, shipping and billing details); commercial information (orders and requests); internet activity (pages viewed on our site); and approximate location (from your IP address or address). We disclose them for business purposes to the providers listed above. We do not sell or share personal information for cross-context advertising, and we do not knowingly sell or share the information of anyone under 16.

You have the right to know what personal information we have about you and get a copy, to have it corrected or deleted, and not to be treated differently for asking. To make a request, email us at contact@catalystsurplus.com and say it's a privacy request. We'll confirm who you are by matching information we already have (such as your order email), confirm receipt within 10 business days and respond within 45 days. Some records may be kept where the law allows, for example to complete an order, prevent fraud or meet tax obligations. Residents of other states with similar laws can make the same requests.

Shine the Light: we don't share personal information with third parties for their own direct marketing.

Security

We use reasonable safeguards, such as encryption in transit and limited access to customer data. No system is perfectly secure, so we can't guarantee it. If a breach affects your personal information, we'll notify you as the law requires.

Children

Our site is for adults. Armor may only be purchased by people 18 or older, and we don't knowingly collect information from children under 13. If we learn we have, we delete it.

Keeping it

We keep order records as long as tax and accounting laws require. Contact messages and restock requests are kept as long as they're useful to answer you. Newsletter emails are kept until you unsubscribe.

Changes and contact

We may update this policy; the date at the top shows the latest version. Questions: contact@catalystsurplus.com.