Privacy policy

1. Who we are

Fourth Dimension CNC is a United States manufacturer of custom height clearance bars operating the Custom Clearance Bars storefront. Our registered business address is 380 Oak Grove Parkway, Suite 200, Vadnais Heights, MN 55127. For any privacy-related inquiry, contact us at support@customclearancebars.com. We are the "controller" of your personal data for GDPR purposes and a "business" as defined by the CCPA.

2. Information we collect

We collect the following categories of personal information:

• Contact information you provide when creating an account or placing an order: name, email address, billing and shipping addresses, and phone number (if you choose to provide one).
• Order and configuration data: the specifications of the clearance bar(s) you design (length, diameter, color, reflective options, custom text, etc.), purchase history, saved designs and quotes, and quote requests.
• Payment information: we do not receive or store your full payment card number. Card data is collected directly by our payment processor, Stripe, Inc. We receive only a tokenized reference to the charge and limited metadata (brand, last four digits, billing ZIP) that Stripe returns to us.
• Account credentials: an email address and a password hash stored by our authentication provider, Supabase, Inc. We never see your password in plain text.
• Device and log data: IP address, browser type and version, operating system, referring URL, pages viewed, and approximate geographic location inferred from the IP address. This data is collected automatically when you visit the site and is used for security, fraud prevention, and error diagnostics.
• Cookies and similar technologies: see Section 6 below.
• Communications: the content of emails and support tickets you send to us.

We do not knowingly collect "sensitive personal information" as defined by the CCPA (such as government identifiers, precise geolocation, or biometric data) and we do not request it to place an order.

3. How we use your information

We use personal information for the following purposes:

• To fulfill the contract you entered into when you placed an order — manufacturing your bar, arranging freight, processing payment, and issuing receipts and shipment notifications.
• To operate and secure your account, authenticate you, and prevent fraud.
• To respond to support inquiries and customer-service requests.
• To send transactional emails (order confirmations, shipping updates, freight quotes, invoice receipts). These are not marketing messages and you cannot opt out of them while you have an active order.
• To comply with our legal obligations, including tax, accounting, and sanctions-screening requirements.
• To improve the site — diagnosing errors, measuring page performance, and understanding which features customers use. Where this relies on non-essential analytics cookies, we do so only with your consent.

Our legal bases under the GDPR are: performance of a contract (order fulfillment, account management), legitimate interests (security, fraud prevention, service improvement), consent (non-essential analytics cookies), and compliance with legal obligations (tax records, regulatory requests).

4. Third parties we share data with

We share personal data only with service providers that help us operate the Services. Each is bound by a written agreement limiting their use of the data to our instructions.

• Stripe, Inc. (United States) — processes all payment card transactions. Stripe receives your card details directly through its embedded checkout and acts as an independent controller for anti-fraud and regulatory purposes. See stripe.com/privacy.
• Supabase, Inc. (United States) — hosts our PostgreSQL database and authentication service. Account credentials, order records, and configuration data are stored in Supabase under row-level security.
• Resend (United States) — delivers transactional email (order confirmations, shipping notifications, freight-quote invitations, password resets). Resend receives your email address and the message content.
• Sentry (United States) — collects anonymized error reports and performance traces when the application encounters a bug. IP addresses may be included for debugging and are scrubbed on a rolling 30-day basis.
• Google Analytics 4 (Google LLC, United States) — aggregated site-usage analytics. This is loaded only after you grant consent through our cookie banner. We have configured IP-anonymization and disabled advertising features.
• Optional advertising measurement — if you separately opt in, we can share Google ad click identifiers and the status/value of a qualified quote or purchase with Google. We do not include your name, email address, custom wording or delivery address in these conversion exports, and we do not request personalized advertising. This choice is separate from analytics consent and can be withdrawn through Cookie preferences.
• Our production system — receives each paid order (your name, contact and delivery details, and the design you approved) so our shop can build and ship it, and asks you through us if a design needs a change. If you allowed analytics, it also receives the general way you reached us for that visit (for example “search”, “email” or “Google ad”, and whether an ad click was recorded) — never the ad click identifier itself, and nothing when you opted out or sent a Global Privacy Control signal.
• Freight carriers (e.g. FedEx Freight, XPO, Old Dominion, Estes) receive the name, address, and phone number associated with your shipment in order to deliver it.

We do not sell your personal information and we do not share it with advertisers, data brokers, or social-media platforms for cross-context behavioral advertising. See Section 8 for your CCPA opt-out right.

5. Data retention

Order records (including invoices, shipping addresses, and amounts paid) are retained for seven (7) years after the order is placed, in order to comply with United States federal and state tax-record-keeping rules and to support accounting audits. Non-order personal data — for example, saved designs and quotes, and account profile details unrelated to a completed purchase — is retained until you delete your account or ask us to delete it. Error logs held by Sentry are retained according to our plan's retention policy and are purged automatically thereafter. Our first-party browsing events and separately consented ad-click records are removed after 90 days. Google Analytics retention is managed separately in our analytics account. Saved projects include specification revisions, scoped sharing records and review responses; these are included with non-order account data when you request deletion. Transaction references on retained orders remain part of the accounting record.

6. Cookies and tracking

We use essential storage and optional measurement:

• Essential cookies (set automatically without consent): session tokens used to keep you signed in, the cookie-consent preference itself, and the cart identifier stored in localStorage. Without these the site cannot function.
• Analytics cookies (opt-in): Google Analytics 4 cookies (_ga, _ga_*), plus a random session identifier for our first-party store funnel. These are used only after you allow analytics on the cookie banner and can be revoked at any time through the "Cookie preferences" link in the footer.

We do not use advertising cookies, cross-site tracking pixels, or retargeting tags. We honor Global Privacy Control (GPC) signals as an opt-out of any non-essential tracking.

7. Your rights under the GDPR

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights with respect to your personal data:

• Access (GDPR Article 15) — request a copy of the personal data we hold about you.
• Rectification (Article 16) — correct inaccurate or incomplete data.
• Erasure / right to be forgotten (Article 17) — delete your personal data, subject to the retention exceptions in Section 5.
• Restriction of processing (Article 18).
• Data portability (Article 20) — receive your data in a structured, machine-readable format.
• Objection (Article 21) — object to processing based on our legitimate interests.
• Withdraw consent at any time, where processing is based on consent (Article 7(3)).
• Lodge a complaint with your local supervisory authority. For example, in Ireland this is the Data Protection Commission (dataprotection.ie); in the UK, the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email support@customclearancebars.com with the subject line "Privacy Request." We will respond within 30 days and may ask you to verify your identity before acting.

8. Your rights under the CCPA

If you are a California resident, you have the following rights:

• Right to know (Cal. Civ. Code § 1798.100, 1798.110) — what personal information we have collected, the categories of sources, the business purpose, and the categories of third parties with whom it is shared.
• Right to delete (§ 1798.105) — request that we delete personal information we have collected from you, subject to statutory exceptions (for example, completing a pending transaction or complying with a legal obligation).
• Right to correct inaccurate personal information (§ 1798.106).
• Right to opt out of sale or sharing (§ 1798.120, 1798.135) — see the section below.
• Right to non-discrimination for exercising these rights (§ 1798.125).

9. Children's privacy

Our Services are directed at businesses and adult consumers and are not intended for children under the age of 13. In compliance with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. § 6501 et seq.), we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us and we will delete it.

10. International data transfers

We are a United States company and our servers and service providers are located in the United States. If you access the Services from outside the United States, your personal data will be transferred to, and processed in, the United States, which may not offer the same level of data protection as your home country. Where we transfer personal data of EEA, UK, or Swiss residents to the United States, we rely on the Standard Contractual Clauses adopted by the European Commission as the transfer mechanism, supplemented by the protective measures described in this Policy.

11. Security

We take reasonable and appropriate technical and organizational measures to protect personal information from unauthorized access, disclosure, alteration, and destruction. All traffic to and from the site is encrypted using TLS 1.2 or higher. Data stored in Supabase is encrypted at rest. Payment card data never touches our servers — it is tokenized by Stripe at the point of capture, which is a PCI-DSS Level 1 certified processor. Administrative access is restricted to named accounts on an explicit allow-list, enforced both in the application and by database row-level security policies. No system is ever perfectly secure, however, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date at the top and, for significant changes, notify you by email or via a banner on the site at least 30 days before the change takes effect. Your continued use of the Services after the effective date constitutes acceptance of the revised Policy.

13. Contact

Questions, requests, or complaints about this Privacy Policy should be sent to support@customclearancebars.com or mailed to Fourth Dimension CNC, 380 Oak Grove Parkway, Suite 200, Vadnais Heights, MN 55127.