Privacy policy

Effective from 22 September 2026. This notice replaces the privacy policy of 20 April 2022.

1. Who we are

This store is run by CO2Art LLC, 187 E. Warm Springs Rd., Suite B, Las Vegas, NV 89119, United States. We are the business responsible for your personal information. You can reach us at support@co2art.us or by post at the address above.

This notice covers the online store at www.co2art.us, our customer accounts, our e-mails and our customer support. Our European store (co2art.eu) and our trade (B2B) store have their own notices.

2. What we collect and why

We only collect what we need to sell you our products, keep you informed and run the store.

Orders and delivery — your name, delivery and billing address, e-mail address, phone number, what you bought and how you paid. We need this to fulfil your order, deliver it, issue invoices and handle returns and warranty claims, and to meet tax and accounting law.
Your customer account — your e-mail address, name, addresses and order history. Sign-in is handled by Shopify with a one-time code sent to your e-mail, or with Google, Facebook, Apple or X (Twitter) if you choose so; we never see a password.
Signing in with Google or Facebook — if you choose "Sign in with Google" or "Log in with Facebook" (provided through Oxi Social Login, section 3), that provider confirms who you are and we receive only your name, your e-mail address and, where your account has one, your profile picture. We use this information solely to create or sign you in to your customer account and to show your name in it. We do not use it for advertising, we do not share it with anyone except the providers that run our store and its sign-in (Shopify and Oxi Social Login), and we never sell it. We do not post anything to your Google or Facebook account. You can revoke this access at any time: in your Google account under "Third-party apps & services", or in your Facebook settings under "Apps and Websites" — and you can ask us to delete the account data we hold, as described in section 6. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements; our use of information received from Facebook follows the Meta Platform Terms. The same applies to Apple and X (Twitter) sign-in: we receive only your name and e-mail address from them.
Google and Facebook user data — in short. What we access: your name, your e-mail address and, if your account has one, your profile picture — nothing else from your Google or Facebook account. How we use it: only to create or sign you in to your customer account on this store and to show your name in it; never for advertising, never to build profiles, never to train AI or machine-learning models, never for credit or eligibility decisions. Who we share it with: only Shopify (which hosts the store and the customer accounts) and Oxi Social Login (which runs the sign-in window); we never sell it and never pass it to data brokers or advertising networks. How we protect it: it is transmitted and stored over encrypted connections, kept in Shopify's and Oxi's secured infrastructure, and accessible only to the members of our team who need it to serve you. How long we keep it: for as long as your customer account exists; when you close your account or ask us by e-mail, we delete it within 45 days, keeping only what tax and accounting law requires about past orders (section 4). Changes: if we ever change how we use Google or Facebook user data, we will update this notice and tell you by e-mail first.
Customer support — the messages you send us by e-mail, chat or the contact form, and the details needed to answer them, such as your order number and photos of a product.
Newsletter and offers — your e-mail address and, where you tell us, the topics you are interested in. You can unsubscribe at any time with the link in every e-mail.
Reviews — the name and review text you submit, together with your order, so that we can show verified reviews.
Purchase and review notifications on our website — to show visitors that the store is active, co2art.us displays short notices about recent orders and recent product reviews, for example "Anna in Austin, Texas bought a Pro-SE Regulator · 3 days ago". A purchase notice shows the buyer's first name, the city and state of the delivery address, the product and how long ago the order was placed; a review notice shows the reviewer's name as published with the review, the country, the rating and the product. We never show surnames, e-mail addresses, order numbers, prices, street addresses or review texts. A notice is generated automatically from orders and reviews of the last 14 days and removed automatically after that. You can ask us at any time to leave your purchase or review out of these notices: write to support@co2art.us with your order number or the e-mail address of your order and we remove it without delay, usually within the hour, and never show it again.
Website use — technical data such as your IP address, browser, the pages you visit, and the analytics and advertising cookies described in section 5, which help us understand how the store is used and show you relevant offers.
Fraud prevention and security — the data around an order and a payment that Shopify and our payment providers use to detect fraud.

3. Who we share it with

We share personal information only with providers that help us run the store, and only for those purposes. They act on our instructions, except where they are independent businesses with their own privacy policies (payment providers, carriers and the sign-in providers you choose). We do not sell your personal information.

Shopify (Shopify Inc., Canada, and its affiliates) hosts the store, the checkout, the customer accounts and the order data, and provides Shopify Payments, Shop Pay, Apple Pay and Google Pay. Shopify's own privacy policy applies to the checkout and to payments.
Payment providers shown at checkout, including PayPal, process your payment. We never receive your full card number.
Carriers such as FedEx and UPS receive your name, address, phone number and e-mail address to deliver your parcel and to send delivery notifications. For deliveries outside the United States, customs authorities receive the data required by law.
Our own order and customer systems, operated by us, hold order, delivery, warranty and support records so that our team can serve you across the store, the warehouse and customer service.
Customer support tools — Re:amaze (chat and help desk). Part of our chat and e-mail support is answered by an AI assistant that we operate; to draft an answer it may process the content of your message with an AI service provider, Anthropic. A person from our team can always take over, and your message is never used to train those models.
E-mail — our newsletters and service e-mails are sent through Amazon Web Services (Amazon SES). Before we send a newsletter we may check that an e-mail address can receive mail through Bouncer, an e-mail verification service. Our sign-up forms, including the prize wheel, are our own.
Sign-in — Oxi Social Login (Oxi Apps) provides the sign-in window of our store: it receives the e-mail address you enter, sends you the one-time code and signs you in to your customer account, and it sets the sign-in cookies listed in section 5. If you choose to sign in with Google, Facebook, Apple or X (Twitter) instead, that provider confirms your name and e-mail address to it under its own privacy policy.
Reviews — Stamped collects and displays product reviews and sends review requests on our behalf.
Returns — Rich Returns runs our returns portal and receives your order number, e-mail address and the details of the return you request.
Order tracking — our "Track order" page looks up your order by its number and your e-mail address in our own order system and shows the carrier's tracking status.
Affiliate program — GoAffPro records that you arrived through an affiliate's link so that the affiliate can be paid a commission; it does not receive your name or address.
Cloudflare (Cloudflare, Inc.) delivers and protects our website (content delivery and security) and checks that entries to our prize wheel come from a person (Cloudflare Turnstile). It processes technical data such as your IP address, your browser and the pages you request.
Analytics and advertising — Shopify Analytics, Google Analytics, Google Ads, Meta (Facebook and Instagram) and OpenAI (ChatGPT advertising) receive usage and conversion data through the cookies and pixels described in section 5. Shopify Audiences may share hashed identifiers with advertising platforms so that we can reach people similar to our customers. You can opt out of this advertising use as described in section 6.
Authorities and advisers where the law requires it, and a buyer of our business if it is sold.

Some of these providers are outside the United States, mainly in Canada and the European Union.

4. How long we keep it

Orders, invoices and the related correspondence: for as long as tax and accounting law requires, in general up to 7 years after the year of the order, and for as long as a warranty claim can be made.
Your customer account: until you close it or after 3 years without an order or a sign-in.
Newsletter data: until you unsubscribe; we then keep only the record that you unsubscribed.
Support conversations: 3 years after the last message, unless they belong to an order or a claim.
Analytics data: according to the retention settings of the tools in section 5, at most 14 months for Google Analytics.

5. Cookies and similar technologies

Cookies are small files stored on your device; pixels are small scripts that report an event, such as a page view or a purchase. We use them to make the store work, to remember your choices, to measure how the store is used and to show you relevant offers. You can block or delete cookies in your browser at any time; necessary cookies are needed for the cart and the checkout to work. To opt out of advertising cookies you can switch on the Global Privacy Control signal in your browser, use the opt-out tools of Google (adssettings.google.com) and Meta (your Facebook ad preferences), or write to us (section 6).

Category	Cookies and pixels	Purpose and duration
Necessary	_shopify_essential, cart, cart_currency, localization, secure_customer_sig, _shop_app_essential, __cf_bm, _cfuvid	The cart, the checkout, your sign-in, your country and currency, and protection against automated abuse (Cloudflare). Session to 1 year.
Preferences	co2art_local_store, concept:newsletter-popup, co2art_spin	Remember that you chose to stay in this store, that you closed the newsletter window and that you already played the prize wheel. Up to 1 year.
Analytics	_shopify_y, _shopify_s, _shopify_analytics, _ga, _ga_*	Shopify Analytics and Google Analytics: how the store is used, in aggregate. Session to 2 years.
Advertising	_shopify_marketing, _gcl_au, _gcl_aw, _fbp, test_cookie, oaiq_*	Google Ads, Meta and OpenAI: attributing a purchase to an ad and showing you relevant offers on those platforms. Session to 2 years.
Third-party services	Re:amaze, Stamped, GoAffPro, Oxi Social Login	The chat window, the reviews widget, the affiliate link record and the sign-in window set their own cookies while you use them, under their own privacy policies. Session to 1 year.

6. Your rights and choices

You can ask us at any time to tell you what personal information we hold about you, to correct it, to delete it, to give you a copy of it, and to stop using it for marketing. You can see and change most of your data yourself in your customer account. For everything else write to support@co2art.us; we answer within 45 days. This includes the purchase and review notices described in section 2: one e-mail with your order number or the e-mail address of your order, and your purchase or review is left out of them, usually within the hour. We will never treat you differently for exercising these rights.

Deleting your data. To delete your customer account and the personal information we hold about you — including anything we received from Google or Facebook when you signed in — write to support@co2art.us from the e-mail address of your account, or use the contact form on our site. We confirm the deletion within 45 days; we keep only what tax and accounting law requires us to keep about past orders (section 4). Removing our app in your Google or Facebook settings stops the sign-in but does not by itself delete the account data we hold — send us the e-mail for that.

California and other US state privacy laws. If you live in California, Colorado, Connecticut, Virginia, Utah or another state with a consumer privacy law, you also have the right to know the categories of personal information we collect and disclose (sections 2 and 3), to opt out of the "sale" or "sharing" of personal information for targeted advertising, and to limit the use of sensitive personal information. We do not sell personal information. The advertising cookies and pixels in section 5 may count as "sharing" for cross-context behavioral advertising; you can opt out with the Global Privacy Control signal, which we honor, or by writing to us. We do not knowingly sell or share the personal information of anyone under 16. You may use an authorized agent to make a request; we will ask for proof of the authorization and verify your identity by matching the details of your request with the information in your order or account.

7. Children

Our products and our marketing are meant for adults. We do not knowingly collect personal information from anyone under 16.

8. Security

The store, the checkout and our own systems use encrypted connections, access controls and regular backups. No method of transmission or storage is completely secure, so please keep your sign-in e-mail account safe and tell us at once if you suspect misuse.

9. Changes

We will post any change to this notice on this page with a new effective date. For material changes we will also tell customers with an account by e-mail.

Spin to win!