Privacy

Website edition: October 10, 2026

Who operates this website

Northpeak Distribution LLC operates this website. Contact northpeak.llc@yahoo.com with privacy questions. Our public business contact is email only; a customer phone number may still be requested during checkout.

Contact messages and supply inquiries

The contact form submits your name, email, subject and message to the website's private inbox. The site records the submission time and a message reference. This is different from opening an email draft: a successful web submission is saved for the administrator. We use these details to handle your inquiry. Direct email messages are handled by our email provider.

Orders and customer details

Checkout collects your name, email, order-contact phone and shipping address. We store order items, quantities, pricing, shipping and tax amounts, accepted policy text, payment references, status and any shipment reference supplied by Northpeak. We use these records to process orders, communicate, handle disputes or refunds, and maintain business records. We do not collect your full card number, card security code, PayPal password, or unrelated account verification code.

Phone verification

In collect-only mode, the phone number is recorded for order contact and no SMS is sent. If real SMS verification is enabled, we request your consent and use Twilio Verify to initiate and check a Northpeak code. Provider acceptance does not guarantee delivery. In a clearly labeled test store, administrator-set test codes do not send SMS and do not prove phone ownership. Verification attempts, expiry and consent state may be recorded to operate and protect checkout. We do not store the code entered by a buyer in order records.

Payments and processing services

Product checkout can offer PayPal, Stripe, Braintree and Checkout.com when configured and enabled. PayPal, Stripe and Checkout.com use processor-hosted checkout pages. Braintree uses provider-origin embedded card fields and may involve the card issuer for 3-D Secure authentication. Northpeak receives an opaque payment token, payment references and status information, not the card number or security code. Braintree device data is used for fraud screening. Failed or interrupted payment requests remain pending until reconciled with the processor. A token needed to reconcile an interrupted Braintree request is encrypted and is cleared after a confirmed transaction reference is obtained.

The separate support page embeds Donorbox. Donorbox and its selected payment processor handle contributions under their own terms and privacy policies. Contributions are not product purchases. These providers may process personal information, device data and cookies when their services load. Review the provider’s information before using a payment service.

Cookies, browser storage and security logs

The store uses a necessary server-session cookie for carts, checkout, form protection and administrator sign-in. The cookie is HttpOnly and Secure on HTTPS. Checkout contact details are kept in the server session and are not saved by our code to localStorage. The older supply-category selector uses browser sessionStorage for category IDs and approximate quantities only. Hosting logs may contain IP addresses, requested URLs, browser information and timestamps. Store abuse limits use keyed hashes of identifiers. Private order links should not be shared, because they grant access to an order summary.

Storage and access

The application stores operational records in a relational MySQL database. Private customer contact fields, message contents, evidence notes, email contents and payment secrets are encrypted using an application key kept outside the public website directory. Administrator passwords are hashed. Product descriptions, prices, order totals, payment references and operational status fields are stored as ordinary database values. Access is limited by hosting and administrator controls. The hosting and mail providers also maintain their own systems and records. These measures do not mean any system is immune from compromise. Protect your administrator password and hosting account.

Retention and requests

Contact us to request access, correction or deletion of information you supplied. We review requests in light of order administration, recordkeeping requirements, disputes and legitimate business needs. Order and message records are retained until the administrator applies an appropriate retention decision; the application does not automatically delete them after a claimed fixed period. Hosting, PayPal, Twilio, SMTP and Donorbox records may require separate requests to those providers. We do not include advertising pixels, behavioral analytics or a newsletter signup in this website package.