Privacy Policy

Section 1 Who we are

Sauna Custom, LLC is a Florida limited liability company that designs, manufactures, sells, delivers and installs saunas across Florida. Our workshop is in Sarasota, Florida. In this policy, "we", "us" and "our" mean Sauna Custom, LLC, and "you" means anyone who visits saunacustom.com, contacts us or places an order.

We are the party that decides what information is collected on this site and why. If you ever want to talk to a person about your information rather than read a policy, email support@saunacustom.com or call (941) 400-9141.

Section 2 Information we collect

2.1 Information you give us

Contact form. Your name, email address, an optional phone number, the subject you pick from the list and whatever you write in the message box. We also record the date and time and the IP address the submission came from, which is what lets us recognise and discard automated spam.
Email capture and the welcome offer. Your email address, an optional first name, which page or popup captured it, and the single-use discount code we mint for you. Each subscriber record also carries a random unsubscribe token so the link at the bottom of our emails works with one click.
Orders. Your name, email address, phone number, billing and delivery address, the products and options you configured, any installation service you chose, any coupon code you applied, order notes you write for our crew, and the totals we calculated. We keep the tax rate that was applied so a historical order can always be reconstructed exactly as it was charged.
Delivery and installation details. Anything you tell us about the site: gate codes and access notes, slab dimensions and location, the electrical service available, scheduling preferences and the name of a contact on site.
Reviews. If you buy from us we email you a one-time review link. A submitted review carries the name you want displayed, your email address, a star rating and your written review. Your email address is never shown publicly — it exists so we can verify the review and reply to you if there is a problem to fix.

2.2 Information collected automatically

Server logs. Our hosting provider records the usual request data: IP address, date and time, the URL requested, the response status, the referring URL and your browser's user-agent string. We use it to keep the site up, diagnose errors and identify abuse.
Cookies. Described in section 4. The short version is that we use the minimum needed to make a shopping cart and a secure form work.
Meta Pixel. Our public pages load Meta’s (Facebook’s) pixel, which reports the pages you view here to Meta Platforms, Inc., along with your IP address, browser details and Meta’s own cookies. We use it to measure our Facebook and Instagram advertising and to show our ads to people who have visited the site. Described, with how to opt out, in section 4.
Local browser storage. The welcome offer popup stores a single flag in your browser (sc.welcome.v1) so it does not reappear once you have seen or accepted it. It never leaves your device and we cannot read it from our servers.

2.3 Information we do not collect

We do not collect Social Security numbers, driver's licence numbers, health records, biometric data, precise geolocation, or any special category of sensitive personal information. We do not buy mailing lists, and we do not build advertising profiles ourselves; the Meta Pixel described in section 4 lets Meta use your visits to this site in the advertising it shows you.

Section 3 Payments and card data

Your payment card details never reach our servers. When you check out, you are handed to Stripe, Inc. — a PCI-DSS Level 1 certified payment processor — on Stripe's own hosted checkout page. You enter your card number there, to Stripe, and we never see it, store it or transmit it.

What comes back to us is confirmation that the payment succeeded, a Stripe session identifier, a payment intent identifier, and the billing details you gave Stripe so we can fulfil and invoice the order. Stripe's own handling of your information is governed by Stripe's privacy policy, which we recommend reading. Refunds are issued back through Stripe to the original payment method.

Section 4 Cookies and similar technology

Our own cookies are few and all of them are strictly necessary. One third-party tool, the Meta Pixel, sets Meta’s cookies; it is described after the list, with how to turn it off.

Session cookie (sc.session). Holds the identifier for your shopping cart. Without it the cart cannot remember what you added between pages. It expires after seven days of inactivity.
Antiforgery cookie (sc.csrf). Pairs with a hidden token in every form to prove that a submission came from our own page. It is what stops another site from submitting a form as you. Session-lifetime.
Staff authentication cookie (sc.auth). Only ever issued to our own employees when they sign in to the admin panel. Customers never receive it — there is no public account system on this site.

All of these are set as HttpOnly where possible, marked Secure so they only travel over HTTPS, and scoped SameSite=Lax. You can block or delete cookies in your browser settings; if you block ours, the cart and the contact form will stop working, because they have nothing to remember you by.

Meta Pixel (Meta Platforms, Inc.). On our public pages, Meta’s pixel reports each page you view to Meta, with your IP address, browser details and Meta’s cookies (such as _fbp). We use it to measure our Facebook and Instagram advertising and to show our ads to people who have visited. Meta can link the visit to a Facebook or Instagram account you are signed in to, and uses the information under Meta’s privacy policy. It never runs in our staff admin panel, and it never sees your card details, which you enter on Stripe’s own checkout page.

To turn it off: switch on Global Privacy Control in your browser (we do not load the pixel at all when it is on), block third-party cookies or facebook.com in your browser settings, or change your ad preferences in your Facebook or Instagram account settings.

We honour Global Privacy Control as described above. The older Do Not Track setting is not a recognised standard, and we do not act on it separately.

Section 5 How we use your information

We use what we collect for these purposes and no others:

To answer the question you asked us, by email or phone.
To quote, take, process, build, deliver and install your order.
To send you transactional email: order confirmations, production and shipping updates, installation scheduling, warranty information and your review invitation.
To calculate shipping, installation and Florida sales tax correctly.
To issue, validate and redeem coupon codes, and to enforce the one-code-per-customer rule on the welcome offer.
To publish reviews you choose to submit, under the display name you give us.
To send marketing email, but only to people who asked for it (see section 7).
To keep the site secure and working: detecting spam, blocking abuse, diagnosing errors.
To keep the books and meet our tax, warranty and record-keeping obligations.

We do not sell your personal information and we do not rent it. Apart from the Meta Pixel described in section 4, we do not share it with anyone for their own marketing purposes. If that ever changed we would have to say so here first, and we would ask you before it applied to information we already hold.

We share the minimum necessary with service providers who work on our behalf and are contractually restricted to using it only to do that work:

Stripe, Inc. — payment processing, fraud screening and refunds.
Microsoft Azure — hosting, application data storage and backups. Our production database and web application run in Microsoft's data centres in the United States.
Our email provider — delivering transactional and marketing email through an authenticated SMTP relay.
Meta Platforms, Inc. — the Meta Pixel described in section 4 reports the pages viewed on this site, to measure and target our Facebook and Instagram advertising. Meta also uses this information for its own purposes under its own privacy policy.
Carriers — your name, delivery address and phone number, when an accessory ordered on its own is shipped to you. Saunas are delivered and installed by our own crew, so your site notes stay with us.
Professional advisers — our accountant and, if ever needed, our attorney or insurer, under their own duties of confidentiality.

Your electrician. When you ask us to, we send the heater’s electrical specification and the site details they need to the licensed electrician you hire, so they can run the dedicated circuit and make the connection. Your electrician is your contractor, not ours and not bound by a contract with us, so how they handle that information is between you and them.

We will also disclose information where we are legally required to: in response to a valid subpoena, court order or lawful request from a government authority; to establish or defend a legal claim; or to protect the safety of a person. If our business is ever sold or merged, customer records would transfer with it, and we would tell you before your information became subject to a different privacy policy.

Section 7 Marketing email and how to stop it

You only get marketing email from us if you asked for it — by entering your address into the welcome offer popup or a newsletter form. Placing an order does not subscribe you. We send at most a couple of messages a month: new builds leaving the shop, seasonal price cuts, and occasional guidance on getting the most out of a sauna.

To stop, click the unsubscribe link at the bottom of any marketing email. It is a one-click link with your own token in it; no login, no form, no "are you sure". You can also email support@saunacustom.com and we will remove you by hand. Unsubscribing takes effect immediately.

Transactional email about an order you actually placed — a confirmation, a shipping notice, an installation appointment, a safety notice or a warranty matter — is not marketing and continues regardless, because you need it. If you also want your account data deleted, see section 10.

Section 8 How long we keep information

Orders and invoices: at least seven years, because tax and warranty law requires it. Our warranty, and any extended warranty years you buy, run on after delivery, and we cannot honour them without the record of what we built and shipped.
Contact form submissions: twenty-four months from the date received, then deleted, unless the enquiry turned into an order.
Email subscribers: until you unsubscribe. After that we keep only a suppression record — your email address and the fact that you opted out — so that we do not accidentally mail you again.
Reviews: for as long as the product is listed, or until you ask us to remove yours.
Server logs: typically ninety days, then rotated out.

Section 9 How we protect information

Everything on this site is served over HTTPS with HSTS, so traffic between your browser and us is encrypted in transit. Data at rest in our Azure SQL database is encrypted by the platform. Access to the admin panel is restricted to named staff accounts, protected by a twelve-character minimum password policy, account lockout after repeated failed attempts, and role-based authorisation; there is no shared login. Every form is protected against cross-site request forgery, and the site sends a strict Content-Security-Policy that only allows scripts from ourselves and Stripe.

No system is perfect and we will not pretend otherwise. If we ever become aware of a breach affecting your personal information, we will notify affected customers and the relevant authorities as required by Florida law, and we will tell you plainly what happened and what to do about it.

Section 10 Your rights and how to use them

Wherever you live, you can ask us to:

Access — tell you what personal information we hold about you and give you a copy.
Correct — fix anything that is wrong or out of date.
Delete — erase what we hold, except records we are legally required to keep, such as completed order and tax records.
Opt out — stop marketing email, permanently.
Object — tell us you do not want a particular use of your information, and have a person consider it.

How to exercise them: email support@saunacustom.com from the address you are asking about, with "Privacy request" in the subject line, and tell us which of the above you want. If you cannot email from that address, call (941) 400-9141 and we will work out another way to verify you. We verify identity in proportion to the request — we will not hand someone else's order history to whoever asks for it.

We answer within thirty days, and we will not charge you, discriminate against you, refuse to serve you, or change your price because you exercised a privacy right. You may use an authorised agent; we will ask for written proof of their authority.

Section 11 California residents

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you specific rights, and we extend the same treatment to everyone who asks.

Right to know — the categories and specific pieces of personal information we have collected, the sources, the business purpose, and the categories of third parties we disclosed it to. Section 2 and section 6 answer this in advance.
Right to delete — subject to the legal exceptions noted in section 10.
Right to correct — inaccurate personal information.
Right to opt out of sale or sharing — we do not sell personal information. The Meta Pixel (section 4) sends information about your visits to this site to Meta for advertising, which the CCPA/CPRA may treat as “sharing”. To opt out, turn on Global Privacy Control in your browser, which stops the pixel loading on this site, or contact us as described in section 10.
Right to limit use of sensitive personal information — we do not collect any.
Right to non-discrimination — exercising a right never changes what we charge you or how we serve you.

Categories collected in the last twelve months, in CCPA terms: identifiers (name, email, postal address, phone number, IP address); customer records and commercial information (orders, products purchased, amounts paid); internet activity (server logs of pages requested, and the page views the Meta Pixel reports to Meta); and geolocation only to the extent a billing or delivery address and an IP address imply a location. Every category is collected directly from you or generated by your use of the site, for the business purposes in section 5.

To make a CCPA request, use the same route as section 10: support@saunacustom.com.

Section 12 Florida notes

We are a Florida business and our records are kept in the United States. Florida law requires us to take reasonable measures to protect and securely dispose of customer records containing personal information, and to notify affected individuals and the Florida Department of Legal Affairs of a qualifying data breach within the statutory deadline. We maintain the safeguards described in section 9 for that purpose.

Sales made to Florida addresses are subject to Florida sales and use tax, which means our order records — including your name, address and what you paid — are business records we are required to retain and produce to the Florida Department of Revenue on a lawful request. Installation work performed at a Florida property may also require us to give your site address to a permitting authority.

If you are calling us from a Florida number, please note that we do not record telephone calls.

Section 13 Children's privacy

This site is meant for adults. It is not directed at children, we do not knowingly collect personal information from anyone under 13, and we do not sell to minors. If you believe a child has given us personal information, email support@saunacustom.com and we will delete it promptly.

Separately, and more importantly than any privacy question: saunas and cold plunges are not safe for unsupervised use by children. See the health and safety section of our terms of service.

Section 14 Links to other sites

This site links out to Stripe's checkout, to our social media profiles and occasionally to a manufacturer's documentation or an industry resource. Once you follow a link you are on somebody else's property, under their privacy policy, and we have no control over what they collect. Social platforms in particular may know you visited them from here. We encourage you to read the policy of any site before giving it information.

Section 15 Changes to this policy

We will update this page when our practices change, and we will move the "last updated" date at the top whenever we do. If a change is material — a new category of data, a new purpose, a new recipient — we will say so prominently on the site, and we will email subscribers before it takes effect. Continuing to use the site after a change means you accept the revised policy; if you do not, tell us and we will delete what we can.

Section 16 How to reach us

Questions, requests and complaints about privacy all go to the same place, and a person reads them:

Email: support@saunacustom.com
Phone: (941) 400-9141, weekdays 8:30am–5:00pm ET
Post: Sauna Custom, LLC, Sarasota, Florida
Web: the contact form

If you are not satisfied with how we handled a privacy request, tell us so directly before going elsewhere — most of the time it is a misunderstanding we can fix the same day.

Privacy policy