What we collect
We collect only the information needed to reply to your enquiry, ship an order, or operate the site. Contact form: your name, email, and message body, plus optional guitar model / part of interest. OEM form: company, country, role, and any drawings or links you choose to send. Stripe-hosted checkout collects payment, contact and delivery details, including a required delivery contact phone number for new checkouts. Where Stripe supports it, business buyers can optionally provide their legal business name and business tax ID for tax treatment and order records. These tax details remain in Stripe; ordinary buyers can check out without a business tax ID. Authorized staff can view the shipping name, delivery address, phone number and any business tax ID retrieved from Stripe in our protected staff portal to fulfil orders and provide necessary details to the carrier. These details are not available in public order responses or shared between customer accounts. The phone number is used for delivery enquiries, not marketing. Provider responses may transiently contain customer details, but our commerce order tables store purchased items and options, amounts, payment/refund references and states, ownership identifiers and recorded dispatch information — not customer names, phone numbers, delivery addresses, business tax IDs or card details. Ordinarily we do not store checkout email addresses in these tables; the encrypted promotion-code checkout snapshot described below is an exception. Full card details are handled by Stripe, not our server.
Optional accounts
You can shop without creating an account. Microsoft Entra External ID handles email-code sign-in; Aumsen does not store a separate account password. We store your account identifiers, an optional editable display name and encrypted sign-in sessions. Your sign-in email and a name supplied by Microsoft may be displayed on your account page, but they are not automatically copied into order/payment records. Separately verifying an email to redeem a promotion creates the encrypted coupon checkout snapshot described below. Purchases placed while signed in appear in that account only. Guest orders are not added or merged into an account. You can edit or clear your saved display name without changing your sign-in email or delivery details.
Promotion codes
To apply a promotion, we ask you to verify your checkout email with a one-time code. This is available to guests and account holders and does not create an account or subscribe you to marketing. We keep a protected matching reference derived from your email and, when signed in, your account identifier to enforce eligibility and one redemption per promotion. Common Gmail address aliases are treated as the same mailbox. The email is encrypted in short-lived verification records and in coupon checkout snapshots needed to create or safely retry the same payment. We provide that verified address to Stripe for the coupon checkout. This encrypted coupon snapshot is an exception to the ordinary order-data email exclusions described above. Verification codes expire after 10 minutes; verification permission expires after 30 minutes. Expired verification records are periodically removed after a two-day safety window. Coupon checkout snapshots, redemption records and staff promotion-change records remain with our order-support and abuse-prevention records. We do not send promotion codes, verification codes, email-matching references or verification tokens to Analytics. A refund does not automatically restore a redeemed promotion. Contact us if you believe your promotion was incorrectly marked as used.
How the information is used
Contact-form submissions go to our workshop inbox at contact@aumsen.com so we can reply. OEM submissions are reviewed by the same team to scope and quote the work. Stripe order data is used to fulfil the order and meet legal record-keeping obligations. We do not sell or rent personal information to third parties, and we do not use it for advertising profiles.
Dispatch and tracking emails
We send transactional dispatch and tracking updates to the contact email supplied with your paid Stripe checkout, whether you purchased as a guest or while signed in. This can differ from your account sign-in email. Our team may resend an update when needed. These messages are separate from Stripe payment receipts and are not marketing emails. We retrieve the checkout contact address from Stripe when preparing a message and pass it to our mail service for delivery; dispatch notifications do not copy the full address into our commerce order tables or notification history. We retain a masked recipient, a protected recipient-matching reference, parcel details and sending-attempt records, including timestamps, status and message identifiers, to investigate problems and reduce duplicate or misdirected messages. Staff see only the masked recipient in the notification controls. We do not add email-open tracking pixels. Replies go to contact@aumsen.com.
Service providers
A small set of third parties processes data on our behalf: Stripe (payment processing and checkout contact details), Microsoft Entra External ID (email-code sign-in), our SMTP relay (delivering contact-form mail, promotion verification codes and transactional dispatch/tracking updates), and our hosting provider Microsoft Azure (running the website and storing data and operational logs). When website analytics is enabled, Google also processes the measurement requests described below. Each is bound by their own data-processing terms.
Functional cookies and browser storage
Secure, HttpOnly cookies protect signed-in sessions, access to the current checkout and a 30-minute promotion-email verification permission. Browser local storage keeps cart items and a narrow current-checkout recovery record to resolve interrupted checkout, not a guest order-history list or your contact and delivery details. A guest order link alone does not grant access from another browser. Signed-in devices have separate sessions; signing out revokes the current Aumsen session. Stripe and Microsoft use their own cookies on their hosted checkout and sign-in pages.
Website analytics
With your acceptance, we use Google Analytics 4 and our linked Google Ads account to measure visits, product interactions and purchases, including which ads lead to sales. Until you accept, or if you reject, we do not load Google’s measurement script or send these measurement requests. Acceptance permits analytics storage, advertising storage and advertising user data for measurement, but not personalised advertising. Google Signals, remarketing and enhanced conversions remain disabled; we do not use separate server-side purchase measurement. Google may process your network IP address, browser and device information, cookie identifiers and approved Google ad-click parameters. Analytics cookies expire after six months without extending their expiry on each visit. We may report public product and variant names, amounts and successful purchases using a randomly generated transaction reference to prevent duplicates. We do not send customer names, email or delivery addresses, payment-card details, account identifiers, authentication tokens or form text. Account, staff, sign-in, contact and OEM pages are excluded. Checkout page views are excluded; a confirmed paid purchase may be reported from its confirmation page. Our integration excludes referring URLs, fragments, search text and other URL parameters; only validated Google ad attribution parameters may accompany public shopping pages after acceptance. Your choice is remembered in this browser for 180 days, and you can change it below at any time. Rejecting stops future measurement, clears first-party Analytics and ad measurement cookies and, where needed, reloads the page to remove Google’s running script. This does not erase data already received by Google. If your choice cannot be safely read or saved, measurement stays off for the current visit. If a changed choice cannot be saved or an earlier acceptance removed, that earlier choice may apply again after a reload; the controls below display a warning. We respect browser Do Not Track and Global Privacy Control signals. These choices do not affect shopping, account sign-in or payment cookies.
Google’s privacy informationLoading your measurement preference…
Retention
Contact and OEM enquiries are retained for up to 24 months so we can follow up on quotes and reorders. Order records are retained for the period required by tax and consumer-protection law in the destination country (typically 6–7 years). Dispatch notification records are retained with order-support records while needed to resolve fulfilment or delivery enquiries and legal obligations. The protected recipient-matching reference remains while an order supports historical notification sending, so removing old sending attempts does not silently change the recipient.
Your rights
You can ask us to access, correct, or delete the personal information we hold about you by emailing contact@aumsen.com with the subject "Privacy request". Contact the same address for account-access or deletion help. Account deletion does not automatically remove order records that must be retained for fulfilment, refunds, accounting or legal obligations. We respond within 30 days. EU/UK residents have the additional rights granted by GDPR / UK GDPR; California residents have the rights granted by the CCPA.
Contact
Questions about this policy? Email contact@aumsen.com. The latest version of this page is always the controlling text.