Privacy Policy

§01 — Orientation

Scope and current facts

This policy explains how Bottomline Thermals LTD., also presented as Bottomline Thermals or Bottomline Thermals PCs (“Bottomline Thermals,” “we,” “us,” or “our”), handles personal information through blthermals.com, our PC configurator and checkout, custom-build and support requests, order service, and related communications.

The storefront does not currently offer customer accounts. The existing sign-in route is for authorized staff. Local carts and saved builds are browser features, not an account, cloud backup, or promise that another device can retrieve them.

Bottomline Thermals serves the U.S. market. We operate from the United States. If you use the site from another country, your information may be processed in the United States, where privacy laws may differ. A provider’s own notice applies when you use a provider-controlled payment, financing, or verification interface.

§02 — Collection record

Information we handle

The information involved depends on what you choose to do. We receive information from you, from the browser or device used to reach us, from our service providers, from Meta when our lead-form connection is on and you submit one of our forms on Facebook or Instagram, and from records created while we fulfill or support a request.

Contact and delivery

Name, email, phone number, company if supplied, billing and shipping address, and order or support reference.

Build and transaction

Cart contents, PC parts and customization choices, saved or shared builds, price, discount, shipping, tax, order status, returns, warranty, and service history.

Payment and financing

Payment method, amount, status, provider transaction identifiers, and limited payment details returned by a payment or financing provider. Provider-entered card or financing information is described in Payments and financing.

Requests and communications

Custom-build details, quiz answers, support messages and submitted photos or files, requested emails, feedback, and consent or opt-out records. Please do not place unnecessary sensitive information in an open message field.

Device, security, and operation

IP address, browser and device information, user agent, timestamps, page addresses or paths and referring-page information, server and security events, anti-abuse or CAPTCHA signals, and first-party visitor or rollout identifiers. Page and referrer information can include URL details supplied by your browser or a form.

Facebook and Instagram lead forms

When our lead-form connection is on and you submit one of our forms, Meta gives us what you entered, such as your name, email address, phone number, and answers, along with the form, the submission time, and Meta’s lead ID.

Advertising measurement

When advertising measurement is on: a random measurement identifier, a Facebook click identifier if you arrived from one of our ads, your IP address, and your user agent.

Showcase material

If provided or approved for display: build photography, review text, the name or display name supplied for publication, general location, build date, and limited build-progress information.

§03 — Purpose

Why we use information

• Operate the storefront, remember a cart or configuration, and provide requested features.
• Create quotes, process payment or financing, fulfill and ship orders, and provide receipts.
• Respond to custom-build, contact, quiz, warranty, order, and support requests.
• Send requested transactional messages and separately authorized recovery or marketing messages.
• Match your email address to a Meta advertising audience under the notice shown with your custom-PC request, subject to your opt-out and applicable privacy requirements.
• If you are on our marketing email list, upload your details to Meta for advertising, as described under Email subscriber lists.
• When advertising measurement is on, measure how our ads perform and help improve how they are delivered, using the events described under Meta below, unless you opt out.
• Prevent fraud, abuse, duplicate actions, security incidents, and technical failures.
• Maintain, debug, and improve the site using necessary, sanitized, or aggregated information.
• Keep required business records and comply with tax, accounting, legal, and regulatory duties.
• Display customer-build material only under the approved display arrangement.

Submitting an order, quote, build, quiz, contact, or support request authorizes us to use the information to complete or respond to that request. Except as described under Messages, marketing, and consent, it does not by itself subscribe you to marketing emails. Advertising audience matching is described separately below.

§04 — Service map

Providers and other disclosures

We share information with providers as needed to operate the services described here. Providers may use their own subprocessors. Their independent practices are governed by their notices and our applicable agreements.

• PlanetScale

  Database storage for orders, requests, support, and consent records.

  PlanetScale privacy notice ↗

• Stripe

  Card-payment collection, authentication, fraud screening, processing, and payment status.

  Stripe privacy notice ↗

• Klarna, when available

  If offered and selected, payment or financing eligibility, authorization, servicing, and status. Available options are shown at checkout.

  Klarna privacy notice ↗

• Cloudflare

  Website hosting, request delivery, security, technical logs, object storage, and Turnstile abuse prevention on selected forms. Cloudflare also provides transactional email delivery when configured.

  Cloudflare Web Analytics. When it is on, Cloudflare adds a small script to our pages from its own network, so it is not part of our site code. It runs when a public page opens: our home, shop, product, about, financing, offer terms, terms of sale, warranty, privacy, and return pages. We set it up to stay on those pages, so it is not meant to follow you to private pages such as your cart, our quiz, the configurator, or a saved build.

  It reports how the page loaded and performed, the page address, the referring page, and your country, device type, browser, and operating system. It leaves out query strings and fragments but keeps the rest of the address, so an ID in a reported path would be included. If a public page opens by a full page load from your cart, checkout, a quote, quote payment, or email preferences, it can report that page as the referring page, such as /cart. Those paths are fixed and contain no ID. Reports go through our site address to Cloudflare, which also hosts our site and sees your IP address on each request. Cloudflare keeps this data under its own terms.

  Cloudflare says this service does not use cookies or local storage, does not fingerprint people by IP address or user agent, and does not track individuals across other sites.

  This applies to all visitors, not only those in the United States, and it does not wait for you to interact. The Opt out of measurement button and Global Privacy Control do not stop it, because Cloudflare adds it outside our site code and it does not check those signals. We offer no opt-out for it. A browser setting or extension that blocks scripts may stop it.

  Cloudflare privacy notice ↗

• Resend, when configured

  Email addresses, message contents, and delivery status for authorized transactional, recovery, or marketing messages. Marketing delivery uses a separately configured channel.

  Resend privacy notice ↗

• Google Workspace

  Business email, including messages sent to our support and sales addresses, and business document storage in Google Drive. These records may include customer contact details, communications, attachments, and order or service information.

  Google privacy notice ↗

• OpenAI assistance

  We use authorized AI tools from OpenAI to help review business inbox communications and prepare draft replies. Customer contact details, message contents, and relevant attachments may be processed for this support and business administration work.

  OpenAI privacy notice ↗

• Twilio

  Phone number, recovery-link content, and delivery status when a separately authorized cart-recovery text is sent and the optional SMS service is configured.

  Twilio privacy notice ↗

• Meta

  When the audience service is configured, we may send Meta a normalized, hashed email address from an eligible custom-PC request submitted with its advertising notice, or under your previously recorded explicit permission, to match against Facebook or Instagram accounts for our ads. Hashing does not make the information anonymous. This audience service does not send your phone number, budget, financing details, purchase history, or freeform request text. Advertising measurement, described next, is separate and does send order value.

  Email subscriber lists. If you are on our marketing email list, we may also upload your details to Meta in hashed form for advertising, including showing, limiting, or measuring ads. Those details can include your email address, name, phone number, and location. Hashing does not make them anonymous. We upload these lists by hand, and the audience service above does not manage them. How to stop this.

  Advertising measurement. When advertising measurement is on, our servers send Meta these events unless you have opted out or sent a Global Privacy Control signal. No Meta pixel runs in your browser.

  Who and when. Website advertising measurement covers visitors whose connection appears to come from the United States, based on a country code from our hosting provider. Visitors elsewhere, including Puerto Rico, Guam, and other U.S. territories, are not measured. Opening a page alone does not start it. It starts when you click, tap, press a key, or scroll on one of our main pages, our contact or custom-PC request pages, our quiz, or your cart; when you submit a contact or custom-PC request; or when checkout starts, which happens when you open checkout with items in your cart. After that, later visits from that browser are measured until you opt out or our measurement cookie expires.

  Visits and shopping: viewing a main page or product and adding a PC to your cart, with the page address, your IP address, and your user agent.

  Requests and checkout: submitting a contact or custom-PC request and starting checkout, with the page address and your user agent.

  Purchases: a website checkout order paid in full, with its order value, currency, our order reference, and your user agent.

  Facebook and Instagram leads: that we received your lead-form submission and, if it happens, that our team marked it as a qualified lead. These events use the lead ID Meta assigned and our inquiry reference. They do not use a cookie or browser data, and they are not limited to the United States.

  Website events also include a hashed version of a random identifier from our measurement cookie. If you arrived from one of our Facebook or Instagram ads in the last 90 days, they can include the Facebook click identifier and the IP address we stored with it. Events can also include our internal references for the request, order, or page type. We do not include your name, email address, phone number, billing or delivery details, payment details, message text, or lead-form answers in these events. Hashing does not make the information anonymous, and your IP address and user agent are not hashed.

  We use these events to measure how our ads perform and help improve how they are delivered. Meta handles this information under its own terms and privacy notice.

  Meta privacy notice ↗

• Fulfillment and professional services

  Carriers, delivery and warranty support, accountants, insurers, attorneys, and other advisers receive information only when needed for that role.

• Legal and business events

  We may disclose information when reasonably necessary to comply with law, protect rights or safety, investigate misuse, or evaluate a financing, sale, merger, or reorganization involving the business.

§05 — Transaction boundary

Payments and financing

Card numbers and security codes entered into Stripe-provided fields go to Stripe and are not stored by the Bottomline Thermals application. We receive the transaction identifier, amount, status, payment method category, and limited details needed to complete, support, reconcile, refund, or dispute an order.

If a Klarna option is offered and you select it, contact, billing, shipping, and order information is sent to Klarna. Any additional information you enter in Klarna’s interface is handled under its own terms and privacy notice. Klarna determines eligibility and available terms. An integration or mention here does not guarantee financing availability. Historical payment records may also identify a provider used for an earlier transaction.

§06 — Device record

Browser storage, cookies, and tracking

We use browser storage to keep carts, PC configurations, saved builds, checkout progress, and interface state on your device. In the current checkout, this may include contact, billing, and delivery details entered to preserve progress. That information can remain after you close the browser until the site overwrites or removes it, the browser clears it, or you clear site data. Clear it before leaving a shared device.

A first-party visitor identifier may be stored in local storage and a cookie when a feature needs it; if you later submit contact details, the identifier may be linked to that request. The local-storage copy has no application-enforced expiry, while the cookie may last up to one year. Short-lived session storage may hold cart-editing state. A persistent first-party visitor profile can store an identifier, email address, name, phone number, and SMS-choice state without an application-enforced expiry. An approved storefront rollout may use a secure, HttpOnly, SameSite=Lax cohort cookie for up to 30 days. It contains a stable random browser-cohort value, expiry, and signature, but no direct name, email, account, cart, or route data.

When advertising measurement is on, a secure, HttpOnly, first-party cookie holds a random measurement identifier for up to 180 days. It is set when measurement starts or when you opt out, and it connects your events and holds your choice. If you arrive from one of our Facebook or Instagram ads, we may store the click identifier from the link with your IP address and user agent. We also store your user agent when you submit a request or start checkout.

Stripe, Klarna when available, and Cloudflare Turnstile may use provider-controlled cookies or storage only on routes where their service is required. Their notices describe their technologies. General Google analytics tags, Meta and TikTok advertising pixels, tag-manager containers, and session replay are disabled. Cloudflare Web Analytics, when on, stores nothing in your browser.

§07 — Permission

Messages, marketing, and consent

• Transactional and requested messages include order, payment, delivery, support, custom-build, consultation, and one-time “email my build” communications.
• Email marketing requires a separate email-marketing choice, with one exception: customers who ordered before we began collecting that choice may receive marketing email at their billing email address unless they have opted out. Otherwise, identification, an order, or a service request is not marketing consent. Marketing email includes a way to unsubscribe, either a link that works directly or an email to us that we act on by hand; necessary order and service messages can continue afterward.
• Advertising audience matching is disclosed on the custom-PC request form when enabled. Submitting that form with the notice may make your email eligible unless you opt out, send a Global Privacy Control signal, or previously opted out. It does not subscribe you to email marketing, and it is separate from a reply to your request and a purchase. Use the form’s advertising opt-out control, the opt-out link in your request acknowledgment email, or contact us. Opting out does not affect service. Withdrawal stops eligibility for new audience additions, and our synchronization process requests removal of previously managed membership. Removal can take time to process and does not prevent ads shown for other reasons.
• Email subscriber lists are described under Meta. Unsubscribing from marketing email keeps you out of later uploads, but it does not remove you from a list already uploaded. To be removed from one, email us with “Privacy Request” and the address on our list. We make that removal by hand in Meta on request, so it is not automatic and can take time. Advertising audience opt-outs and Global Privacy Control do not reach these lists. Removal does not prevent ads shown for other reasons.
• Advertising measurement is covered by the measurement notice and is separate from email marketing and advertising audience matching. These choices do not cover Cloudflare Web Analytics. When it is on, you can use the Opt out of measurement button in Advertising measurement preferences on this page. The button also appears on our main pages, our contact and custom-PC request pages, our quiz, and your cart. It does not appear at checkout, but checkout links here and a choice you already made still applies there. Your opt-out is kept in a cookie in that browser for 180 days from when you opt out. It ends sooner if you clear cookies, and it does not carry to another browser, so you would need to opt out again. A Global Privacy Control signal also turns measurement off. To stop events about a Facebook or Instagram lead, contact us with “Privacy Request” and the email address you used on the form, or use an opt-out link in one of our emails. That also stops advertising audience matching through our audience service for that address. Opting out does not affect service. It stops new events and keeps queued events from being sent, but it does not recall events Meta already received.
• Cart-recovery messages require the authority appropriate to that channel. A saved cart or email address alone does not authorize a marketing campaign.
• Automated cart-recovery texts may be sent through Twilio when the optional service is configured and a separate, purpose-specific SMS choice is recorded with a phone number. Consent is not a condition of purchase. Message frequency varies; message and data rates may apply. Reply STOP to the sending number or contact us to opt out.

We may retain the existing notice, consent, and suppression record after withdrawal so that we do not restart the message type you stopped and can document the choice. That record can include the email address, consent and withdrawal status, dates, source page or referrer, IP address, user agent, profile linkage, and unsubscribe token.

§08 — Link custody

Saved builds, recovery links, and showcases

Builds saved on your device stay in that browser until you or the browser removes them. The legacy public saved-build list, create, read, email, raw-ID, and edit routes are unavailable and return the same generic gone response without caching. That retirement does not itself delete existing database rows or establish a deletion date. Browser-local saves remain device features, not a private customer account or cloud backup.

A cart-recovery link is intended to expire after 30 days. Expiry stops the link from restoring the cart but does not necessarily delete the related operational record that same day. A working build-tracker or receipt link may display customer, delivery, order, or build information to someone who has the link. Treat these links as private and send them only to people you trust.

With the customer’s permission, a completed build, photo, review, the name or display name supplied for publication, general location, order date, or selected progress details may appear in a customer-build gallery or featured build record. Contact us to question or withdraw a display permission; legal or operational records may still remain where required.

§09 — Retention

How long we keep information

We do not currently have one application-enforced deletion schedule covering every category. Retention varies by the record and provider, and some records can remain until manually deleted, overwritten, or removed under a provider schedule. We use the following criteria rather than promising one period for every record:

Orders and payments

Fulfillment, delivery, returns, warranty, tax, accounting, fraud, chargeback, and legal-claim needs.

Requests and support

Time needed to answer, document the work, prevent duplicate requests, and meet business or legal duties.

Consent and suppression

Time needed to prove a choice and continue honoring a withdrawal. For advertising audiences, this includes membership and delivery records needed to reconcile additions and removals.

Advertising measurement

When advertising measurement is on, we delete a Facebook click identifier and the IP address stored with it 90 days after the click, and a stored user agent 90 days after it was last recorded. We remove identifiers from our records of each event seven days after the event, or sooner if you opt out. The record that an event happened, including any order or inquiry reference and value, stays with our business records. Website opt-out records hold a random identifier and no contact details, and we keep them to honor your choice.

Recovery, visitor, and security records

The requested recovery life, abuse prevention, debugging, security, and dispute needs. A link expiry is not a deletion promise.

Browser-stored information

Until the site removes or overwrites it, an applicable expiry runs, or you or the browser clear it.

Backups and provider logs

Until overwritten under applicable backup, security, and provider schedules; access remains limited to the relevant purpose.

Contact us to request deletion. We consider applicable rights and legal exceptions; order, tax, warranty, dispute, security, and suppression records may need to remain. A request or link expiry does not automatically erase every record or provider backup.

§10 — Safeguards

How we protect information

We use reasonable administrative, technical, and organizational safeguards designed for the nature of the information we handle. These include access restrictions, secure transport, provider boundaries, response protections, and review of sensitive changes. No internet transmission, browser, provider, or storage system is completely secure.

You can reduce risk by protecting your device and email, clearing site data on shared devices, keeping private order and build links private, and contacting us promptly if a link or transaction appears to be misused.

§11 — Customer control

Your choices and privacy rights

Depending on where you live, which laws apply to our business, and legal exceptions, you may have rights to request confirmation, access, correction, deletion, or a portable copy of personal information; opt out of a sale, targeted advertising, or certain profiling; or limit certain uses of sensitive personal information. You may also appeal a denied request and exercise applicable rights without unlawful discrimination.

Email support@blthermals.com with “Privacy Request,” or use our support form. To appeal a denial where that right applies, reply with “Privacy Appeal.” We will verify only what is reasonably necessary, may recognize an authorized agent where required, and will respond within the time required by applicable law.

Browser privacy signals

A Global Privacy Control (GPC) signal prevents advertising-audience eligibility from a custom-PC request submission. When that request is successfully submitted, the signal also withdraws previously enabled audience matching for the submitted email. You can also use an existing opt-out link or contact us to request removal from the audience we manage. A GPC signal does not reach email subscriber lists, which we handle by hand. When advertising measurement is on, a GPC signal also turns it off for that browser, and we do not set a measurement cookie if you do not already have one. A GPC signal does not stop Cloudflare Web Analytics. Browser advertising pixels remain disabled. A browser signal cannot reach a form you submit on Facebook or Instagram, so use the lead opt-out described above for those forms. Legacy “Do Not Track” signals do not express a standardized choice, so we do not respond to them differently.

§12 — Age boundary

Children's privacy

The storefront is a general-audience service and is not directed to children under 13. We do not knowingly collect personal information online from a child under 13. If we learn that we have done so, we will delete it or otherwise comply with applicable law. A parent or guardian may contact us using the methods below about a child’s information.

§13 — Planned capability

Future customer accounts

Customer accounts are not available today; the staff sign-in is not a customer account. Any future account feature would need its own current disclosures. Except as described under Messages, marketing, and consent, an existing order, saved build, or request does not by itself authorize marketing emails.

§14 — Revision control

Changes to this policy

We will post changes on this page and update the effective or last-reviewed date. If a change materially affects how previously collected information is used, we will provide additional notice or obtain consent when required. An archived or requested copy can be identified by the policy version shown at the top of this page.

§15 — Accountable contact

Contact Bottomline Thermals

Questions, privacy requests, appeals, and concerns about a data practice can be sent to:

If what this policy says differs from what you observe, tell us. Michael Giblin is the accountable policy owner and will investigate the discrepancy.