Privacy Policy

Effective October 20, 2026.

Catalog browsing and private owner access

You can browse the public catalog without creating a customer account. Online contact forms remain disabled. A product shown in the catalog is not a completed purchase or reservation.

The site is delivered through Cloudflare. Standard connection information, including your IP address, browser information and request timing, is processed to deliver pages and protect the service. Application security checks also use limited records and identifiers derived from connection information.

The product dashboard requires an authorized owner sign-in. The public catalog does not provide guest product-editing access. Product descriptions, published maker codes and photos are intended for the public catalog. Do not enter customer contacts, payment details, supplier information or other private information in public catalog fields or product photos.

Authorized owners use a private setup process to choose a passphrase, then sign in. Setup does not sign the owner in automatically. This processes the owner's name, email, protected passphrase record, session and security information. Owner setup is not public customer registration.

You can contact William directly by phone, text or email. Your phone or email provider and the provider receiving that message process the information you choose to send. Purchases made after following a Whatnot link take place under Whatnot's own terms and privacy practices.

Scope of the direct-store policy

The remaining sections describe the direct SGT Diecast store. This policy covers information handled through sgtdiecast.com and direct support about its orders. It does not replace the policies of Stripe, Whatnot, your bank, your carrier or another independently operated service.

Information the direct store uses

• Order and contact information: your name, email address, shipping address and phone number if supplied, together with the products, quantities, prices, discounts, shipping charges, tax, payment status, tracking, cancellations and refunds associated with your order.
• Preorder records: the selected pieces and quantities, agreed prices and shipping rule, expected ship-by dates, the agreement you accepted, its version and acceptance time, and records of later notices and your responses.
• Availability requests: the email address you enter to be told when a listed piece opens for preorder, and the piece you asked about.
• Payment references: Stripe customer, payment, saved-payment-method and refund references, plus limited card information such as brand, last four digits and expiration information when available. Full card numbers and security codes are entered in Stripe's hosted payment interface, rather than SGT's product or support forms.
• Support information: what you include when asking a question or reporting an order problem, including an order number, correspondence and relevant photos you choose to provide.
• Technical and security information: connection and browser details, session records, sign-in or verification events, request timing and limited fraud-prevention or abuse-prevention records.
• Owner administration: authorized staff identity, protected authentication information and records of changes made in the back office. Public product information and private owner records have different access controls.

Do not send a full card number, card security code, passphrase or private order-management link by email or text. We ask only for information reasonably needed to identify and resolve your request.

Why the direct store uses it

We use this information to review and fulfill orders, reserve and allocate preorders, record the agreement you accepted, process authorized payments and refunds, calculate applicable tax, arrange shipping, provide order-status and tracking information, and answer support requests. We also use limited records to protect accounts, investigate suspected misuse, reconcile payment events, resolve disputes and meet applicable recordkeeping obligations.

A preorder's saved card is used only for the preorders covered by its agreement. It does not create a subscription, an open-ended authorization for unrelated purchases or permission to add a new product to an existing agreement.

Stripe and saved cards

Stripe processes card entry and payments. For a preorder-only reservation, the flow saves the payment method without charging for the preorder at that time. Later charges follow the specific agreement: once per shipment, only after the pieces physically arrive at SGT Diecast and William confirms the charge.

The store retains the payment references and limited card details needed to manage that agreement. Updating a saved card takes place through Stripe's hosted interface. Your bank or Stripe may require additional verification. You do not need to create a separate Stripe consumer account merely to use the store's card checkout. Stripe's own handling of payment information is described in its Privacy Policy.

Cookies and browser storage

Necessary session cookies support authenticated owner access. The direct store also uses necessary security and order-management protections. Blocking these can prevent sign-in or other protected functions.

The storefront code can remember a cart's product identifiers and quantities in your browser's local storage. The opening animation also remembers, for the current browser session, that it has played. These browser notes are separate from a completed order or accepted preorder. Clearing a cart or browser storage does not cancel an order or reservation that has already been confirmed.

This policy does not introduce advertising cookies, an analytics service or a marketing-consent mechanism. Any future analytics, advertising or additional bot-verification tool needs an accurate notice before use, including any choice or consent required for that use.

Owner sign-in, checkout and availability requests may use Cloudflare Turnstile when configured. If the verification widget is shown, it sends a verification token and, when available, your IP address to Cloudflare.

Who receives information

Information is shared with service providers only as needed for the relevant function. This includes Cloudflare for hosting, storage, delivery, email and security; Stripe for payments, saved-card processing and any configured tax calculation; and carriers or fulfillment services when a shipment is arranged. We may also need to provide relevant records to professional advisers, a payment provider handling a dispute, or a public authority where a lawful requirement applies.

Cloudflare describes its practices in its Privacy Policy. Following an external link starts a relationship with that service under its own policies. A Whatnot order is handled on Whatnot, not transferred into this site's checkout simply because the sites link to each other.

Business policy: SGT Diecast does not sell or rent customer lists, or share customer information for cross-context advertising.

Order messages and marketing

Service messages include confirmations, preorder delays and choices, card-update or failed-payment requests, shipping updates, cancellations and refunds. These messages relate to a transaction or a request you made. The policy does not enroll you in a newsletter or authorize unrelated promotional messages.

Any later optional marketing program needs a separate explanation and the appropriate choice or consent. Marketing subscriptions are not offered. Customer order emails, availability emails and requested owner account-recovery messages use Cloudflare email.

How long records are kept

Retention policy: we retain completed direct-store order records and their accepted agreements for five years after the order is completed or canceled, then remove or deidentify information that is no longer needed. A longer period may be needed for an unresolved dispute, fraud investigation, legal claim or an applicable legal obligation. Routine technical records are kept for shorter periods appropriate to their purpose.

The five-year period is a business policy, not a statement that the FTC requires every store to keep records for five years. It is also not a claim that an automatic five-year deletion schedule is configured today.

Your questions and choices

You may contact us to ask what information we hold about you, request a copy, correct inaccurate information or request deletion. We verify the request in a way proportionate to its sensitivity, explain any information we must retain and respond under any applicable requirements. We do not ask you to send a full card number or passphrase to make a privacy request.

You can control browser storage through your browser and decide whether to follow external links or provide optional support material. If you need to cancel a preorder, use its private management link or contact us; a privacy request or clearing browser storage is not a substitute for an order-cancellation request.

The direct store is not designed as a service for children. If you believe a child has supplied personal information through the site, contact us so we can review it.

Security and processing locations

We use reasonable access restrictions, protected authentication and appropriate service-provider safeguards. No website, message or storage system can be guaranteed completely secure. Keep owner credentials and private order, payment and management links confidential.

Service providers may process information in locations other than where you live, including outside your state or country. This policy does not promise that every provider keeps all information in one location or certify a particular international-transfer arrangement.

Changes to this policy

This policy identifies its effective date and is updated when relevant practices change. Material changes receive the notice or choice required for the change. A privacy-policy update does not silently change an existing preorder's saved prices or card-charge authorization.

Contact SGT Diecast

Email sgtdiecast@gmail.com, or call or text (203) 994-0877. Identify the order or request without sending card numbers, security codes, passphrases or private access links.

Related policies: Terms, Shipping and Returns, and Preorders.