Last updated: October 6, 2026
C&Rsenal, registered in the State of South Carolina (“we”, “us”, “our”), operates the [campaign.candrsenal.com](http://campaign.candrsenal.com) website. This policy explains what data we collect, why we collect it, and what rights you have over it.
We collect the minimum data needed to fulfill orders. We don’t sell it, and we don’t use it for advertising.
1. Information We Collect
Account Information. When you create an account, we collect your first name, last name, email address, and optionally your organization name. Your password is stored only as a secure one-way hash, so we cannot read it.
Order & Shipping Information. When you place an order, we collect your billing and shipping address, your phone number if you provide one, the items ordered, and your order history. We need this to process, ship, and support your purchases, and to meet our tax and accounting obligations.
Payment Information. Card payments are processed by Authorize.net. Your card details go directly to Authorize.net for processing, and we do not store full card numbers on our servers.
Usage Data. We log page views on the website, including the page path, your IP address, browser user agent, referrer, and timestamp. We use this for basic first-party traffic analytics. We do not run third-party analytics, tracking, or advertising scripts. The only third-party script we load is Google reCAPTCHA on forms, used solely for spam and abuse prevention (see Section 4).
We also perform geographic lookups on IP addresses using a local database to identify approximate location and hosting provider. That data is cached on our own servers, and no third-party geolocation services are contacted.
Contact & Submissions. When you submit a contact form, bug report, or feature request, we collect your name, email, the content of your submission, and your IP address. These submissions are delivered to us by email rather than kept in the site’s database.
Launch Notifications. While the store is in its pre-launch phase, if you enter your email address to be notified when we go live, we use that address only to send you that notification. We do not use it for other marketing.
Login History. We record login timestamps and IP addresses to detect unauthorized access and enforce rate limits.
2. How We Use Your Data
We use your data to authenticate your account, bill you, and ship and deliver your purchases. We use it to process payments and issue receipts, and to respond to your contact messages, bug reports, and feature requests. We use it for security, including rate limiting, login monitoring, and fraud prevention. We use aggregate page-view data to understand which pages are visited, without building individual profiles. And we use your email to send transactional messages such as account verification, password resets, and order and shipping confirmations, along with any newsletters you have opted into.
We do not sell, rent, or share your personal data with third parties for marketing purposes.
3. Cookies & Sessions
We use functional cookies to run the store and keep you logged in, plus one third-party security cookie from Google reCAPTCHA. We do not use analytics, advertising, or cross-site tracking cookies.
WordPress sets login cookies (`wordpress_logged_in_*`, `wp-settings-*`) that keep you logged into your account and remember your preferences. WooCommerce sets cart and session cookies (`woocommerce_cart_hash`, `woocommerce_items_in_cart`, `wp_woocommerce_session_*`) that remember your shopping cart and checkout session; these are essential to the store working. Google sets a reCAPTCHA cookie (`_GRECAPTCHA`) on pages with protected forms to tell humans from bots; this is a third-party cookie used only for security (see Section 4).
4. Third-Party Services
We share data with the following third parties, each of which operates under its own privacy practices.
Authorize.net handles payment processing and receives your billing details and card data when you place an order. See their [privacy policy](https://www.authorize.net/about-us/privacy.html).
Our merchandise is produced and shipped by third-party fulfillment partners, including Schneider General Media. When you place an order, your name, shipping address, and email are shared with the relevant partner solely to produce and deliver that order.
Our transactional email, such as account verification, password resets, and order and shipping confirmations, is delivered through Google (Gmail / Google Workspace). Google receives the recipient’s email address and the content of the message in order to deliver it, and handles that data under its [privacy policy](https://policies.google.com/privacy).
Google reCAPTCHA provides spam and abuse prevention on our forms. Google may collect usage data and set a cookie under its [privacy policy](https://policies.google.com/privacy).
5. Data Storage & Security
The website is served exclusively over HTTPS, with HSTS enforced. Passwords are stored only as secure one-way hashes, never in plain text. Access to admin functions requires authentication with WordPress role-based permissions. IP addresses that engage in automated vulnerability scanning or other malicious activity may be automatically blocked from the site.
In keeping with the South Carolina data breach notification law (S.C. Code Ann. § 39-1-90), if we discover a breach involving personal information we will notify affected residents, and the relevant authorities where required, in the most expedient time possible and without unreasonable delay.
6. Data Retention
We keep your account data for as long as your account is active and delete it on request, except for order records we are required to retain. Order records are kept as long as needed to meet tax, accounting, and legal obligations, even after an account is closed. Page-view logs are kept for aggregate analytics, though the IP addresses in them can be purged on request. Login history is kept for security auditing, and login rate-limit records are purged automatically after fifteen minutes. Session cookies expire at the end of your session, and persistent login cookies expire per WordPress defaults. Contact submissions are kept until resolved and for a reasonable period afterward.
7. Your Rights
Regardless of where you live, you can ask us for a copy of the personal data we hold about you, ask us to correct inaccurate information, ask us to delete your account and associated data (apart from records we must keep for legal or tax reasons), ask for your data in a portable format, and object to specific uses of your data.
To exercise any of these rights, email us at info@candrsenal.com or use our [contact form](https://candrsenal.com/contact/). We will respond within 30 days.
EU/EEA & UK residents (GDPR / UK GDPR). We process your data on three lawful bases: contract performance, to fulfill the order you placed; legitimate interest, for security, fraud prevention, and basic analytics; and consent, for optional communications such as newsletters, which you can withdraw at any time. Goods shipped internationally are sent DAP (Delivered At Place), so customs and import data may be shared with carriers and customs authorities as needed to deliver your order.
California residents (CCPA/CPRA). We do not sell or share personal information as defined under the California Consumer Privacy Act, and we do not share personal information for cross-context behavioral advertising. You have the right to know what data we collect, to request deletion, and not to be discriminated against for exercising your rights.
8. Children
C&Rsenal is not directed at children under 16, and we do not knowingly collect personal information from anyone under 16. If we learn that we have collected data from a child under 16, we will delete it promptly.
9. Changes to This Policy
We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. For significant changes, we will notify registered users by email.
10. Contact
Questions about this privacy policy or your data? Email us at info@candrsenal.com or use our [contact form](https://candrsenal.com/contact/).