Privacy Policy

Effective date: September 01, 2026

Heritage Leather & Hardware is operated by Heritage Leather & Hardware LLC, located at 9056 Long Point Road, Houston, Texas 77055. This Privacy Policy explains what information we collect when you use our website, place an order, or contact us, how we use it, who we share it with, and the choices available to you.

Information you provide when you submit an order request. An order request is not a purchase and no payment is collected. When you submit one, we collect your name, email address, phone number if you provide one, the items and quantities you are asking about, and any shipping or recipient details you include so that we can confirm availability, pricing, and total cost with you.

Information you provide at checkout. When you place an order, we collect your name, email address, phone number if you provide one, and your billing and shipping addresses. Payment card details are entered directly on a payment page hosted by our payment processor. Your full card number never passes through, and is never stored on, Heritage systems. We receive only a confirmation of the transaction along with limited details such as the card brand, the last four digits, and a payment reference.

Information associated with a customer account. Creating an account is optional. If you create one, you sign in with a one-time code sent to your email address rather than a password, so we never hold a password for you. Your account stores your email address, your order history, and any shipping addresses or saved recipients you choose to keep for reuse.

Information you provide when you contact us. If you call us or email us, we collect the information in your message along with the contact details you supply, and we keep enough of that exchange to handle your question and any follow-up.

Information collected automatically. Our hosting and security infrastructure records standard technical information such as IP address, browser type, and the pages requested. This is used to operate the site, diagnose errors, and protect against abuse. We do not use analytics, advertising, tracking pixels, or third-party marketing tools on this site.

Information about a recipient who is not you. Many of our customers order on behalf of someone else, including people incarcerated in Texas Department of Criminal Justice facilities. If you place such an order, you provide information about that recipient, which may include their full name, their TDCJ or other identification number, the facility name, the housing unit, and other delivery-routing details.

We use recipient information only for the following purposes: validating whether an order is eligible to be sent to the chosen facility, fulfilling and packing the order, meeting the facility's own mail and package requirements, routing the delivery correctly, responding to customer-service questions about the order, protecting against fraud and misuse, and maintaining records we are required or reasonably need to keep.

Please understand that when you give us another person's information, you are providing it on their behalf. That person does not visit our website, does not create an account with us, and has not agreed to this Privacy Policy. We rely on you to have a proper basis for sharing their details with us, and we ask that you provide only what is needed to deliver the order. We do not use recipient information to market to the recipient, and we do not sell it.

How we use your information. We use the information described above to respond to order requests, to process and fulfill orders, to arrange shipping and provide tracking, to send transactional messages about your order or your account, to answer your questions, to prevent and investigate fraud and abuse, to maintain accurate financial and tax records, and to meet our legal obligations.

Email we send you. We use email only for transactional and service messages: order-request acknowledgements, order confirmations, shipping and tracking notices, return and refund updates, cancellation notices, account sign-in codes, and replies to messages you send us. We do not operate a marketing or promotional email program, and we do not send newsletters or promotional campaigns.

Service providers we rely on. We share information with a small number of service providers, only to the extent each needs it to perform its function for us. Each is a separate company with its own privacy practices, and we encourage you to review theirs.

Stripe processes payments. Card details are entered on a page hosted by Stripe and are handled by Stripe rather than by us. Stripe receives the payment amount, the information needed to process and secure the transaction, and your email address for the receipt.

Shippo is used to calculate shipping rates, purchase postage, and produce shipping labels and tracking. Shippo receives the delivery name and address, the package details, and the carrier selection needed to produce a label.

Resend delivers our transactional email. Resend receives the recipient email address and the contents of the message being sent, such as an order confirmation or a shipping notice.

Supabase provides our database, authentication, and file storage. Customer, order, account, and recipient records described in this policy are stored in that infrastructure.

Amazon Web Services hosts the website itself and the systems that run it.

We may also share information with professional advisors such as accountants and attorneys, and with government authorities, courts, or law enforcement where we are required to do so by law or legal process, or where we reasonably believe it is necessary to protect our rights, our customers, or the safety of others. If our business is ever sold or reorganized, customer information may transfer as part of that transaction.

We do not sell your personal information, and we do not rent, trade, or share it with third parties for their own marketing purposes.

We use only the cookies needed to make the site work. One cookie links your shopping cart to your browser so your cart persists between pages and visits. A second set of cookies is used by our authentication provider to keep you signed in to your account. We do not use advertising cookies, analytics cookies, or third-party tracking cookies, and we do not track you across other websites. Because we use only strictly functional cookies, we do not display a cookie-consent banner. You can block or delete cookies in your browser settings, but the cart and sign-in features will not work correctly without them.

We do not set a single fixed deletion date for all information. We keep information for as long as it is reasonably necessary for the purposes described in this policy, including fulfilling your order, providing customer service, protecting the security of our systems and preventing fraud, maintaining financial and tax records, meeting audit obligations, complying with the law, resolving disputes, and enforcing our agreements. How long that is depends on the type of record and the obligation attached to it.

Some records cannot be deleted on request. Certain transaction records, payment references, fulfillment and shipping records, security records, tax and financial records, and records in our append-only audit log are retained because we are required to keep them, because they document a completed transaction, or because the system that holds them is designed so that entries cannot be altered or removed once written. Deleting them is not possible for us, and we want to be straightforward about that rather than promise otherwise.

You may contact Heritage Leather & Hardware to request access to, correction of, or deletion of eligible personal information. We will evaluate the request and may retain transaction, payment-reference, fulfillment, security, tax, legal, and append-only audit records where retention is reasonably necessary or legally required. We will tell you what we are able to do and what we are not.

Please note that depending on where you live, you may have additional rights under state or other applicable law. If you believe you have such a right, contact us and tell us what you are asking for, and we will respond as that law requires.

Security. We use reasonable administrative and technical measures to protect the information we hold, including handling card payments entirely through our payment processor so that card numbers do not reach our systems. No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security.

Children. This site is intended for adults. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will take appropriate steps.

Changes to this policy. We may update this policy from time to time. When we do, we will revise the effective date at the top. Material changes will be reflected on this page, and continuing to use the site or place orders after an update means the updated policy applies.

Contacting us about privacy. For any question or request about this policy or your information, contact us at info@heritageleatherandhardware.com, by phone at 832-844-0484, or by mail at Heritage Leather & Hardware LLC, 9056 Long Point Road, Houston, Texas 77055. Please tell us what you are asking for so we can route it correctly.