Privacy policy

Privacy Policy

Effective Date: October 13, 2026

Policy Version: 2026-10-13.2

About this update: We clarified that optional services may run by default and that you can change your browser preferences on our Your Privacy Choices page. The informational privacy notice links to those choices; closing the notice does not change your settings.

October 7, 2026 update: This version follows a review of our website completed in October 2026. On October 7, 2026, we removed the third-party advertising and analytics tags that previously loaded on our website (Google Tag Manager, the Meta Pixel, Google Ads tags, Google Analytics, and Microsoft Advertising tags). We added a Your Privacy Choices page where you decide which optional services load on our website. We now describe our own first-party site tracking, which runs for every visitor, and the purchase reporting we send to the advertising platforms we buy ads from, including how to opt out of that reporting. We replaced the separate California and New Hampshire sections with one state privacy rights section covering residents of every state with a comprehensive privacy law, with California, Rhode Island, and Texas addenda. We added a retention schedule and a list of the companies that process personal information for us. Earlier updates covering customer-service recordings and transcripts, AI assistance, and the website chat consent step are unchanged.

This Privacy Policy describes how North Country Fire collects, uses, shares, retains, and protects personal information when you visit our website, contact us, create an account, submit a form, place an order, request support, submit a damage claim, request a return, participate in a payment dispute, or otherwise interact with us.

North Country Fire is operated by Apolaustic Inc. For purposes of this Privacy Policy, “North Country Fire,” “we,” “our,” and “us” mean Apolaustic Inc. operating North Country Fire.

North Country Fire
Apolaustic Inc.
PO Box 2342
North Conway, NH 03860

This Privacy Policy applies to www.northcountryfire.com and to information collected through our website, checkout, customer-service channels, forms, emails, chats, phone calls, order-processing systems, payment-processing systems, shipping systems, fraud-screening tools, damage-claim processes, return processes, warranty-support processes, and related business operations. The current version is always available at https://www.northcountryfire.com/policies/privacy-policy.

Summary

This summary is provided for convenience only. The full Privacy Policy below controls.

  • We collect information you provide directly to us, such as your name, email address, phone number, billing address, shipping address, order details, support messages, claim information, return information, and photos you submit.
  • Our own tracking script runs for every visitor on every page. It sends site-interaction, device, browser, and network signals, including signals we use for fraud screening, to our own systems; it sets two first-party identifiers in your browser; and it records advertising click identifiers from the web address you arrived on. This first-party tracking is not controlled by the on-site cookie choices. Shopify, our ecommerce platform, also runs its own platform analytics.
  • No third-party advertising pixels load on our website. CallRail call tracking, the Affirm financing widget, the Trustpilot reviews widget, the Google Customer Reviews badge, and Calendly scheduling follow your current browser preferences. You can change these on our Your Privacy Choices page or in Shopify’s cookie banner where it appears. Optional services may run by default.
  • We report purchases to the advertising platforms we buy ads from (Google Ads, Microsoft Advertising, and OpenAI Ads) by uploading conversion data, including click identifiers and hashed contact details, from our own systems. Under California and some other state privacy laws this reporting is a “sale” or “sharing” of personal information. The on-site cookie choices and Global Privacy Control do not stop it. To opt out, email support@northcountryfire.com with the subject “Opt out of advertising reporting”; no identity verification is required.
  • We use information to process orders, arrange shipping, communicate with customers, process payments, screen for fraud, handle damage claims, process returns, support warranty claims, respond to chargebacks, recover unpaid amounts, measure our advertising, comply with legal obligations, and improve our website.
  • We share information with service providers that work for us under written contracts, including Shopify, payment processors, fraud-screening tools, carriers, manufacturers, warehouses, distribution partners, communications and AI providers, attorneys, collection agencies, and insurers, and with courts, law enforcement, and other parties when the law requires or permits it.
  • We record and store customer-service chats and record or transcribe other communications with the notice and consent required for that channel. We use service providers, including cloud and artificial intelligence (AI) providers, to process communications and assist our team. See “Conversations, Recordings, and AI Assistance” below.
  • We do not intentionally store full credit card numbers on our own systems.
  • Depending on where you live, you have rights to access, correct, delete, and obtain a copy of your personal information, to opt out of its sale, sharing, use for targeted advertising, and profiling, and to appeal our decision on a request. Opt-outs never require an account or identity verification.

Information We Collect

We collect personal information that you provide directly to us, information generated when you use our website, information related to orders and transactions, and information provided to us by service providers, payment processors, fraud-prevention tools, carriers, manufacturers, warehouses, distribution partners, and other parties involved in processing orders, delivering products, resolving claims, preventing fraud, recovering unpaid amounts, and enforcing our policies.

The types of information we collect fall into the categories below.

Contact Information

  • Name;
  • Email address;
  • Phone number;
  • Billing address;
  • Shipping address;
  • Business name, if applicable;
  • Account username or customer account details, if applicable;
  • Account login credentials, if you create a customer account. Your password is held by Shopify, our ecommerce platform, and is never visible to us.

Order and Transaction Information

  • Products purchased or attempted to be purchased;
  • Order number;
  • Order date;
  • Purchase amount;
  • Billing details;
  • Shipping details;
  • Discount codes, gift certificates, credits, or promotions used;
  • Order notes;
  • Order status;
  • Fulfillment status;
  • Invoice and receipt information;
  • Quote and draft-order records;
  • Refund, return, cancellation, exchange, and warranty records.

Payment Information

When you make or attempt to make a purchase, payment information is processed by our payment processors. We receive transaction details such as payment status, payment authorization information, billing information, payment method type, limited payment details (such as card brand and the last four digits), fraud-screening information, chargeback information, and payment-processor records.

We do not intentionally store full credit card numbers on our own systems.

Shipping, Delivery, and Fulfillment Information

  • Shipping address;
  • Delivery address;
  • Carrier information;
  • Tracking numbers;
  • PRO numbers;
  • Shipment status;
  • Delivery confirmation;
  • Bill of lading records;
  • Freight delivery receipts;
  • Carrier notes;
  • Warehouse records;
  • Manufacturer records;
  • Distribution partner records;
  • Delivery appointment information;
  • Reconsignment, storage, redelivery, terminal pickup, or accessorial-charge records.

Damage Claim, Return, Warranty, and Support Information

If you contact us for support, submit a damage claim, request a return, request an exchange, request cancellation, submit a warranty claim, or otherwise communicate with us, we collect information including:

  • Order number;
  • Delivery date;
  • Approximate delivery time;
  • Carrier name;
  • Tracking number or PRO number;
  • Photos or videos of shipments, packaging, products, labels, pallets, bills of lading, delivery receipts, damaged items, or installation conditions;
  • Descriptions of damage, missing items, shortages, wrong items, defects, installation issues, or service concerns;
  • Return authorization records;
  • Return inspection records;
  • Warranty claim records;
  • Customer-service communications;
  • Chat messages;
  • Email messages;
  • Form submissions;
  • Phone-call notes and, where recording or transcription is enabled with the required notice and consent, call recordings and transcripts;
  • Chat transcripts, attachments, communication timestamps, participant identifiers, and related service records;
  • AI-generated summaries, classifications, and draft responses derived from communications and relevant customer or order records;
  • Support-ticket records;
  • Scheduling details, if you book a call or appointment with us;
  • Installer, contractor, or service-company information when provided for warranty or technical-support purposes.

Device, Website, and Site-Interaction Information

Our own tracking script, served from cdn.northcountryfire.com, runs on every page of our website for every visitor and sends the information below to our systems at network.northcountryfire.com. It is described in more detail under “Cookies, Pixels, Tags, and Similar Technologies.” Shopify, our ecommerce platform, also collects website and checkout activity through its own platform analytics. The information collected includes:

  • IP address and network information, such as connection type;
  • Browser type, version, language, and settings;
  • Device type, operating system, screen size, and time zone;
  • Referring web address and the page you arrived on, including advertising click identifiers in the web address (gclid, msclkid, fbclid, gbraid, and wbraid) and the CallRail session identifier when one is present;
  • Pages viewed, products viewed, search terms, links clicked, cart activity, checkout activity, and date and time stamps;
  • Interaction and capability signals used for fraud screening, including automation (bot) detection, graphics (WebGL) and sensor capability, and mouse, keyboard, and scroll patterns;
  • Our first-party identifiers (__ncf_uuid and __ncf_ucid) and, when you allow CallRail to load, the identifiers it sets;
  • Shopify cookie identifiers and the web-pixel data collected by Shopify’s platform analytics.

Fraud-Screening, Risk, and Security Information

We collect or receive information used to detect, investigate, or prevent fraud, payment abuse, chargebacks, unauthorized transactions, account misuse, suspicious activity, policy violations, and security incidents. This includes:

  • IP address records;
  • Device records;
  • Site-interaction and device-capability signals collected by our first-party tracking script, including automation detection and input patterns;
  • Billing and shipping address comparisons;
  • AVS/address verification results;
  • Payment authorization records;
  • Fraud-screening scores or flags;
  • Order history;
  • Account history;
  • Chargeback history;
  • Customer communications;
  • Policy-acceptance records;
  • Other risk or verification records.

Policy Acceptance Records

We may collect and retain records of policy displays and, separately, affirmative choices such as checkout acceptance or chat consent. A record that a policy was displayed or available is not, by itself, a record of consent. Depending on the interaction, these records may include:

  • Policy version;
  • Policy URL;
  • Timestamp;
  • Order number;
  • Customer account information;
  • Email address;
  • IP address;
  • Checkout acceptance method;
  • Cart or checkout checkbox records, where applicable;
  • Chat notice version, notice text, acceptance text, consent timestamp, and affirmative choice where recorded for the interaction.

Conversations, Recordings, and AI Assistance

Chat notice and choice. Before our website chat connects, we present a notice and require you to check an unchecked consent box and select Start chat (or Resume chat for an existing conversation). This enables the chat service to receive and process information for the conversation. The chat widget does not load its chat provider software before that choice. This choice applies to chat; it is separate from cookies, advertising preferences, checkout, and marketing subscriptions.

What is recorded. Customer-service chats are recorded and stored as messages or transcripts. Records can include what you and our team send, attachments, contact details, order information, participant identifiers, timestamps, and other information you choose to share. Phone calls or other communications may also be recorded or transcribed when that feature is enabled. Recording a separate call requires the notice and consent applicable to that channel before recording; the website chat checkbox does not authorize it.

Why and how we use communications. We use communications to answer questions, provide product and order support, route requests, prepare summaries and draft responses, review service quality, maintain service records, investigate issues, and handle claims or disputes. AI tools may process communications and relevant customer, order, product, and support records to assist with these tasks. Our staff may review the original records and AI output.

Providers and transfers. Communications and related personal information may be transferred to and processed by our chat, communications, customer-service, hosting, cloud-storage, and AI service providers for these purposes. Providers used in our systems include Twilio for website chat, Google Cloud for storage and AI services, and OpenAI for AI assistance. The providers involved depend on the channel and task. Information may be processed in the United States and other countries where providers operate, as described under “International Users.” Provider processing and retention are subject to the applicable service arrangements and legal requirements.

AI limitations and sensitive information. AI-generated content can be incomplete or incorrect. Ask a team member to confirm important product compatibility, pricing, order, or installation information. Follow the manufacturer's instructions and consult a qualified installer and the relevant local authority for installation and code questions. Do not submit payment-card numbers, passwords, government identification numbers, health information, or other unnecessary sensitive information through chat or support messages. Provide information about other people only when you are authorized to do so.

Your choices. If you do not agree to the chat notice, leave the box unchecked and do not continue. You can contact us at support@northcountryfire.com instead; email is also processed and retained for support under this Privacy Policy and may involve AI assistance. You can stop providing information through chat at any time. To withdraw consent for processing that relies on consent, or request access, correction, or deletion of communications, contact us using the “Contact Us” details below. Withdrawal applies going forward and does not undo prior lawful processing. Closing chat does not delete records already created; retention and applicable legal exceptions are described below.

Separate permissions. Chat consent does not enroll you in promotional emails, marketing texts, or advertising tracking. It is not permission to publish your private support messages or a blanket authorization to use them to train general-purpose AI models. This policy update does not authorize a new, incompatible use of previously collected information; any additional notice or permission required by law must be obtained separately.

Cookies, Pixels, Tags, and Similar Technologies

Cookies are small data files placed on your device. Browser local storage is a similar feature that holds data until you clear it. Log files record actions that occur on a website. Pixels, tags, and web beacons are small pieces of code or images used to record browsing behavior and advertising performance. We use these technologies to operate our website, remember cart and checkout activity, process orders, detect fraud, understand how customers use the website, attribute orders and inquiries to the visit, campaign, or call that led to them, and provide optional features such as call tracking, financing estimates, customer reviews, and appointment scheduling.

First-Party Tracking (Always On)

Our own tracking script, served from cdn.northcountryfire.com, runs for every visitor on every page. It sends site-interaction, device, browser, and network signals to our systems at network.northcountryfire.com, including the signals we use for fraud screening: automation (bot) detection, graphics (WebGL) and sensor capability, and mouse, keyboard, and scroll patterns. It sets the cookie __ncf_uuid and stores the identifier __ncf_ucid in your browser, and it records advertising click identifiers from the web address you arrived on (gclid, msclkid, fbclid, gbraid, and wbraid) and the CallRail session identifier when one is present.

The script sends data only to our own systems. We treat it as strictly necessary for operating the website, screening orders for fraud, and attributing orders and inquiries, so it is not controlled by the choices on our Your Privacy Choices page or by Shopify’s cookie banner, and it runs whether or not your browser sends an opt-out preference signal. We use the click identifiers it records in the purchase reporting described under “Advertising Measurement and Conversion Reporting,” and you can opt out of that reporting by email as described there. You can block or delete our cookies through your browser settings; doing so does not stop the script from running, and it can affect cart, checkout, account, and fraud-screening functions.

Cookie Categories and Your Choices

The services that load on our website fall into four categories. You control the Analytics, Advertising, and Functional categories on our Your Privacy Choices page and, where it appears, in Shopify’s cookie banner. Optional services may run by default. You can change your preferences for this browser on our Your Privacy Choices page.

  • Strictly necessary (always on): Shopify’s cookies for the store, cart, checkout, customer accounts, localization, and security; Shopify’s platform analytics, including Shop Pay; and our first-party tracking described above.
  • Analytics: CallRail call tracking and number swapping. When allowed, CallRail records the source of your visit and the page you landed on, replaces the phone number shown on the website with a tracking number that identifies the campaign or page you came from, and links your call to that visit. The phone number shown in our website header is a CallRail tracking number and appears only when this category is allowed.
  • Advertising cookies and pixels: none are currently loaded. We removed Google Tag Manager, the Meta Pixel, Google Ads tags, Google Analytics, and Microsoft Advertising tags on October 7, 2026. If we add an advertising tag in the future, it will load only when you allow this category, and we will update this Privacy Policy first.
  • Functional: the Affirm financing widget on product pages (monthly payment estimates and prequalification), the Trustpilot reviews widget, the Google Customer Reviews badge, and Calendly scheduling (only on pages with a scheduling embed).

Website chat is controlled separately by the chat notice described under “Conversations, Recordings, and AI Assistance,” not by these categories.

Cookies and Identifiers Used on Our Website

Name Set by Purpose Lifetime Category
__ncf_uuid North Country Fire (cookie on northcountryfire.com) Identifies your browser across visits for website operation, fraud screening, and order and inquiry attribution. 1 year Strictly necessary
__ncf_ucid North Country Fire (browser local storage) Identifies your browser for the same purposes and links a visit to a later order, chat, or inquiry. Until you clear your browser storage Strictly necessary
_shopify_essential, _shopify_analytics, _shopify_marketing, cart_currency, localization, checkout_continuity_service, _shop_app_essential, and other Shopify cookies Shopify Store, cart, checkout, customer accounts, localization, Shop Pay, consent recording, and Shopify platform analytics. Shopify describes each cookie in its own cookie policy. Session to 1 year Strictly necessary
calltrk_session_id, calltrk_referrer, calltrk_landing (cookies) and calltrk-* local storage keys CallRail Records the source and landing page of your visit, swaps the displayed phone number, and links phone calls to the visit. About 6 months (cookies); local storage until you clear it Analytics (loads only when allowed)
__cf_bm, _cfuvid, session, t_v2_s, checkout_continuity_service, and similar cookies on affirm.com Affirm Operates and secures the financing widget and any prequalification session you start. Session to 13 months Functional (loads only when allowed)
Cookies set by trustpilot.com inside the reviews widget Trustpilot Displays and secures the reviews widget. Set by Trustpilot Functional (loads only when allowed)
NID and similar cookies on google.com Google Displays the Google Customer Reviews badge. About 6 months Functional (loads only when allowed)
__cf_bm on calendly.com Calendly Secures the scheduling embed. 30 minutes Functional (loads only when allowed)

You can also control cookies through your browser settings. Disabling cookies can affect website functionality, cart functionality, checkout functionality, account access, and order processing.

How We Use Personal Information

We use personal information for business and operational purposes, including to:

  • Operate our website;
  • Process orders;
  • Process payments;
  • Provide invoices, receipts, and order confirmations;
  • Arrange shipping and delivery;
  • Coordinate with manufacturers, warehouses, distributors, distribution partners, carriers, and service providers;
  • Communicate with customers;
  • Provide customer service;
  • Respond to questions, support requests, and product inquiries;
  • Process damage claims;
  • Process shortage, missing-item, wrong-item, and concealed-damage claims;
  • Process returns, refunds, exchanges, and cancellations;
  • Support manufacturer warranty claims;
  • Investigate delivery issues;
  • Verify delivery, receipt, and claim records;
  • Screen orders for risk, fraud, abuse, or unauthorized activity;
  • Protect our rights, customers, website, systems, and business;
  • Respond to chargebacks, payment disputes, legal claims, subpoenas, and lawful requests;
  • Recover unpaid amounts;
  • Refer unpaid balances to collection agencies, attorneys, payment processors, or other appropriate third parties as permitted by law;
  • Enforce our policies, terms, and agreements;
  • Maintain business, tax, accounting, compliance, and legal records;
  • Attribute orders and inquiries to the visit, campaign, or call that led to them;
  • Measure the performance of our advertising by reporting purchases to the advertising platforms we buy ads from, as described under “Advertising Measurement and Conversion Reporting”;
  • Improve our products, services, website, marketing, and customer experience;
  • Send service-related communications;
  • Send marketing communications where permitted by law and consistent with your preferences;
  • Comply with applicable laws, regulations, legal processes, and card-network or payment-processor requirements.

How We Share Personal Information

We share personal information as reasonably necessary to operate our business, process orders, deliver products, provide customer service, investigate claims, respond to disputes, prevent fraud, recover unpaid amounts, measure our advertising, and enforce our policies.

We share personal information with the following categories of recipients:

  • Shopify, our ecommerce platform, including Shopify Payments and Shop Pay;
  • Payment processors;
  • Card networks;
  • Banks and issuing banks;
  • Fraud-screening and risk-prevention providers;
  • Carriers and freight companies;
  • Manufacturers;
  • Warehouses;
  • Distributors and distribution partners;
  • Fulfillment providers;
  • Email, chat, telephone, transcription, text-messaging, scheduling, and form providers;
  • Cloud-hosting, cloud-storage, and AI service providers that process communications and related records for the support purposes described above;
  • Shipment-tracking providers;
  • CallRail, for call tracking, when you allow it to load;
  • Advertising platforms we buy ads from (Google Ads, Microsoft Advertising, and OpenAI Ads), which receive purchase reporting as described under “Advertising Measurement and Conversion Reporting”;
  • Technology, hosting, security, and website-service providers;
  • Insurers;
  • Accountants, auditors, and tax professionals;
  • Attorneys and legal-service providers;
  • Collection agencies;
  • Courts, arbitrators, mediators, and dispute-resolution providers;
  • Law enforcement, regulators, government agencies, or other parties when required or permitted by law;
  • A buyer or successor if we sell or transfer all or part of our business, subject to this Privacy Policy;
  • Other parties with your consent or at your direction.

We share order records, customer communications, payment records, shipping records, delivery records, photographs, IP address records, device records, fraud-screening records, return records, claim records, warranty records, policy-acceptance records, and related information with payment processors, card networks, banks, carriers, manufacturers, warehouses, distribution partners, insurers, attorneys, collection agencies, courts, law enforcement, and other parties as reasonably necessary to process orders, deliver products, investigate claims, respond to disputes, recover unpaid amounts, prevent fraud, and enforce our policies.

Service providers and processors, including our ecommerce platform and our payment, shipping, chat, telephone, email, text-messaging, scheduling, form, cloud, and AI providers, may use personal information only to perform services for us under written contracts that prohibit them from selling it, using it for their own purposes, or combining it with other data except as permitted by law. The advertising platforms that receive our purchase reporting act as independent businesses; their use of that data is governed by their own policies and by your choices described in this Privacy Policy. Carriers, manufacturers, distributors, payment processors, and financing providers also have their own legal obligations and act as independent businesses for those purposes.

Service Providers, Processors, and Advertising Platforms

The companies below process personal information for us today. “Sale or share” means a sale of personal information or sharing for cross-context behavioral advertising as defined by California and similar state privacy laws.

Company What it does for us Personal information involved Sale or share?
Shopify (including Shopify Payments, Shop Pay, and Shopify Email) Online store, customer accounts, checkout, payment processing, order records, contact form, consent recording, platform analytics, and marketing email. Contact, order, payment, account, website, and consent information. No
Twilio Website chat and telephone services. Chat messages and attachments, phone numbers, call metadata, and call recordings. No
CloudTalk Business phone system, including call recordings and transcripts. Phone numbers, call recordings, transcripts, and call notes. No
Google Cloud Hosting for our systems, data storage, and AI analysis of communications and records. All categories of information we hold. No
OpenAI AI assistance for customer support, such as summaries, classifications, and draft responses. Communications and the customer, order, and product records needed for the task. No
AfterShip Shipment tracking and delivery notifications. Name, email address, phone number, shipping address, tracking numbers, and order details. No
Postscript Text-message marketing for subscribers who opt in. Phone number, name, order information, and subscription status. No
CallRail Call tracking and phone-number swapping on our website; follows your current browser preferences. Visit source and landing page, your phone number when you call, call time and duration, and the visit the call is linked to. No
Affirm Financing estimates and prequalification on product pages; follows your current browser preferences. If you apply for financing, Affirm processes your application as an independent business under its own privacy policy. Device information while the widget loads; the information you give Affirm in an application. No
Trustpilot Displays customer reviews on our website; follows your current browser preferences. Device information while the widget loads. No
Google Customer Reviews Displays our Google seller-rating badge; follows your current browser preferences. Device information while the badge loads. No
Calendly Appointment scheduling on pages with a scheduling embed; follows your current browser preferences. Name, email address, phone number, and appointment details you enter. No
Form provider for our shipping-damage claim form Hosts the damage-claim form and delivers submissions and uploaded photos to us. Contact and order information, claim details, and photos you submit. No
Carriers and freight companies Delivery of orders. Name, address, phone number, email address, and order contents. No
Manufacturers, distributors, and warehouses Fulfillment, drop-shipping, warranty service, technical support, and claims. Name, address, phone number, email address, order contents, claim details, and photos. No
Payment processors and fraud-screening tools Payment authorization, dispute handling, and fraud screening (Shopify Payments, the payment or financing provider you choose at checkout, Shopify’s fraud analysis, and our own fraud screening). Billing details, payment status, IP address, device signals, and order history. No
Attorneys, collection agencies, and insurers Legal claims, unpaid balances, and insured losses. The records relevant to the matter. No
Google Ads (Google LLC), Microsoft Advertising (Microsoft Corporation), and OpenAI Ads (OpenAI) Advertising platforms that receive our purchase reporting (conversion uploads) so we can measure which ads lead to orders. Advertising click identifiers, hashed email address and phone number, purchase date, order value, and an order reference. Yes. Opt out by email as described under “Advertising Measurement and Conversion Reporting.”

Advertising Measurement and Conversion Reporting

We buy advertising on Google Ads, Microsoft Advertising, and OpenAI Ads. To measure which ads lead to purchases, we report purchases to those platforms by uploading conversion data from our own systems after the order is placed. No pixel or tag on our website sends this information; the uploads come from our order records.

Each upload includes the advertising click identifier recorded when you arrived on our website, where one exists (gclid, gbraid, or wbraid for Google; msclkid for Microsoft), hashed (one-way encoded) versions of contact details such as your email address and phone number, the purchase date, the order value, and an order reference. We record the Meta click identifier (fbclid) when it is present, but we do not currently report purchases to Meta.

The platforms use this data to match the purchase to the ad click or to your account on their service, to report our advertising results to us, and to improve their own advertising systems. Under the California Consumer Privacy Act and some other state privacy laws, this reporting is a “sale” of personal information or “sharing” for cross-context behavioral advertising, because the platforms receive personal information and are not limited to acting as our service providers. We receive no money for it, and we do not sell personal information in any other way.

The choices on our Your Privacy Choices page and the Global Privacy Control signal do not stop these uploads, because the uploads come from our systems rather than from your browser. To opt out, email support@northcountryfire.com with the subject line “Opt out of advertising reporting” and list the email addresses and phone numbers you have used with us. We will apply the opt-out within 15 business days without requiring identity verification or an account, and we will exclude your orders from future uploads. We cannot recall data already uploaded, but the opt-out stops further reporting.

You can also manage how these platforms use data about you in their own settings:

Your Privacy Choices and Opt-Out Preference Signals

Your Privacy Choices page. Our Your Privacy Choices page lets you allow or decline the Analytics, Advertising, and Functional services described under “Cookies, Pixels, Tags, and Similar Technologies,” change your choice at any time, and see which services are currently allowed. Your choice is stored in your browser, so it applies to that browser and device; if you use another browser or device, or clear your cookies, make your choice again. We do not require you to create an account or verify your identity to opt out.

Advertising conversion reporting. The choices page and opt-out preference signals control what loads in your browser. They do not stop the purchase reporting we send to advertising platforms from our own systems. To opt out of that reporting, email support@northcountryfire.com with the subject line “Opt out of advertising reporting,” as described under “Advertising Measurement and Conversion Reporting.” We honor that request within 15 business days without identity verification.

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, Shopify records it and we treat it as a request to opt out of advertising cookies and pixels and of the sale or sharing of personal information through our website for that browser. No advertising tags currently load, so the signal changes nothing visible today, but it is recorded and will be honored for any advertising tag we add later. GPC does not reach the conversion reporting we send from our own systems; use the email request above for that.

Do Not Track. We do not respond to browser “Do Not Track” signals, because there is no accepted standard for them.

If you believe your choice or opt-out preference signal was not recognized, contact us using the information in the “Contact Us” section below.

Payment Processing

Payments are processed by third-party payment processors, including Shopify Payments and the payment or financing provider you choose at checkout. We receive payment-related information such as transaction status, authorization status, billing details, payment method type, limited payment details, fraud-screening results, processor records, dispute records, and chargeback records.

We do not intentionally store full credit card numbers on our own systems.

Payment processors act as our service providers when they process your payment for us. They also have their own obligations to card networks, banks, and regulators, and for those purposes they act as independent businesses under their own privacy policies and security practices.

Fraud Screening, Chargebacks, Collections, and Legal Claims

We collect, use, retain, and share personal information to screen for fraud, investigate suspicious activity, respond to chargebacks, defend transactions, process disputes, pursue collection of unpaid amounts, recover merchandise, enforce our policies, and protect our legal rights.

Information used for these purposes includes:

  • Order records;
  • Checkout records;
  • Policy-acceptance records;
  • Payment records;
  • AVS/address verification records;
  • Fraud-screening records;
  • IP address records;
  • Device records;
  • Site-interaction and device-capability signals from our first-party tracking script, including automation detection and mouse, keyboard, and scroll patterns;
  • Account records;
  • Shipment tracking;
  • Delivery confirmation;
  • Bill of lading records;
  • Freight delivery receipts;
  • Carrier notes;
  • Carrier photographs;
  • Warehouse records;
  • Manufacturer records;
  • Distribution partner records;
  • Photos submitted by the customer;
  • Photos submitted by carriers, warehouses, manufacturers, or distribution partners;
  • Return authorization records;
  • Return inspection records;
  • Damage claim records;
  • Warranty claim records;
  • Customer communications;
  • Proof of refund, credit, replacement, repair, part shipment, or other remedy;
  • Records showing compliance or non-compliance with our shipping, delivery, damage reporting, return, cancellation, exchange, payment dispute, chargeback, non-payment, or collections policies.

We submit this information to payment processors, card networks, banks, issuing banks, carriers, manufacturers, warehouses, distribution partners, insurers, attorneys, collection agencies, courts, arbitrators, law enforcement, regulators, or other appropriate parties as reasonably necessary.

Marketing Communications

We use your contact information to send marketing communications, product updates, promotions, or other information about our products and services where permitted by law and consistent with your communication preferences.

Our marketing emails are sent through Shopify Email and contain open and click tracking: a small image and tracked links tell us whether an email was opened and which links were clicked. We use this to measure our campaigns and to stop sending to addresses that do not engage.

You can opt out of marketing emails by using the unsubscribe link in any marketing email or by contacting us. Even if you opt out of marketing communications, we still send transactional or service-related communications, such as order confirmations, shipping updates, return communications, damage-claim communications, warranty communications, payment communications, dispute communications, legal notices, and policy-related communications.

Mobile Messaging

Marketing text messages are sent through Postscript and have their own enrollment and opt-out instructions. Providing a phone number in chat or accepting the chat notice does not enroll you in marketing texts. See the mobile messaging and SMS privacy sections of our Terms of Service, the Messaging Terms, and the Messaging Privacy Policy. Follow the STOP or unsubscribe instructions in the relevant message to opt out.

Your State Privacy Rights

This section applies to residents of states with comprehensive consumer privacy laws, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and to residents of other states as their privacy laws take effect, to the extent those laws apply to North Country Fire. Where your state’s law gives you a right that is not listed here, you have that right too.

Subject to the exceptions in those laws, you have the right to:

  • Confirm whether we process your personal information and access it;
  • Correct inaccurate personal information;
  • Delete personal information you provided or we obtained about you;
  • Obtain a copy of your personal information in a portable and readily usable format;
  • Opt out of the sale of your personal information;
  • Opt out of sharing for cross-context behavioral advertising and of processing for targeted advertising;
  • Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not make such decisions through automated profiling; our fraud screening produces risk signals that our team reviews;
  • Appeal our decision on a request, as described below;
  • Not be discriminated against for exercising these rights. We do not deny goods or services, charge different prices, or provide a different level of service because you exercised a privacy right.

These rights are subject to limitations and exceptions under applicable law. For example, we retain and use information as needed to complete transactions, process orders, provide requested products or services, detect security incidents, prevent fraud, comply with legal obligations, resolve disputes, respond to chargebacks, support warranty claims, maintain business records, collect amounts owed, and enforce our policies and agreements.

The purposes for which we process personal information, the categories we collect and share, the recipients, and how long we keep it are described under “Information We Collect,” “How We Use Personal Information,” “How We Share Personal Information,” “Advertising Measurement and Conversion Reporting,” and “Data Retention.”

Submitting Requests, Verification, Authorized Agents, and Appeals

How to submit a request. Email support@northcountryfire.com with the subject line “Privacy Request,” or write to the mailing address under “Contact Us.” Tell us which right you are exercising, your state of residence, and the email address, phone number, or order number you have used with us so we can find your records. There is no fee for a request. For the conversion-reporting opt-out, use the subject line “Opt out of advertising reporting.”

Opt-out requests. Opt-outs of sale, sharing, targeted advertising, and profiling never require identity verification or an account. We use only the information needed to apply the opt-out, such as the email address or phone number to suppress, and we apply it within 15 business days. Opt-outs made through our Your Privacy Choices page or a Global Privacy Control signal take effect immediately for that browser.

Verification for other requests. For access, correction, deletion, and portability requests, we confirm that the request comes from you, using verification proportionate to the request. For most requests we match two pieces of information you have already given us, such as the email address on file and an order number or billing postal code. For requests involving more sensitive records, such as call recordings, chat transcripts, or payment records, we match three pieces of information or confirm the request from the email address or phone number on file. We do not ask for government identification, payment-card numbers, or passwords to verify a request. If we cannot verify a request, we tell you and explain what is missing.

Timing. We respond to access, correction, deletion, and portability requests within 45 days of receipt. When a request is complex or we have received many at once, we take up to 45 additional days and tell you within the first 45 days.

Authorized agents. You may use an authorized agent to submit a request on your behalf. The agent must provide your signed written permission. For access, correction, deletion, and portability requests, we also ask you to confirm your identity directly with us; for opt-out requests, the written permission is enough.

Appeals. If we decline a request in whole or in part, you may appeal by replying to our decision or by emailing support@northcountryfire.com with the subject line “Privacy Appeal.” We give you a written decision within 45 days of receiving the appeal, explaining the reasons. If we deny the appeal, our decision includes how to contact your state’s Attorney General to submit a complaint. California residents may contact the California Privacy Protection Agency or the California Attorney General.

California Addendum

This addendum applies to California residents and supplements the rights above under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA). Together with the rest of this Privacy Policy, it serves as our notice at collection.

Categories of personal information collected in the past 12 months. For each category, the table lists examples, the sources, the business purposes, and whether we sold or shared it. The retention period for each category is set out under “Data Retention.”

Category Examples Sources Business purposes Sold or shared?
Identifiers Name, postal address, email address, phone number, account username, IP address, our first-party identifiers (__ncf_uuid and __ncf_ucid), Shopify cookie identifiers, and advertising click identifiers. You; your device and browser through our first-party script and Shopify; carriers, manufacturers, and distribution partners. Orders, delivery, customer service, claims, fraud screening, website operation, attribution, advertising measurement, legal compliance, and record keeping. Yes: hashed email address and phone number and advertising click identifiers, to advertising platforms for conversion reporting.
Customer records (Cal. Civ. Code 1798.80(e)) Name, address, phone number, and limited payment details such as card brand and last four digits. You; payment processors. Orders, payment processing, dispute handling, and record keeping. No
Commercial information Products purchased, order history, quotes, purchase amounts, return, claim, and warranty records. You; Shopify; manufacturers, distributors, warehouses, and carriers. Orders, delivery, customer service, claims, warranty support, fraud screening, advertising measurement, and record keeping. Yes: purchase date, order value, and an order reference, to advertising platforms for conversion reporting.
Internet or other electronic network activity Pages and products viewed, search terms, cart and checkout activity, referring web address, browser and device signals, interaction patterns, and advertising click identifiers. Your device and browser through our first-party script, Shopify platform analytics, and CallRail when you allow it. Website operation, fraud screening, attribution, understanding website use, and advertising measurement. Yes: advertising click identifiers, to advertising platforms for conversion reporting. No other network-activity information is sold or shared.
Geolocation data Approximate location derived from your IP address or shipping address. We do not collect precise geolocation. Your device; you. Shipping, sales tax, fraud screening, and website operation. No
Audio, electronic, visual, or similar information Chat and email messages, attachments, call recordings and transcripts, and photos or videos submitted for claims or support. You; our chat, telephone, and email providers. Customer service, claims, warranty support, service-quality review, dispute handling, and record keeping. No
Professional or employment-related information Business name and installer, contractor, or service-company details. You. Business accounts, warranty support, and technical support. No
Inferences Fraud-risk assessments, customer-service classifications, and AI-generated summaries. Derived by us and our fraud-screening and AI providers from the categories above. Fraud screening, routing and answering support requests, and service-quality review. No
Sensitive personal information Account login credentials when you create a customer account. You. Providing and securing your account only. No

Sale and sharing. In the past 12 months we sold or shared the identifiers, commercial information, and network-activity information listed as “Yes” above with one category of third party: advertising platforms (Google Ads, Microsoft Advertising, and OpenAI Ads), for conversion reporting as described under “Advertising Measurement and Conversion Reporting.” We did not sell or share any other category of personal information, and we do not knowingly sell or share the personal information of consumers under 18 years of age. To opt out, email support@northcountryfire.com with the subject line “Opt out of advertising reporting.” Opt-out preference signals such as Global Privacy Control are honored for your browser as described under “Your Privacy Choices and Opt-Out Preference Signals.”

Sensitive personal information. The only sensitive personal information we collect is your account login credentials when you create a customer account; your password is held by Shopify. We use these credentials only to provide and secure your account, and we do not use them to infer characteristics about you. Because of that, the right to limit the use of sensitive personal information does not apply to our processing, and we do not offer a separate “Limit the Use of My Sensitive Personal Information” link.

Financial incentives. We do not currently offer a financial incentive, or a price or service difference, in exchange for personal information, so no Notice of Financial Incentive applies. If we introduce a sign-up discount or similar program, we will provide the required notice before you enroll.

Shine the Light (Cal. Civ. Code 1798.83). We do not disclose personal information to third parties for those third parties’ own direct marketing purposes. California residents may nonetheless request a statement of any such disclosures by emailing support@northcountryfire.com with the subject line “Shine the Light Request” or by writing to North Country Fire, Apolaustic Inc., PO Box 2342, North Conway, NH 03860.

Rhode Island Addendum

R.I. Gen. Laws 6-48.1-3 requires us to tell Rhode Island customers the categories of personal information we collect through our website and to identify all third parties to which we have sold or may sell personally identifiable information. We collect the categories described under “Information We Collect”: contact information, order and transaction information, payment information, shipping and delivery information, damage-claim, return, warranty, and support information, device, website, and site-interaction information, fraud-screening information, and policy-acceptance records. The third parties to which we have sold, and will continue to sell unless you opt out, personally identifiable information are Google LLC (Google Ads), Microsoft Corporation (Microsoft Advertising), and OpenAI (OpenAI Ads), each of which receives purchase reporting as described under “Advertising Measurement and Conversion Reporting.” We have not sold personally identifiable information to any other third party. To opt out, email support@northcountryfire.com with the subject line “Opt out of advertising reporting.”

Texas Addendum

Texas residents: under the Texas Data Privacy and Security Act, the purchase reporting we send to Google Ads, Microsoft Advertising, and OpenAI Ads is a sale of personal data, and our use of that data is processing for targeted advertising. We do not sell sensitive data. To opt out, email support@northcountryfire.com with the subject line “Opt out of advertising reporting.” For the website, you can also decline the Advertising category on our Your Privacy Choices page or send a Global Privacy Control signal, which we honor for that browser. The rights, verification, authorized-agent, and appeal procedures above apply to Texas residents.

Data Retention

We retain personal information for as long as reasonably necessary to process orders, provide customer service, maintain business records, comply with legal obligations, resolve disputes, prevent fraud, enforce our agreements, support warranty claims, respond to chargebacks, recover unpaid amounts, and operate our business.

We retain certain records even after a deletion request where retention is permitted or required by law. This includes records needed for tax, accounting, compliance, fraud prevention, security, warranty, product safety, dispute resolution, chargeback defense, collections, legal claims, policy enforcement, or other legitimate business purposes.

Retention periods vary depending on the type of information, the reason it was collected, legal requirements, operational needs, warranty periods, dispute periods, chargeback periods, product-safety considerations, and our legitimate business needs. The schedule below gives the retention period for each type of record. When one record falls under more than one row, the longer period applies.

Record type Retention period
Order, invoice, and tax records, including payment records 7 years after the transaction
Fraud-screening, chargeback, dispute, and collections records 7 years after the transaction or the close of the dispute, whichever is later
Warranty and damage-claim records, including photos and videos The life of the manufacturer warranty plus 3 years
Customer account Until you delete the account or ask us to delete it; order records then remain under the rows above
Chat transcripts, call transcripts, and support email 3 years from the conversation
Call recordings (audio) 2 years (730 days) from the call; recordings are deleted automatically from our recording storage
Video-meeting transcripts 30 days from the meeting
AI-generated summaries, classifications, and drafts No longer than the source records they were derived from
Marketing email and text-message lists Until you unsubscribe or opt out; after that we keep a suppression record (your email address or phone number and the opt-out date) so that we do not contact you again
Conversion-reporting opt-out and other privacy requests The suppression record indefinitely, so the opt-out keeps working; request correspondence 2 years
Policy-acceptance and consent records As long as the related order, account, or communication record
Site-tracking and device data from our first-party script Kept in our data platform under its retention rules, which apply the periods in this table to the order, inquiry, or fraud-screening record the data is linked to and otherwise keep the data no longer than fraud screening and attribution require

Communications and Derived Records

The retention criteria above also apply to chat messages, recordings, transcripts, attachments, consent records, and AI-generated summaries or drafts. Different systems and record types can have different retention periods. Deleting a source recording does not necessarily delete a separately retained support record or summary. Closing the chat window, leaving the website, or withdrawing consent does not automatically erase existing records. You may request deletion using the contact details below; we will evaluate the request and any applicable retention exceptions.

Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information.

When sensitive information is transmitted through our website, it is protected using encryption where supported by our systems and service providers. You can often verify this by looking for “https” in the website address.

Only personnel and service providers with a business need are granted access to personal information where reasonably appropriate.

No method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security of personal information.

Children’s Privacy

Our website is not intended for children under 13 years of age, and we do not knowingly collect personal information from children under 13. We do not knowingly sell or share the personal information of anyone under 18, and we do not knowingly direct targeted advertising to anyone under 18. If you believe a child under 13 has provided us with personal information, or that we hold personal information of someone under 18 that was sold, shared, or used for targeted advertising, contact us using the information in the “Contact Us” section below and we will delete it or stop that use.

International Users

North Country Fire is based in the United States. If you access our website or provide information from outside the United States, your information may be processed in the United States or other locations where our service providers operate.

These locations may have privacy laws different from those in your location. We remain responsible for meeting applicable requirements for international transfers, including any required safeguards or permissions. Visiting our website or acknowledging this policy is not a substitute for a legally required transfer safeguard or consent.

Links to Other Websites and Embedded Content

Our website contains links to other websites, manufacturers, service providers, payment processors, financing providers, and third-party resources. Pages that embed a video hosted by YouTube or Vimeo load that provider’s player; the provider receives your IP address and device information and sets its own cookies under its own privacy policy.

We are not responsible for the privacy practices, content, policies, or security of third-party websites or services. We encourage you to review the privacy policies of any third-party websites or services you visit.

Changes to This Privacy Policy

We update this Privacy Policy when our practices, technology, services, legal obligations, or business operations change.

The updated version is posted at https://www.northcountryfire.com/policies/privacy-policy with a revised effective date and policy version. We will provide additional notice or obtain consent where required by applicable law.

A policy update, continued website use, or silence does not by itself provide consent where an affirmative choice is required. We will not treat this update as retroactive permission for a materially different use of information already collected.

Contact Us

For questions about this Privacy Policy, privacy requests, or complaints, contact us at:

North Country Fire
Apolaustic Inc.
PO Box 2342
North Conway, NH 03860

Email: support@northcountryfire.com

For privacy requests, use the email or mailing address above and identify your request as a privacy request, using the subject lines given under “Your State Privacy Rights.” Our shipping-damage form is intended for shipment claims, not privacy requests.

When submitting an access, correction, deletion, or portability request, include enough information for us to locate your records, such as the email address, phone number, or order number you used with us. Opt-out requests need only the email addresses or phone numbers to suppress. Do not include unnecessary sensitive information in your request.