_Last updated: 2026-08-30. Operated by QSai LLC ("we"), trading as SecurityGadgets.shop._
SecurityGadgets.shop is operated by QSai LLC, a Texas limited liability company,
from Austin, Texas. For orders placed on this site we are the controller of
your personal data. For orders you place through a marketplace — eBay, TikTok
Shop, Etsy — that marketplace is the controller and its privacy policy
governs the data it collects; we receive only what it passes to us to fulfil
your order.
Contact: sales@securitygadgets.shop.
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Name, email, phone, shipping and billing address | To take payment, ship your order, and handle delivery problems | Performance of a contract |
| Order contents and amounts | To fulfil, account for, and support the sale | Contract; legal obligation (tax) |
| IP address | Fraud and abuse prevention; regional routing | Legitimate interests |
Referral / campaign parameters (sg_attr) | To attribute a sale to the referring partner | Legitimate interests |
| Account identifier, if you sign in | To attach the order to your CISO Marketplace account | Contract |
You may check out as a guest. A guest order is recorded against a random
identifier and is not linked to any account — which also means we cannot show it
to you later; keep your confirmation email.
We do not sell personal data, and we do not use it for automated
decision-making or profiling.
Shipping a physical parcel necessarily means sharing your address. These are
everyone who receives it, and — stated plainly — how much control we have over
each.
We control these directly, and can prove deletion:
| Provider | Role | Retention |
|---|---|---|
| Cloudflare | Workers, Pages, D1, R2, KV — all compute and storage | Ours to set — BUT D1 Time Travel restores any minute of the last 30 days (Workers Paid) |
| Custody (QSai LLC 3PL) | Our own warehouse — pick, pack, ship, RMA | 90 days post-delivery, then redacted to hash; per-tenant override |
These hold your address under contract. We require deletion contractually.
We cannot enforce it technically, and we will not claim otherwise:
| Provider | Role | Their retention |
|---|---|---|
| EasyPost | Carrier rating, label purchase, tracking | EasyPost's own |
| Nitrokey GmbH | Vendor; drop-ships direct to buyer when not from our stock | Vendor's own — not enforceable by us |
| NovaCustom | Vendor; drop-ships worldwide direct to buyer | Vendor's own — not enforceable by us |
| Stripe | Card processing + hosted Checkout for every spoke | Multi-year (AML / dispute obligations) |
These set their own terms and we have no control over their retention:
| Provider | Role |
|---|---|
| _None_ | — |
These own the customer relationship outright — if you bought there, their
policy governs, not ours:
| Platform | Role |
|---|---|
| TikTok Shop | Marketplace; owns checkout and the customer |
| eBay | Marketplace; owns checkout and the customer |
We share your data with these providers, with a brand that ships your order
directly, or where we are legally compelled. Nowhere else.
90 days after your order is delivered, we automatically redact
your name, email, phone, shipping address and IP from the order record. What
remains is the commercial record — what was bought, what it cost, the tracking
number — which we must keep for tax, accounting and dispute purposes.
That job runs nightly and is logged, so we can demonstrate it ran rather than
merely assert it.
Complete removal takes up to 120 days. Our database provider keeps
an encrypted point-in-time restore window of 30 days, so a record redacted on day
90 remains theoretically recoverable from backup until roughly day
120. We state the longer number because it is the true one.
Providers in the second, third and fourth tables above keep their own copies on
their own schedules. Payment records are retained by our payment processor for
years under anti-money-laundering and dispute rules, and we cannot shorten that.
Under the GDPR, UK GDPR, CCPA/CPRA and comparable laws you may request access,
correction, deletion, portability, restriction, or object to processing, and you
will not be treated differently for asking. Email
sales@securitygadgets.shop; we respond within 30 days.
If you bought through a marketplace, send deletion requests to that marketplace
as well — we cannot reach their copy.
You may complain to your data protection authority (EU/UK) at any time.
We operate from the United States and our infrastructure is US-based. Orders from
the EEA/UK are transferred to the US under the Standard Contractual Clauses or an
equivalent mechanism with each provider.
Payment card details never reach our servers — payment is completed on our
processor's hosted page. Internal service-to-service calls are authenticated and
signed. Access to production data is restricted and logged.
We post updates here with a new date. Material changes are notified to account
holders by email.