Privacy policy

Last updated October 19, 2026

Who is responsible

Codext GmbH, Frankenstraße 10, 74549 Wolpertshausen, Germany. Contact: support@sturdyharbor.com.

What we collect

• When you order: name, email, shipping address, optional phone number, what you bought and how much you paid. You enter payment details in the secure Shopify checkout; they never reach us.
• When you browse: our shop runs on Shopify, which records the pages viewed, the referring site or campaign tag (such as utm_source), your browser type and IP address, and sets the cookies the cart and checkout need. We use no advertising pixels.
• When you write to us: your message and email address.

Why and on what basis

We use order data to deliver your order, send receipts and tracking, handle refunds and keep our accounts (contract and legal obligation). We use the visit statistics to see which products people look at (legitimate interest).

Who receives data

• Shopify (Shopify International Limited, Ireland, and its affiliates) runs our online shop and checkout, processes the payment and sends our order and shipping emails. PayPal processes the payment if you choose it.
• Our fulfilment partner CJ Dropshipping receives your name, address and phone number to pack and ship the order from its warehouse (in the United States, or abroad where the product page says so), and passes them to the carrier.
• Our hosting provider runs our order processing server in Germany.

We do not sell your personal information and we do not share it for advertising.

How long we keep it

Order records are kept for 10 years because German accounting law requires it. Messages are deleted after the matter is closed, at the latest after 2 years.

Your rights

You can ask us what we hold about you, to correct it, or to delete what the law allows us to delete. Residents of California and other states with privacy laws have these rights as well. Write to support@sturdyharbor.com. We answer within 30 days.

Data transfers

We are based in Germany. Data about US customers is processed in the EU, Canada and the US by the providers above under their standard contractual protections.