Privacy policy
Effective date: July 17, 2026
This Privacy Policy explains how NEXHOLD COMMERCE LLC, operating the online store Lomaroshop at www.lomaroshop.com ("we", "us", "our"), collects, uses, shares and protects your personal information when you visit our store, create an account, place an order or contact our support team. We wrote it to be read — no legalese where plain English works.
1. Who is responsible for your data
NEXHOLD COMMERCE LLC 5830 E 2nd St, Ste 7000 Casper, WY 82609, United States Wyoming Filing ID: 2026-001887388 E-mail: support@lomaroshop.com Phone: +1 307 443 4575 (Mon–Fri, 9:00 AM – 5:00 PM Mountain Time)
For any privacy question or request, e-mail is the fastest channel — we reply within 1 business day.
2. What we collect, why, and on what basis
2.1 Information you give us directly
| Data | When | Purpose | Legal basis |
|---|---|---|---|
| Name, shipping address, e-mail, phone | Checkout | Order fulfillment, delivery, delivery notifications | Performance of a contract |
| Payment details (card number, wallet identity) | Checkout — processed directly by Stripe; we never see or store full card numbers | Payment processing, fraud screening | Performance of a contract; legal obligation |
| E-mail address | Newsletter signup | Marketing e-mails you asked for | Consent — withdraw anytime via the unsubscribe link |
| Correspondence (e-mails, phone notes) | When you contact support | Answering you, handling returns and claims, quality of service | Contract; legitimate interest |
2.2 Information collected automatically
| Data | Tool | Purpose |
|---|---|---|
| Device type, browser, IP address, pages viewed, referral source | Google Analytics 4 | Understanding how the store is used, improving navigation |
| Ad interaction data | Google Ads conversion tracking | Measuring whether our advertising works |
| On-site interactions (clicks, scrolling, form abandonment) | Vitals visitor recording | Finding usability problems. Recordings are interaction replays; checkout and payment fields are never recorded |
| Cart contents, session state | Shopify (essential cookies) | Keeping your cart and checkout working |
We do not send marketing SMS. We do not sell your personal information for money, and we do not share it except as described in section 4.
2.3 What we deliberately do NOT collect
No government ID numbers, no financial account credentials, no biometric data, no precise geolocation, no data from data brokers.
3. Cookies and your choices
We use Shopify's cookie consent banner. Three categories:
- Essential — cart, checkout, security. Always on; the store cannot function without them.
- Analytics — Google Analytics 4. Loads only after you accept.
- Marketing — Google Ads conversion tracking, Vitals. Loads only after you accept.
You can change or withdraw your choice anytime via the Your Privacy Choices link in the footer, or via your browser's cookie controls. Declining non-essential cookies never blocks you from ordering.
4. Who processes data on our behalf
We share personal data only with providers who need it to run the store, each bound by its own privacy safeguards:
| Provider | Role | What they receive |
|---|---|---|
| Shopify Inc. | Store hosting, checkout, Shopify Email | Order, account and payment data |
| Stripe, Inc. | Card and digital-wallet payments (Visa, Mastercard, American Express, JCB, Discover, Diners Club, Apple Pay, Google Pay) | Payment and order amount data |
| ShipBob, Inc. (Fontana, CA) | Order fulfillment and returns | Name, address, order contents |
| UPS / USPS / FedEx / DHL eCommerce | Delivery | Name, address, package data |
| Google LLC | GA4 analytics; Ads conversion measurement | Pseudonymous usage and conversion data |
| Vitals | On-site session recording | Pseudonymous interaction data (no payment fields) |
| Track123 | Shipment tracking page | Tracking number, shipment status |
| Simprosys | Google Shopping product feed | Product data only — no customer data |
We may also disclose information where the law requires it (court order, tax authority) or to protect against fraud.
International transfers: our providers are US-based; where any processing happens outside the US, providers rely on their own recognized safeguards.
5. How long we keep your information
| Category | Retention period | Why |
|---|---|---|
| Order, invoice and payment records | As long as required by applicable tax and accounting laws | Legal obligation |
| Customer support correspondence | Up to 2 years after the case closes | Handling follow-ups and claims |
| Newsletter e-mail address | Until you unsubscribe | Consent-based |
| Analytics data | 14 months (Google Analytics setting) | Shortest available GA4 window |
| Cookie consent record | As long as the consent remains valid | Proof of consent |
When a retention period ends, data is deleted or irreversibly anonymized.
6. Your privacy rights
Depending on your state of residence — including under the California Consumer Privacy Act (CCPA/CPRA), the Colorado Privacy Act, the Virginia CDPA and similar state laws — you have the right to:
- Know / access — get a copy of the personal information we hold about you;
- Correct — fix inaccurate information;
- Delete — have your data erased, except where the law requires us to keep it (e.g. tax records);
- Portability — receive your data in a usable format;
- Opt out of targeted advertising and of any "sale" or "sharing" of personal information as those terms are defined by state law — use the Your Privacy Choices page in our footer or e-mail us;
- Non-discrimination — exercising your rights never affects pricing or service;
- Appeal — if we decline a request, you may appeal by replying to our decision e-mail.
We honor these rights for all US customers, regardless of state. To exercise any right, e-mail support@lomaroshop.com with the subject "Privacy request". We confirm receipt within 1 business day and resolve requests within 45 days (extendable once by 45 days where the law allows; we'll tell you if so). We verify identity by matching your request to the e-mail address on file — we never ask for ID documents for routine requests.
California residents: we do not use or disclose sensitive personal information for purposes requiring a "Limit Use" option, and we have not "sold" personal information for money in the preceding 12 months. Sharing for cross-context behavioral advertising (analytics/ads cookies) can be opted out as described above.
7. Security
- The entire store runs over HTTPS (SSL/TLS) — every page, not just checkout.
- Payments are processed by PCI DSS Level 1 certified providers (Stripe); card data never touches our systems.
- Access to order data is limited to staff who need it for fulfillment and support.
- 3-D Secure (Visa Secure, Mastercard Identity Check) protects card payments where your bank supports it.
No system is perfectly secure; if a breach ever affects your data, we will notify you and the authorities as the law requires.
8. Children
Our store sells to adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us data, write to us and we will delete it.
9. Do Not Track and opt-out preference signals
We honor Global Privacy Control (GPC) signals sent by your browser as an opt-out of targeted advertising, as required by California law.
10. Changes to this policy
We may update this policy as the store or the law evolves. The current version, with its effective date, is always published at this address. Material changes will be announced on the site before they take effect.
11. Contact
Privacy requests and questions: support@lomaroshop.com · +1 307 443 4575 Mon–Fri, 9:00 AM – 5:00 PM (Mountain Time) · reply within 1 business day
Postal address: NEXHOLD COMMERCE LLC, 5830 E 2nd St, Ste 7000, Casper, WY 82609, United States