1. Scope and effective date
This Privacy Notice describes how Swanson Tool Company, Inc. (“Swanson” or “We”), a corporation with its principal place of business at 211 Ontario Street, Frankfort, Illinois 60423, handles personal information collected through swansontoolco.com, subdomains We operate, forms embedded on retail-partner or campaign pages, offline interactions tied to your online activity (trade-show sign-ups, printed Blue Book redemption codes, warranty registrations), and marketing communications you receive from us by email or text message. Together We call these the “Sites and Services.”
Swanson is the controller of the personal information collected through the Sites and Services. That means We decide what is collected and why. Service providers (Stripe, Klaviyo, Vercel, SheerID, and the others named throughout this Privacy Notice) process information on our behalf under written contracts.
This Privacy Notice is effective on the “last updated” date shown above. Your continued use of the Sites and Services after that date means you agree to the current version. When We make a material change We will highlight the change on the site and, where required by law, ask you to accept the new version before you continue to use a feature.
2. Information We collect
We collect the categories of personal information listed below. Not every category applies to every visitor. If you only read a product page and never fill in a form, only the “Device and usage” and “Cookie” categories apply to you.
a. Contact and identity information
Your name, email address, mailing or shipping address, phone number, trade or job title, employer, and the password hash for accounts you create with us. If you verify as a Swanson Pro, We also collect any trade-credential document you submit (union card, contractor license, resale certificate) or the identifier you provide to our identity partner SheerID (see § 8).
b. Purchase and transaction information
Order details, itemized cart contents, shipping method, order status, refunds and returns, warranty claim details, gift-card balances, and the last four digits of the card you used. We do not store your full card number, expiration, or CVV. Card data is tokenized by Stripe inside a PCI-compliant iframe and is not stored on Swanson’s servers.
c. Community and review content
Product reviews, review headlines, star ratings, review photos, question submissions, contest and giveaway entries, testimonial text or video you send us, and the display name and trade badge that will appear next to your review. See § 8 for details on how We moderate and use this content.
d. Verified Pro credential information
If you apply for our verified Pro program We collect the trade, employer, license or union number, and any supporting document (photo of a card, PDF of a certificate) you submit; or, when the SheerID flow is live, the response our verification partner returns (“approved” / “denied” / “review”) plus a hashed reference so We can match approvals to future logins. We do not receive the full government or licensing records SheerID checks.
e. Marketing preferences and consent history
Your email and SMS subscription status, the date and source of each subscription (footer form, exit-intent offer, checkout opt-in), your consent to text-message marketing (with the check-box wording you actually saw), language and locale, and the version of this Privacy Notice you accepted (stamped at the moment of consent).
f. Support and correspondence
Messages you send through the contact form, email responses, warranty-claim conversations, chat transcripts (if a chat feature is enabled on your visit), and any attachments you include. If you speak with our customer service team by phone We do not record the call by default; if a specific call is recorded for training or quality We will disclose that at the start of the call.
g. Device and usage information
IP address, approximate location derived from the IP (usually city / region), device type, operating system, browser, screen size, referring URL, pages viewed, time on page, add-to-cart and checkout events, product-tile impressions, search queries you type into our search bar, and error messages your browser reports.
h. Cookies and similar identifiers
First-party cookies that store your cart, session, and preferences; analytics cookies from Google Analytics 4; the Meta (Facebook) advertising pixel; any similar retargeting pixels We later enable; and locally-stored browser data (localStorage, sessionStorage) that supports features like your cart-recovery banner and your recently-viewed strip. Full detail in § 5.
i. Inferences and audience segments
From the categories above We create limited inferences, for example an audience segment of “framer / carpenter Pro who bought a Speed Square in the last 90 days” that We use to time follow-up email flows. These segments live inside Klaviyo and are keyed to your email address, never to sensitive characteristics.
3. Where the information comes from
We collect the information above from:
- You directly, when you fill in a form, upload a photo, create an account, submit a review, apply for Pro status, buy from us, contact support, or opt in to email or SMS updates.
- Your device automatically, when your browser makes requests to Swanson’s servers or loads cookies and pixels described in § 5.
- Our service providers, when Stripe returns the last-four of a card, Klaviyo reports engagement with an email, SheerID returns a verification decision, or Vercel Blob confirms a photo upload.
- Retail and marketing partners, when Amazon, Home Depot, Lowe’s, or another authorized retailer shares an aggregated review rating for a Swanson product (used to display the star average on our product pages), or when you sign up through a co-branded campaign page We run with a distributor.
- Publicly available sources, when We use business-registration data or publicly-listed contractor licenses to verify a Pro application you submit.
4. How We use your information
We use personal information to:
- Operate the Sites and Services, including hosting the site on Vercel, serving product pages, and personalizing content like your recently-viewed strip or your cart.
- Process purchases, send order confirmations, calculate tax, ship product, issue refunds, and handle warranty claims and returns.
- Create, secure, and maintain your account, remember your login, and prevent unauthorized access.
- Verify your identity or trade credentials for the Pro program, and issue Pro-only pricing and rewards.
- Moderate reviews, photos, and other user-submitted content under the Community Guidelines, including running submissions through automated profanity and spam filters.
- Send transactional messages (order status, warranty updates, password resets, review moderation decisions).
- Send marketing messages to subscribers who opted in, including email newsletters, promotional offers, product launches, and SMS updates.
- Improve the Sites and Services by measuring which pages are used, which product images convert, where visitors drop off in checkout, and where errors occur.
- Build audience segments for marketing on Meta, Google, and similar platforms, using hashed identifiers.
- Detect, investigate, and prevent fraud, abuse, unlawful activity, and security incidents.
- Comply with legal obligations (tax, warranty, consumer-protection, product-safety recalls, subpoenas, and lawful requests from government or regulators).
- Enforce our Terms of Use, our Community Guidelines, and any contract We have with you.
7. Analytics, advertising, and marketing
We use Google Analytics 4 to measure site traffic and user behavior in aggregate. IP-anonymization is enabled so full IP addresses are not stored in the analytics account. Learn more at Google’s partner-sites privacy page and opt out with the Google Analytics opt-out browser add-on.
We use the Meta / Facebook Pixel to measure conversions and build lookalike audiences on Meta platforms (Facebook, Instagram). Manage Meta ad preferences at facebook.com/adpreferences.
We use Klaviyo for email and SMS marketing and to fire server-side events (order placed, review submitted, account created) so We can time follow-up messages. You can unsubscribe from any marketing email using the “unsubscribe” link in the footer of every message, from SMS by texting STOP to any message, or by contacting us directly.
You may opt out of interest-based advertising delivered by many participating companies through the Digital Advertising Alliance (optout.aboutads.info), the Network Advertising Initiative (optout.networkadvertising.org), or, in the EU, the European Interactive Digital Advertising Alliance (youronlinechoices.eu). Opting out does not stop all advertising, only interest-based advertising from participating companies.
8. Reviews and user-submitted content
When you submit a product review, photo, question, or other content through the Sites and Services (together, “User Content”) you are consenting to the following, and We ask you to confirm it with a check-box at the point of submission.
- Your User Content will be held in a moderation queue and reviewed by a Swanson moderator or a moderation service acting on our behalf before it appears on the public site.
- We may reject the submission, edit it for clarity or length, remove it after publishing, or block your email or IP address from further submissions if the User Content violates the Community Guidelines or applicable law.
- Your display name, star rating, review headline, review body, review photos, trade badge, and (if applicable) Verified Buyer or Verified Pro badge will appear publicly on the product page. Your email address is not displayed publicly.
- We may use the email you submit with the review to match against orders in Stripe or Pro verifications in our records to award the Verified Buyer or Verified Pro badge.
- You grant Swanson a worldwide, non-exclusive, royalty-free, sublicensable, perpetual license to host, store, reproduce, modify, translate, publish, publicly display, publicly perform, and distribute the User Content on our Sites and Services, in email and SMS, in social channels, in print, in packaging, and in any current or future marketing materials, and to grant that license to third-party retail partners for the same purposes. Any promotion of the User Content constitutes valuable consideration provided to you in exchange for the aforesaid license grant.
- You confirm that the User Content is your own, that anyone identifiable in the photos has consented to being posted publicly, that you own or have permission to grant the license above, and that the User Content does not violate any third-party right (including copyright, trademark, privacy, or publicity rights), and you hereby release and hold harmless Swanson and its affiliates for any use of User Content.
- You understand you have no obligation to submit User Content and no additional compensation is owed to you for it.
Automated filtering catches most obvious violations (profanity, slurs, spam, external links, personal contact information) before a moderator ever sees them. Serious violations, including any content that appears to depict child sexual abuse material or an imminent threat to a person, are reported to law enforcement.
You may ask us to remove a review or photo you submitted at any time by contacting us through our contact page. We honor the removal but may keep an internal record of the fact of your submission for audit and abuse-prevention purposes.
9. Accounts and verified Pros
When you create a Swanson account We collect your name, email, password hash (We never store the plaintext password), the date and IP of account creation, the version of this Privacy Notice you accepted, and, over time, your order history, tool registrations, saved addresses, wishlists, and communication preferences.
When you apply for verified Pro status, We collect additional information described in § 2(d). We rely on SheerID (when active) to verify the trade credential. SheerID has its own privacy notice at sheerid.com/customers/privacy-policy. We receive only the pass/fail decision and a hashed reference; We do not receive the underlying government records SheerID may consult.
We treat account information as confidential. You are responsible for keeping your login credentials secure and for the activity that occurs under your account. Tell us immediately if you believe your account has been used without your permission by contacting our support team.
You can update or close your account at any time from your account dashboard, or by asking us to close it. On account closure We delete or de-identify the account record within a reasonable period, subject to the retention rules in § 10 (We keep some information for tax, warranty, and audit reasons even after closure).
10. How long We keep information
We keep personal information only as long as We need it for the purposes described in this Privacy Notice, or longer where required by law. Illustrative retention periods:
- Order and transaction records: at least 7 years, to comply with tax, warranty, and accounting rules.
- Warranty registrations: for the useful life of the tool plus 2 years, to honor lifetime-warranty claims.
- Account records: until you close the account, then archived / de-identified within 90 days except for the transaction records above.
- Reviews and community content: for as long as We publish the review; rejected submissions are retained for 90 days for moderation appeal, then deleted.
- Marketing engagement data in Klaviyo: for up to 3 years after your last engagement, then archived.
- Server logs: for up to 90 days.
- Analytics events in GA4: up to 14 months, per the retention policy We set in the property.
- Fraud, abuse, and security incident records: as long as necessary to investigate and prevent recurrence.
11. How We protect information
We use administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, and destruction. Examples of our current controls:
- All traffic between your browser and Swanson’s servers is served over TLS (HTTPS).
- Passwords are hashed with a modern scrypt-based key-derivation function; We never store the plaintext.
- Card data is tokenized by Stripe inside a PCI-DSS Level 1 environment; card numbers are not stored on Swanson’s servers.
- Access to production databases is limited to a small number of engineering staff, requires two-factor authentication, and is logged.
- Blob storage of review photos and Pro-verification uploads uses signed, expiring URLs.
- Rate-limiting and abuse detection protect review submission, login, and password-reset endpoints.
- We review vendor security posture before onboarding and re-review at least annually.
No system is perfectly secure. If We become aware of a security incident affecting your personal information We will notify you as required by law.
12. Your privacy rights
Depending on where you live, you may have some or all of the rights below. We provide the rights described here to all US visitors, regardless of state of residence, unless a specific law limits them.
- Right to know / access. Request the categories and specific pieces of personal information We hold about you, the sources, the purposes, and the categories of recipients.
- Right to correct. Ask us to correct information that is inaccurate.
- Right to delete. Ask us to delete personal information We have collected from you, subject to the retention exceptions in § 10 and applicable law (We can decline to delete records We need to keep for tax, warranty, or fraud-prevention reasons).
- Right to portability. Receive a copy of the information you provided to us in a portable, machine-readable format.
- Right to opt out of “sale” or “sharing” for cross-context behavioral advertising. We do not sell personal information for money, and We treat use of the Meta Pixel and similar tools as “sharing” under California law. Opt out through our cookie banner (“Reject Non-Essential”) or by sending a Global Privacy Control signal (§ 14).
- Right to limit use of sensitive personal information. We do not use sensitive personal information (as defined by the CPRA) for purposes that require this limit; if that changes, We will update this notice.
- Right to non-discrimination. We will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right, except where the difference is reasonably related to the value of the information (e.g. a rewards program that requires an email address).
- Right to appeal. If We decline a request, you may appeal by replying to our response email; a different reviewer will re-evaluate the request.
To exercise any of these rights, contact us at our contact page or by mail to the address in § 18. We will verify your identity before responding, using at minimum the email address on file for your account or order, and, for sensitive requests, a challenge tied to a recent order or a signed statement.
You may designate an authorized agent to make a request on your behalf. We may still contact you directly to verify the request.
California residents may see a “Notice at Collection” summary in the cookie banner on their first visit; the categories collected match the list in § 2. Residents of Colorado, Connecticut, Delaware, Iowa, Montana, Nevada, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia have substantively similar rights under their state privacy laws and may exercise them the same way.
13. Children’s privacy
The Sites and Services are intended for adults working in the trades or in DIY contexts. We do not knowingly collect personal information from children under 13, and We do not knowingly market to children. If you are a parent or guardian and believe a child under 13 has provided personal information to us, contact us and We will delete the information as required by the Children’s Online Privacy Protection Act (COPPA).
14. Do Not Track and Global Privacy Control
Some browsers offer a “Do Not Track” setting. There is no consensus on how commercial websites should respond to that signal, so we do not respond to it in a distinct way. However, We honor the Global Privacy Control (“GPC”) signal for visitors in jurisdictions where GPC is legally binding. When your browser sends a GPC signal, We treat it as a request to opt out of “sale” or “sharing” of personal information for cross-context behavioral advertising.
15. International visitors and transfers
Swanson is a US company and the Sites and Services are operated from the United States. If you access them from outside the United States, your personal information will be transferred to, processed in, and stored in the United States. Data protection laws in the United States may differ from those in your country. By using the Sites and Services you consent to that transfer, subject to applicable law.
If you are in the European Economic Area, the United Kingdom, or Switzerland, you may have additional rights under the GDPR / UK GDPR / Swiss FADP (including the right to lodge a complaint with your local supervisory authority). Swanson’s legal bases for processing are contract performance (order fulfillment, account maintenance), consent (marketing communications, cookies where required), our legitimate interests in running and improving our business (site analytics, fraud prevention), and legal obligation (tax, product-safety, lawful requests).
16. Third-party links and services
The Sites and Services include links to third-party sites (retailer product pages on Amazon, Home Depot, Lowe’s, Menards, Ace, Walmart, and other authorized retailers; distributor pages; the SheerID verification flow; embedded YouTube or Vimeo videos; social-media accounts). Those sites are not operated by Swanson and are not covered by this Privacy Notice. Read the privacy notice of any third-party site before submitting information to it.
17. Changes to this Privacy Notice
We may update this Privacy Notice from time to time. The “last updated” date and the version stamp at the top of the page will always reflect the most recent revision. For material changes We will post prominent notice on the Sites and Services, and where required by law, ask you to accept the updated notice before you continue to use an affected feature (for example, at your next login or your next review submission).
We keep a versioned copy of this notice internally. When you create an account or submit a review the version stamp you accepted is recorded with your submission so We can prove, if needed, which version applied to your consent.
18. How to contact us
Questions, requests to exercise privacy rights, or concerns about how your information was handled:
Swanson Tool Company, Inc.
Attn: Privacy
211 Ontario Street
Frankfort, Illinois 60423
Web: swansontoolco.com/contact
Phone: (815) 469-9453
We will respond to verifiable requests within the timeframe required by the applicable law (typically 45 days under US state privacy laws, with a possible 45-day extension when reasonably necessary).