Policy · last updated 2026-09-15

Privacy

A hardware-wallet reseller that hoards customer data is a data breach waiting to happen. We collect the minimum required to ship your order and support you, and we keep it for the minimum time required.

1. Who is the controller of your data

RAO LLC, a Florida limited-liability company (Florida Doc L24000092374, EIN 37-2135087) with its principal place of business at 400 SW 107th Ave, Miami, FL 33174, USA. Contact care@coldkeys.shop.

2. What we collect

• Order details — email, name, delivery address, phone (optional, for courier), the items you bought, order id.
• Payment reference — a Stripe payment intent id and settlement amount. We never see or store card number, CVV, or 3-D Secure data. Stripe, Inc. (PCI-DSS Level 1) is the processor of your card data.
• Server logs — IP address, user agent, referrer, timestamps. Retained 30 days for fraud and abuse defence, then purged.

3. What we don't collect

• No customer accounts. You can check out without signing up for anything.
• No advertising cookies. No Facebook Pixel, no Google Analytics on your card-entry flow.
• No wallet balances, no seed phrases, no keys. Anyone who asks for your seed phrase is trying to steal from you — that includes us. We will never ask.

4. Who we share with

• The courier — name, address, phone, tracking id.
• Stripe, Inc. — email, name, order amount, order id, billing address (for card AVS).
• Cloudflare, Inc. — hosts the site and processes traffic at the edge (IP/UA/timestamps).
• Nobody else. We do not sell, rent, or license your personal information to marketers or data brokers.

5. Retention

We keep order records for as long as legally required to comply with U.S. federal, Florida state, and destination-country tax and consumer-protection law (typically 4 to 10 years, depending on jurisdiction). After the applicable period the record is deleted. Server logs are purged after 30 days.

6. Your rights — U.S. buyers (CCPA / CPRA)

If you are a California resident you have the right to know what personal information we hold about you, to request a copy of it, to correct it, and to request its deletion (subject to our legal obligation to retain order records). You have the right not to be discriminated against for exercising these rights. RAO LLC does not sell personal information and does not share it for cross-context behavioural advertising. Send a verifiable request to care@coldkeys.shop from the email address on your order.

7. Your rights — EU / UK / EEA buyers (GDPR / UK-GDPR)

You have the right to access, correction, portability, restriction, objection, and erasure of your personal data (subject to our legal retention obligations). The lawful bases we rely on are: performance of the sale contract (Art. 6(1)(b) GDPR) and legitimate interest in fraud prevention and record-keeping (Art. 6(1)(f) GDPR). If we transfer your data from the EU/UK to the United States, we do so under Stripe's Standard Contractual Clauses and the EU-U.S. Data Privacy Framework where applicable. You may lodge a complaint with your national data protection authority.

8. Cookies

Coldkeys uses only technical cookies necessary for the cart to work (a localStorage entry that keeps your cart between pages on your own device). No analytics or advertising cookies are set. Stripe's hosted checkout page uses its own cookies during payment — see stripe.com/privacy.

9. Children

Coldkeys is not directed to children under 16 (or under 13 for U.S. residents under COPPA). We do not knowingly collect personal information from anyone in those groups. If you believe we have, contact us and we will delete it.

10. Contact

RAO LLC
400 SW 107th Ave, Miami, FL 33174, USA
care@coldkeys.shop