TRUST & SECURITY
The safest data is the data we never collect.
EFFECTIVE AUGUST 20, 2026 · LAST UPDATED AUGUST 20, 2026
Our approach
DATA MINIMIZATION1. Security by subtraction
Most security pages list certifications and acronyms. Ours is shorter, because the approach is simpler: the safest data is data we never collect. Every piece of information this website doesn't gather is a piece that can't be lost, leaked, or misused — so the shop is built to gather almost nothing.
2. What this site does not do
There are no accounts and no passwords to steal. We do not run advertising pixels or a first-party analytics tool. Termly records your consent choice; optional tawk.to chat stays blocked until you accept. Card numbers are not collected on this website: quote and chat are not payment forms, and future card checkout is planned as Stripe-hosted Checkout, not a form here.
3. Badges we don't have
We're a small goods shop, not a software company, so you won't see SOC 2 or ISO 27001 badges here — we don't hold those certifications, and displaying them would be a false claim. What we offer instead is a website that simply holds very little worth stealing.
What little data we hold
INVENTORY & RETENTIONThe inventory below matches our privacy policy. It is the data this website actually handles — not a claim that nothing else exists at vendors.
| What | Where it lives | How long it's kept |
|---|---|---|
| Quote-request details you send us | Cloudflare D1 (`contact_inquiries`) plus a Resend email to quotes@smallpetcarriers.com — the quote form sends your name, email, organization, quantities, and notes there after a PAN check | While your quote or order is active. Quote requests and quiet threads are deleted within 24 months; order records are kept as long as warranty and tax obligations require. |
| Email correspondence | The same @smallpetcarriers.com mailboxes — messages you send and our replies | While the conversation is active; threads that go quiet are removed within 24 months. |
| Server logs | Cloudflare — visitor IP address, browser type, and pages requested | A short standard period, typically 30 days, for security and debugging. |
| Consent choice | Termly | While the consent record is required to honor your preference. |
| Optional live chat | tawk.to, only after you accept that category | Per tawk.to retention; do not send card numbers in chat. |
Quote rows live in D1 until we fulfill or expire them; there is no marketing database and no ad network quietly collecting more. Even the Fit Guide's weight slider runs entirely in your browser — the number you set never leaves your device.
How we protect it
SAFEGUARDS1. Encrypted in transit
Every page of smallpetcarriers.com is served over HTTPS with TLS, so anything you send us — like a quote request — travels encrypted between your browser and the site.
2. Tightly limited access
Quote rows in D1 and shop mail are limited to the people who answer requests. Optional chat, if you use it, is processed by tawk.to. There is no customer account database on this website.
3. Nothing embedded that reports on you
No advertising networks are embedded. Termly and, after consent, tawk.to are the optional third-party scripts besides Google Fonts. Your visit is not sold.
4. Third-party scripts we do load
Google Fonts (fonts.googleapis.com / fonts.gstatic.com), Termly AutoBlocker, and — only after you accept — tawk.to. Google receives IP and user-agent to deliver fonts. Termly records consent. Chat content goes to tawk.to if you use the widget.
Payments
NO CARDS ON THIS SITE1. No checkout here
You can't enter a card number on this website even if you want to — there is no cart, no checkout, and no payment form anywhere on it. Quotes are handled by email, starting from the quote page.
2. How payment happens
Card checkout is planned as full-page Stripe-hosted Checkout. You would enter card details on Stripe's page, not ours. Until that account is connected, payment is arranged by email after a written quote. This is a design choice, not a PCI DSS certification of Little Carriers LLC.
3. Why that's the safest setup
This website does not collect card numbers. The quote API rejects likely PANs before D1 or Resend. When Stripe-hosted Checkout is live, card data stays on Stripe's page. Do not treat that architecture as a completed PCI DSS audit.
Reporting a security issue
Found something that looks wrong — a suspicious email using our name, a problem with the site, a possible vulnerability? Tell us. Email with the subject line "SECURITY" so it stands out, or call the shop (MON–FRI, 8:00–16:00 CT). We aim to acknowledge every security report within 1 business day.
We ask for responsible disclosure: give us a reasonable chance to investigate and fix an issue before sharing it publicly. We don't run a paid bug-bounty program — what we can promise is a fast, human response from the people who run the shop.
If something goes wrong
INCIDENT RESPONSE1. What we'll do
If a security incident ever affects personal data we hold, we will notify the people affected and the authorities as the law requires. Where the GDPR applies, that includes notifying the relevant supervisory authority within 72 hours of our becoming aware of a breach, and informing affected individuals without undue delay when the risk to them is high. We'd rather tell you promptly than quietly.
2. What you can do
If you ever receive a message claiming to be from us that seems off, don't reply to it — forward it to quotes@smallpetcarriers.com or call +1 (920) 768-6262 and we'll confirm whether it's genuine.
Subprocessors
THIRD PARTIESA subprocessor is a company that handles data on our behalf. Ours fit on an index card — these are the only outside companies that touch any visitor or customer data for this site:
| Provider | What it does for us | What it receives |
|---|---|---|
| Cloudflare | Hosts the Site and stores quote rows in D1 | Standard server logs plus quote fields you submit |
| Google Fonts | Delivers the typefaces used on this site | Visitor IP address and browser user-agent when font files are downloaded |
| Termly | Consent management and AutoBlocker | Your consent choice |
| tawk.to | Optional live chat after consent | Chat contents if you start a conversation |
| Resend | Transactional email of submitted quotes | Quote details you submit |
| Migadu | Inbound @smallpetcarriers.com mailboxes | The contents of emails you send us, and our replies |
No advertising network or social platform appears here. Stripe is listed as planned hosted Checkout only and does not receive card data from this Site today. If that changes, this table — and our privacy policy — will be updated first.
This document is provided for general information and does not constitute legal advice.