This policy describes what Bagsby.com collects, why, who else can see it, and how to get it removed. It applies to everything under the bagsby.com domain, from the carry-on luggage catalog through to the contact form. It does not apply to Amazon or to any other site you reach by following a link from here, because once you leave, that operator’s policy governs, not ours.
The short version
Bagsby is a reading site. There is no visitor account to create, no newsletter to join, and nothing to buy, so the great majority of people who read a page here never give us any personal information at all. The only way to hand us your details deliberately is to type them into the contact form. Everything else is the ordinary technical record that any web server keeps, plus light traffic analytics.
What we collect
What you type into the contact form
If you write to us through the contact form, we receive whatever you put in it: typically a name, an email address, a subject and a message. Be aware of one thing that many sites gloss over. Submissions are delivered to us by email and stored in this website’s own database, so a copy of your message persists on the server until it is deleted. That is why the form page asks you not to send payment card details, identity documents, health information or anything else you would not want sitting in a database.
We use what you send only to deal with the message. We do not add contact form addresses to a mailing list, because there is no mailing list, and we do not sell, rent or trade them.
Server logs
The web server records requests as they arrive. A log line typically holds the network address the request came from, the date and time, the page requested, the response code, the referring page and the browser user agent string. Logs are how a site is kept running and defended: they show errors, broken links, scraping and attempted intrusions. They are technical records rather than a profile, but a network address can be personal data in some jurisdictions, so we treat them accordingly.
Analytics
We measure traffic in aggregate to see which parts of the catalog earn their place. That means page addresses, referring sites, approximate location derived from network address, and broad device and browser categories. It tells us that the luggage sets section is read more often than the tags section. It does not tell us who you are, and we do not attempt to combine it with anything that would.
Cookies
Cookies used on and after this site are set out in the cookie policy, including the Amazon affiliate click cookie and its 24 hour attribution window. Read that page if the commercial side is what concerns you.
What we never collect
No payment information, ever. Store software is installed as part of the platform and a cart page exists, but nothing is sold here, no payment processor is connected and no transaction has been taken. We do not run advertising networks that build behavioral profiles, we do not buy visitor data from brokers, and we do not knowingly collect special category information such as health, biometric, political or religious data.
Why we are allowed to hold it
Where the law requires a basis for processing, ours are straightforward. Contact form data is processed because you chose to send it and we need it to reply. Server logs and security records are processed for our legitimate interest in keeping the site available and defended. Analytics is processed for our legitimate interest in understanding which content is useful, and it is configured to be light rather than comprehensive for that reason. Where consent is the correct basis in your jurisdiction, your browser cookie controls are how it is given or withheld.
Who else can see it
Running a website means other companies handle data on the way through. The ones that matter here are:
- The hosting provider. The server that stores this site and its database, including contact form submissions, is operated by a third party hosting company.
- Cloudflare. Traffic to bagsby.com passes through Cloudflare for security filtering and delivery, so request data reaches Cloudflare before it reaches us.
- Analytics providers. Traffic measurement is handled by analytics software, some of it running on our own server and some provided as a service.
- Email delivery. Contact form messages are delivered by email and pass through the mail provider handling that delivery.
- Amazon. Amazon receives nothing from us about you. It learns of the click when your browser arrives on its site carrying our referrer tag, and from that point Amazon’s own privacy notice applies to everything you do there, including anything you buy.
Beyond that, we disclose data only where the law compels it, where it is needed to establish or defend a legal claim, or where we must act on a credible threat to the site or to a person. We do not sell personal information and we do not share it for cross context behavioral advertising.
Where it is held
The site and its providers operate internationally, and data may be processed in a country other than the one you are reading from, including the United States. If you are somewhere with data export rules, treat that as the position rather than assuming local storage.
How long we keep it
These are targets we work to, not promises we can guarantee, because backups, caches and provider retention schedules are outside our direct control.
- Contact form submissions: aimed at removal within about 24 months of the conversation ending, sooner on request.
- Server and security logs: rotated by the host on a short cycle, generally weeks rather than years.
- Analytics: retained in aggregate for trend comparison across years, with no individual record to retain.
- Backups: overwritten on the backup rotation, so a deleted record can survive in a backup for a period after deletion from the live site.
Your rights and how to use them
Depending on where you live you may have the right to ask what we hold about you, to have it corrected, to have it deleted, to object to or restrict certain processing, to receive a copy in a portable form, and to complain to your data protection authority. Nothing here takes away a right your local law gives you.
All of these go through the same route: the contact form. Say what you want done and give us enough detail to find the record, which in practice means the email address you used and roughly when you wrote. We will not ask for identity documents. Be aware of the honest limit: if all we hold is a server log line, we usually cannot connect it to you as a person, and inventing a link in order to satisfy a request would be worse for your privacy, not better. We act on requests as promptly as we can and within the time limits our applicable law sets.
Exercising a right costs nothing and does not affect what you can read on this site.
Children
This site is written for adults buying travel gear, and that includes the kids’ luggage section, which is aimed at the parent making the purchase rather than the child using the case. We do not direct the site to children under 13 and we do not knowingly collect their personal information. If you believe a child has sent us something through the form, write to us and we will delete it.
Security
The site is served over an encrypted connection, sits behind a filtering layer, and is kept patched. Access to the database is restricted to the people who maintain it. That is a reasonable standard and it is not a guarantee. No site can promise it will never be breached, and any site that does is overselling. If a breach affects personal data we hold, we will act on it and notify where the law requires.
Changes to this policy
This policy changes when the software or the providers behind the site change. The revision date below is the reliable indicator, since we do not have a mailing list to announce it through. Continued use of the site after a revision means the current version applies.
Questions about anything on this page go through the contact form.
Last updated: August 18, 2026.