Effective date
This policy takes effect on 28 September 2026 and replaces any earlier version. The date at the top of the page changes whenever the text does.
Who runs this site
Zavellora, trading at zavellora.us, is the controller of the personal data described here. Postal address: 34 River Road, Floor 2, Austin, Texas 37641, United States. Email [email protected], phone +1 (204) 555-4462. We are a small team selling LED strip, channel, drivers and controls by inquiry. There is no account system, no login and no payment on this site.
What we collect
From the parts list form (it posts to submit.php): your name, phone, email, address or ZIP, the kind of inquiry, your message, the specification you paste in (run lengths, strip, feed distance) and whether you ticked the consent box.
Recorded with every form automatically: your IP address, your browser's user-agent string, the referring URL, the moment the form was rendered and the moment it was sent. The timing tells us whether a human or a script filled it in.
From the support chat (chat.php): the messages you and we write, plus a name, phone or email if you choose to give one. A token is kept in your browser's local storage so you can come back to the same conversation.
From your browser: the consent choice you make, stored under site_consent_v2. If you allow storage, advertising cookies set by Google, Microsoft and Meta. If you arrive from an ad, the click identifier on the link: gclid, msclkid or fbclid.
We do not collect payment data, card numbers, passwords or government IDs. Nothing is sold on this site, so none of that is ever asked for.
What each piece is used for
- Form fields: to work out a load sheet, reply with a parts list and a USD quote, and ship to the right place.
- Chat messages and token: to answer your question and keep the thread together across visits.
- IP, user-agent, referrer, timing: to block spam and abuse, and to fix the site when something breaks.
- Consent record: to remember your choice so the banner does not ask again on every page.
- Ad cookies and click identifiers: to measure which ads lead to an inquiry, so we stop paying for the ones that do not.
Legal bases
For visitors covered by the GDPR, each purpose rests on one basis, stated here plainly.
| Purpose | Basis | Why |
|---|---|---|
| Reply and quote | Contract | Steps you asked for before a possible order. |
| Chat support | Contract | You started the conversation to get an answer. |
| Spam and security logs | Legitimate interest | Keeping the form usable and the server safe. |
| Consent record | Legal obligation | We have to be able to show what you chose. |
| Ad measurement | Consent | Off until you press Allow, off again when you decline. |
Advertising platforms
This site takes paid traffic today. Google Ads, Microsoft Advertising and Meta Ads send visitors here. When you click one of those ads, the platform adds its own click identifier to the link: gclid for Google Ads, msclkid for Microsoft Advertising, fbclid for Meta Ads. If you allow storage, the platform's tag reads that identifier and tells the platform when an inquiry is sent, so we can see which ad led to it. If you decline, the identifier stays in the address bar and nothing reads it for ad measurement.
No platform has told us anything about you beyond that link. We do not upload customer lists to them.
Consent Mode v2
We run Google Consent Mode v2. Before you choose, four signals are set to denied: ad_storage, ad_user_data, ad_personalization and analytics_storage. They switch to granted only when you press Allow. If you press Decline, or later withdraw through the Cookie settings link in the footer, all four go straight back to denied. With them denied, tags may send cookieless pings that carry no identifier we can tie to you. The full list of storage keys is on the cookie policy.
Who receives data
- Google Ireland Ltd and Google LLC, for Google Ads. Attaches gclid to a click and receives the consent signals.
- Microsoft Ireland Operations Ltd, for Microsoft Advertising. Attaches msclkid. Its handling is covered by the Microsoft privacy statement at privacy.microsoft.com.
- Meta Platforms Ireland Ltd, for Meta Ads, where a campaign runs there. Attaches fbclid.
- Our hosting provider, which serves the site and stores the inquiry database and chat transcripts.
- Our mail provider, which carries the notification of each inquiry to our inbox.
We do not sell personal data to anyone, and we do not pass inquiries to installers or other sellers.
Transfers outside your country
We are in Texas and our host stores data in the United States. If you write from Europe, your data crosses to the US when you send the form. That transfer is needed to answer the inquiry you sent. Where Google, Microsoft or Meta move data between their Irish entities and the US, they rely on the EU Standard Contractual Clauses and, where they are certified, the EU-US Data Privacy Framework.
How long we keep it
| Record | Kept for |
|---|---|
| Inquiries and email copies | 24 months from the last message |
| Chat transcripts | 12 months |
| Server and access logs | 60 days |
| Consent choice | 12 months, then the banner asks again |
Cookies set by the ad platforms follow the lifetimes listed in the cookie table. After these periods the record is deleted, not archived.
How it is protected
The site is served over HTTPS only. The inquiry store sits outside the public web folder and is reachable only through a password-protected operator panel used by our own staff. Honeypot fields and timing checks turn away most automated spam before it is stored. No system is proof against everything; if we find a breach that puts your data at risk, we tell you by email.
Your rights under the GDPR
If you reach this site from the European Economic Area, the UK or Switzerland, the GDPR gives you these rights over your data:
- Access: a copy of what we hold.
- Rectification: correct anything wrong.
- Erasure: have it deleted.
- Restriction: have us stop using it while a dispute is settled.
- Portability: get it in a machine-readable file.
- Objection: object to use based on legitimate interest.
- Withdrawing consent: at any time, through Cookie settings in the footer, without affecting what happened before.
Your rights in US states
If you live in California, the CCPA as amended by the CPRA gives you the right to know what we collect, to delete it, to correct it, and to opt out of its sale or sharing for cross-context behavioural advertising. We do not sell personal data. Ad cookies can count as sharing under California law, which is why they stay off until you allow them and switch off when you decline. Residents of Virginia, Colorado, Connecticut, Utah, Texas and the other states with privacy laws in force have similar rights, and we honour them the same way. Using a right never changes the price or service you get.
Global Privacy Control
If your browser sends the Global Privacy Control signal (the Sec-GPC header), we treat it as an opt-out of sale and sharing. The ad signals stay denied and the banner does not ask you to change that.
Children
This site sells electrical components to adults. It is not meant for anyone under 16 and we do not knowingly take data from children. If a child has sent us something, write to us and we delete it.
Complaints
Tell us first if you can, because most things are fixed in one email. You may also complain to your state Attorney General, and in California to the California Privacy Protection Agency. Visitors in Europe may complain to the data protection authority in their own country.
Making a request
Email [email protected], write to 34 River Road, Floor 2, Austin, Texas 37641, United States, or use the form on the data request page. Tell us the email or phone you used so we can find the record. We answer within 10 days. If we need to confirm it is you, we ask once, using the contact detail already on file.
Changes to this policy
When the text changes, the effective date at the top changes with it. If a change affects what we collect or who receives it, the consent banner asks again on your next visit, and where we still hold your email under the retention periods above, we write to you before the change applies.
Contact
A person reads every message to [email protected]. Phone +1 (204) 555-4462. Post: Zavellora, 34 River Road, Floor 2, Austin, Texas 37641, United States. For questions about a specific cookie, see the cookie policy; for the terms that apply to a quote, see the terms of sale by inquiry.