What Pexalod knows about a visitor who asks us for a part

This policy took effect on September 14, 2026. Every version before that date is superseded. If you read this page after that date without a newer effective date shown above, this is the version in force.

Pexalod, trading as pexalod.com, operates this website and the catalog it describes. Our postal address is 164 Cedar Court, Floor 2, Austin, Texas 67482, Austin, Texas, United States. We are the controller of the data described below — the party that decides what is collected and why, not a processor working for someone else.

This policy is written under the law of Texas, United States. Anything not resolved here would be heard in the courts of Austin. Where a visitor reaches us from Europe, the sections on GDPR further down apply to that visit as well.

The inquiry form on the contact page and inside the catalog writes name, phone, email, the shipping address or route, the kind of enquiry, the free-text message, the specification you're asking about, and the tick confirming consent. Two hidden fields named company and website sit on that form unlabelled — they exist to catch automated spam, not to collect anything from a person filling it in by hand.

The parts support chat keeps whatever you type into it, plus a name, phone or email if you choose to give one, and a token stored in your browser so the conversation can continue if you come back.

Alongside both, our server automatically logs the IP address a request came from, the browser's user-agent string, the page that referred you here, and the two moments that matter for a form: when the page was rendered and when you pressed send.

A cookie identifier and a consent record are set in your browser — see the cookie policy for the exact names. If you arrived from a paid link, the URL usually carries an advertising click identifier: gclid from Google Ads, msclkid from Microsoft Advertising, or fbclid from Meta Ads. We do not add anything to that identifier beyond what the platform already attached to your click.

Contact details and message content exist to answer the question you asked — confirm a cross-reference, quote a price basis, or arrange same-day dispatch. Nothing in that data is used to build a marketing profile of you.

Log data — IP address, user-agent, referrer, timestamps — is used to keep the site running, catch abuse of the form, and debug something that broke. Cookie and advertising identifiers measure whether a specific ad click turned into an enquiry, and let Google Ads, Microsoft Advertising and Meta Ads report on the campaigns that sent the click, when you have allowed that storage.

Google Ads, Microsoft Advertising and Meta Ads send paid traffic to this site today. Each one attaches its own click identifier to the link a visitor follows: gclid for Google Ads, msclkid for Microsoft Advertising, and fbclid for Meta Ads, where a Meta campaign is running. None of the three has reviewed or approved this site — running an ad on a platform is not the same thing as that platform vetting the destination.

We do not claim this site avoids tracking. It runs advertising measurement, in the present tense, and the sections below explain exactly what that means and how to turn it off.

This site runs Google's Consent Mode v2 (also written consent mode). Four signals — ad_storage, ad_user_data, ad_personalization and analytics_storage — start out denied for every visitor, before you have made any choice. Nothing tied to those four signals fires until you press Allow on the cookie banner.

If you press Decline, or you had previously allowed storage and change your mind, all four signals are set back to denied immediately. The advertising platforms named above receive the denied signal itself, so they know not to store or use identifiers for that visit, but they do not receive the content of anything you typed into the form.

We do not sell data to anyone. A limited set of parties handle it on our behalf or as independent advertising platforms:

• Google Ireland Ltd / Google LLC, running Google Ads, receiving the gclid identifier and the consent signals described above.
• Microsoft Ireland Operations Ltd, running Microsoft Advertising, receiving msclkid. Its own handling of that data is covered by the Microsoft privacy statement at privacy.microsoft.com.
• Meta Platforms Ireland Ltd, running Meta Ads, receiving fbclid on the campaigns that use it.
• Our hosting provider, which serves this site and stores the enquiry database, and our mail provider, which carries the notification email of a new enquiry into our inbox.

Our warehouse and our records sit in Austin, Texas. The advertising platforms named above are international companies with infrastructure outside the United States, including in the European Union, so a click identifier can cross a border as part of their own reporting pipeline. Where that happens for a European visitor, it relies on the standard contractual clauses or an equivalent safeguard those platforms already have in place for their advertiser tools — we do not run our own separate transfer mechanism on top of theirs.

The site is served over an encrypted connection. Access to the enquiry database and the chat transcripts is limited to the small team who answer parts questions, not opened to the whole warehouse floor. We take no card data and run no payment step on this site, so there is no card number to protect in the first place — see the ordering terms on the terms page for how an order is actually confirmed and paid.

If you reach us from Europe, the General Data Protection Regulation (gdpr) gives you seven concrete rights over the data in section 03: access to a copy of it, rectification if it's wrong, erasure once we no longer need it, restriction of how we use it while a dispute is sorted out, portability in a common file format, objection to processing based on legitimate interest, and withdrawal of consent at any time, with no effect on anything done before you withdrew it.

California residents have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa): to know what we hold, to delete it, to correct it, and to opt out of the sale or sharing of personal information. We do not sell data for money, but the advertising identifiers described in section 06 count as "sharing" under that law when you have allowed advertising storage, and you can opt out of that sharing at any time through the cookie banner or the choices on the cookie page.

Residents of other US states with comparable privacy laws currently in force have equivalent rights to know, delete, correct and opt out, exercised the same way, through section 17 below.

If your browser sends the Sec-GPC header, we treat that as an opt-out signal automatically — Global Privacy Control (global privacy control) is honoured the moment the request arrives, and advertising storage is held denied for that visit without asking you to click anything first.

This is a business-to-business parts catalog. It is not directed at children, and we do not knowingly collect data from anyone under 16. If we learn a submission came from a child, we delete it.

You can complain to your state Attorney General, or, if you are a California resident, to the California Privacy Protection Agency. You do not need to contact us first, though we would rather have the chance to fix it — see section 19 for a direct line to a person.

If we change what we collect or why, we update the effective date at the top of this page and in section 01. We do not silently change the meaning of the sections above without moving that date, so an old bookmark of this page still tells you honestly what applied then.