Privacy Notice

Effective date: August 15, 2026

Last Updated: August 15, 2026

Version: 2026-08-15

1. Introduction and Scope

This Privacy Notice explains how WPARTS LLC (“WPARTS”, “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use wparts.com, hosted seller sites, calendar booking, APIs, and related services (the “Services”). WPARTS LLC is a California limited liability company.

This Notice applies worldwide. Additional rights for California residents appear in Section 14. Additional rights for EEA/UK residents appear in the EEA/UK Privacy Addendum.

Privacy contact: [email protected] · Legal: [email protected]

Submit a request using our privacy request form or by email. If a translation conflicts with the English version, the English version controls.

2. Controller

WPARTS LLC is the controller for personal information we collect to operate the marketplace, accounts, security, and platform messaging.

Sellers as controllers. A Seller is the controller for: (a) lead-form submissions on that Seller’s hosted site; (b) buyer contact data shared so the Seller can fulfill an Order or inquiry; and (c) any analytics or advertising tools the Seller configures on that site. WPARTS hosts the site and acts as a processor / service provider for those seller-controlled activities.

3. Categories of Personal Information We Collect

We collect the following categories. We do not collect payment card PAN, bank account numbers, or tax identification numbers as a routine part of the Services, because we do not process payments or issue tax forms.

• Identifiers: name, email, phone, postal address, account ID, username.
• Commercial / transaction data: Order requests (contact and shipping address, line items, comments). No card numbers.
• Vehicle and fitment data: VIN, year/make/model, garage vehicles, part requests, and compatibility queries. We use this to operate search, listings, seller-site vehicle pages, and optional search or assistant features. When you use those features, we may send a VIN or vehicle descriptors to service providers that return catalog or fitment results.
• Device and security data: IP address, user agent, coarse location derived from IP, and device or security identifiers used for account security, fraud prevention, and abuse prevention. This is not used for advertising without your consent or a valid opt-out exception.
• Internet / activity: pages viewed, search queries, locale, site-builder drafts, cookie identifiers.
• Professional / business (Sellers): company name, address, phone, city, description, uploaded company documents, business type. We do not collect W-9/W-8 or payout bank details because we do not run payouts.
• Calendar guests: name, email, phone, and appointment details for bookings.
• Site leads: name, contact details, vehicle/message content submitted on a Seller site.
• Secure Rooms metadata: membership, timestamps, sizes, audit logs (IP, user agent). Message content is end-to-end encrypted; we store ciphertext we cannot read.
• Notifications: delivery records for transactional messages you request or that are needed to operate the Services, which may include message body text.
• Inferences: limited preference signals for search and recommendations. We do not sell a marketing profile.
• Sensitive personal information (limited): precise geolocation only if you grant it (for example, when you use a map picker); government ID only if you voluntarily upload it in company documents. VIN may be treated as a vehicle-linked identifier. Device and security identifiers are used for security, not advertising, unless you consent.

Sources: you; your device; Sellers (when they message or fulfill); service providers that return search, catalog, or fitment results; and the categories of service providers described in Section 5 and on our Subprocessors page.

4. Purposes of Processing

• Operating accounts, listings, Order requests, part/service requests, hosted sites, and calendar bookings (contract / legitimate interests).
• Security, fraud prevention, and abuse detection (legitimate interests / legal obligation).
• VIN/fitment search and optional assistant features (contract / legitimate interests). This may involve an international transfer to service providers that return results.
• Analytics and advertising cookies only with consent (EEA/UK) or after you have not opted out (CPRA sale/share), and never when a GPC signal is present.
• Transactional messages needed to operate the Services, and optional notifications you enable (contract). Marketing email only with consent or another lawful basis.
• Legal compliance, including responding to lawful requests and copyright notices.

5. Disclosure / Recipients

We disclose personal information to:

• Service providers in these categories: hosting and storage; email and other transactional messaging; security and abuse prevention; maps and geocoding when you use a map; catalog, fitment, and optional assistant providers; coarse geolocation; and error or reliability monitoring. See Subprocessors. A current named list is available to Sellers under contract and to others on confidential request at [email protected].
• Sellers - contact and Order/lead details needed to respond to you. The Seller is an independent controller for that use.
• Seller-configured analytics or advertising tools - only after cookie consent (or a valid US opt-out exception that is not overridden by GPC). The Seller is the controller of those tools.
• Law enforcement, courts, or government agencies when required by law.
• Professional advisors and successors in a merger or sale of assets, under appropriate safeguards.

We do not disclose data to payment processors, banks, or shipping carriers as payment or logistics processors, because those services are not integrated.

6. Sale / Sharing; CPRA Table

We do not sell personal information for money. Disclosure of identifiers and internet activity to advertising or analytics partners (including tools a Seller enables on a hosted site) may be “sharing” or a “sale” under the CPRA when used for cross-context behavioral advertising. You may opt out via the footer link Do Not Sell or Share My Personal Information, Cookie Settings, the privacy request form, or a Global Privacy Control (GPC) signal. We honor GPC as an opt-out of sale/share.

7. Cookies and Similar Technologies

See the Cookie Policy. Necessary cookies run the site. Analytics and advertising cookies load only after you accept, or, for US users, until you opt out. We honor GPC. Security technologies that are not cookies may also be used to protect accounts and the Services.

8. International Transfers

We are based in the United States. Personal information, including VIN queries when you use search or assistant features, may be processed in the United States and other countries where our service providers operate. For EEA/UK transfers we rely on the EU Standard Contractual Clauses and UK addenda where required. Details: EEA/UK Privacy Addendum.

9. Retention

• Account data: until deletion + up to 12 months for security logs.
• Order / lead / booking records: up to 7 years where needed for disputes or legal claims (these are not tax-collection records of WPARTS).
• Security logs: up to 24 months.
• Records of your acceptance of our terms: up to 5 years or as required to demonstrate consent.
• Marketing opt-out and GPC records: at least 12 months, typically 5 years.
• Secure Rooms ciphertext: per room retention (30 / 90 / 365 days or until deleted).

10. Security

We use TLS in transit, access controls, and secure hosting. No method is perfect. We will notify affected users and regulators as required by law if a breach occurs.

11. Children’s Privacy

The Services are not directed to children under 13. We do not knowingly collect personal information from children under 13. Accounts require age 18. If you believe we have collected data from a child, contact [email protected].

12. Automated Decision-Making

We use automated systems for fraud and risk scoring, account security, and search ranking. These do not produce legal or similarly significant effects without human review available on request for EEA/UK users.

13. Your Rights; How to Submit Requests

Depending on your location, you may have rights to access, correct, delete, port, opt out of sale/share, limit use of sensitive personal information, appeal a denial, and lodge a complaint with a regulator.

Two methods:

1. Privacy request form (access, delete, correct, opt-out, limit SPI, appeal).
2. Email [email protected].

We respond within 45 days (CPRA) or one month (GDPR), with lawful extensions. We will verify identity for access, correction, and deletion. Opt-out of sale/share and GPC do not require government ID.

Authorized agents (California): an authorized agent may submit a request with proof of authorization. We may still verify the consumer.

Shine the Light (Cal. Civ. Code § 1798.83): we do not disclose personal information to third parties for their direct marketing for money. You may email [email protected] with subject “Shine the Light”.

14. California Residents - CPRA / CCPA

• Right to Know categories and specific pieces, sources, purposes, and recipients.
• Right to Delete (subject to exceptions).
• Right to Correct inaccurate personal information.
• Right to Opt-Out of Sale or Sharing - footer link, Cookie Settings, form, GPC.
• Right to Limit Use of Sensitive Personal Information to what is necessary to provide the Services.
• Right to Non-Discrimination.

Other U.S. state laws (including VCDPA, CPA, CTDPA, UCPA, OCPA, TDPSA, and similar) provide overlapping rights to access, delete, correct, and opt out of targeted advertising or sale. We will honor those rights through the same form and email when they apply to you.

15. Marketplace and Hosted-Site Specifics

Buyer contact data is shared with the Seller fulfilling the Order or lead. Seller-site lead forms: the Seller is controller; WPARTS is processor. Analytics or advertising tools a Seller enables on a hosted site are the Seller’s processing; we load those tools only after visitor consent, where required.

16. Secure Rooms

We store ciphertext we cannot decrypt, plus membership metadata, timestamps, sizes, and audit logs. Staff can read content only if a participant files a report and consents to hand over room keys. Retention follows the room setting. Account deletion removes that user’s cryptographic identity and key backups.

17. Changes

We may modify this Notice. Material changes (including new sale/share practices) will be posted with a new Effective Date and, where required, we will ask for affirmative re-acceptance.

18. Contact

WPARTS LLC

[email protected] · [email protected]
Imprint