Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account information: name, email address, hashed password, and role (customer, professional, or admin) when you create an Account.
• Order information: items purchased, billing and shipping addresses, order status, tracking number, and order history.
• Payment information: handled by Stripe, Inc. We do NOT store full credit card numbers or CVV codes on our systems; we receive a tokenized reference and limited last-4 information for receipts. When you check out, we send Stripe the name, email, phone number and shipping address you entered; where sales tax applies, Stripe stores them as a customer record in our Stripe account so it can calculate the tax from your shipping address.
• Compatibility Check inputs: photos you upload of your appliance's model plate, the Model Number extracted by our OCR (after your confirmation), the symptom or problem text you provide, and the Part(s) of interest.
• Compatibility Check outputs: Ratings (GREEN, YELLOW, RED), confidence scores, and human review notes (where applicable for YELLOW ratings).
• Professional verification documents: if you register as an appliance repair professional, you may upload business license, tax-ID, or resale certificate documentation. These are stored encrypted and accessible only to admin staff for verification purposes.
• Communication content: messages you send to support, refund/warranty claim narratives, and DMCA notices or counter-notices.
• Questions and contact requests: when you ask us something through the contact form, the "Ask about this part" form on a part page, or the form on a compatibility result, we collect your email, and if you give them, your name, your phone number and your message, together with the part or compatibility check it is about. When you call us, we may write down notes of the call (your name, number, email and what you asked). We never record calls.
• Technical information: IP address, browser type, device type, pages visited, referring URL, and timestamps.
• Cookies: session cookies for authentication, cart-state cookies, and — only if you accept them — analytics cookies and session recordings. See Section 5 for details.

2. How We Use Your Information

We use information for the following purposes:

• Provide the Site and the Compatibility Check service.
• Process Orders and payments, fulfill shipping, and communicate about your purchases.
• Operate the Compatibility Check (your model number, symptom text, and part of interest are processed by a third-party large-language-model provider — see Section 4 sub-processor list).
• Conduct human review when the AI is uncertain (YELLOW Ratings) — only the case data needed for review is shared with the appliance parts specialist on duty.
• Send transactional emails (order confirmations, shipping notifications, validation results) via Resend, Inc.
• Send marketing emails (new parts, deals, restock alerts) via Resend, Inc. — only if you check the opt-in box at checkout and then confirm via a link we email you. This applies equally whether or not you create an account. You can unsubscribe at any time, and not opting in never affects your ability to purchase or your transactional emails.
• Send up to three reminders about a checkout you started and did not finish (about 1 hour, 1 day and 3 days later; for example, "You left something in your cart") to the email address you entered at checkout, even if you did not opt in to marketing emails. The reminders stop as soon as you buy, write to us, or unsubscribe. Every reminder identifies itself as promotional and includes a one-click unsubscribe link; once you unsubscribe we stop sending you reminders and marketing emails, while emails about orders you place still reach you.
• When a Compatibility Check shows that a part fits and you have not bought it, send one follow-up email about that part about a day later, to the email you left on the result or the email of your Account. After an order ships, send one email asking you to review its parts. Both identify themselves as promotional and include a one-click unsubscribe link.
• Detect and prevent fraud, abuse, and security incidents.
• Verify Professional Account eligibility and ongoing good standing.
• Comply with legal obligations (tax records, court orders, regulatory inquiries).
• Improve our service through aggregated, de-identified analytics.
• Respond to your requests (refund, warranty, support, data subject requests — see Section 6).
• Answer the questions and contact requests you send us: we email you an automatic confirmation with our business hours, and a parts specialist replies by email or calls you back if you gave a phone number. We use your phone number only to call you back — we never send marketing texts. We may also send one follow-up email about the part or question you asked about; it includes an unsubscribe link, and once you unsubscribe we stop.

3. Information We Do NOT Use

We do NOT sell your personal information. We do NOT use the photos you upload for advertising or for training third-party AI models. We do NOT share your personal information with marketing partners. The privacy invariant of our AI processing is that we send only the model number, symptom text, and part title to the AI provider — never your email, name, order ID, validation request ID, or other personally identifying information. This invariant is enforced by automated tests in our codebase.

4. Sub-Processors and Third-Party Service Providers

We use the following service providers, each of whom processes data only as needed to perform their function and is contractually bound to confidentiality and security obligations. This list is versioned with this Policy; the effective version is identified by the metadata at the top of this document.

We will update the table above when sub-processors change. Where required by applicable law, we will provide notice of changes that affect a sub-processor handling sensitive personal information.

5. Cookies and Similar Technologies

We use a minimal set of cookies:

• Session cookies (essential) — required for authentication. Without these, you cannot log in. Lifetime: until you log out or 30 days, whichever is sooner.
• Cart-state cookie (essential for approved professionals) — used to hold cart contents between page loads for Professional Accounts. Lifetime: until checkout or 14 days, whichever is sooner.
• Consent cookie (essential) — remembers whether you accepted or declined analytics (itg_consent). Lifetime: 1 year.
• Google Analytics cookies (analytics, only if you accept) — _ga and _ga_<id>, a pseudonymous identifier that lets us count visits and see which parts and checkout steps work. Lifetime: up to 2 years. If you decline, Google Analytics still receives cookieless signals (Google's Consent Mode) about the pages and parts you view, cart and checkout steps (including the destination state, never the address) and compatibility checks or back-in-stock requests, with no identifier stored on your device and no way for us to link them to you; our server does not report your purchase to Google Analytics.
• Microsoft Clarity cookies (analytics, only if you accept) — _clck and _clsk, used to group the pages of one visit into a session recording. Lifetime: up to 1 year. If you decline, Clarity is not loaded at all.

We do not use advertising cookies, retargeting pixels, or cross-site tracking for advertising, and we do not share analytics data with advertising networks: advertising signals are always sent to Google as denied.

Our own visit count, without cookies. Whether or not you accept analytics, each page you view sends our server the kind of page (only the first part of its address, such as /parts — never a part, order or link identifier), the website that sent you there (its domain only) and any campaign tag in the address you arrived on (utm_source, utm_medium); adding a part to the cart is counted too. Your browser keeps that origin in session storage until you close the tab, with no identifier. To count unique visitors per day our server combines your IP address and browser type with a random value that changes every day and is deleted shortly after the day ends; the result is only kept inside a statistical counter that cannot list or identify anyone. We store only daily totals (for example, views of part pages that came from a search engine) — never your IP address, browser details, the full address of a page or anything that identifies you. The only exception is our abuse limit, which keeps your IP address for up to 10 minutes to stop a script from sending thousands of fake views. When you start a checkout, the kind of source your visit came from (for example Google, ChatGPT or a direct visit) is saved with that order, so we can tell which sources lead to purchases — only that label, never the address of the site or anything about the visit itself. Requests from automated tools that identify themselves as bots but that we do not recognize have their browser-type string (user agent) kept for up to 48 hours, so we can tell which tool they are; this is never done for people browsing the Site.

Managing cookies.

The banner shown on your first visit lets you accept or decline analytics; nothing beyond the essential cookies is set until you accept. To change your choice, delete the itg_consent cookie for itgparts.com in your browser (the banner then asks again). You can also disable cookies in your browser settings, but blocking the essential ones will prevent log-in and the cart from working.

6. Your Rights and How to Exercise Them

Universal rights.

You may at any time:

• Review and update your Account information through your account settings.
• Request a copy of the personal information we hold about you.
• Request correction of inaccurate information we hold about you.
• Request deletion of your Account and associated personal information, subject to retention requirements in Section 9.
• Request that we restrict processing of your information to specific purposes.
• Object to processing based on legitimate interest, where applicable.

How to make a request.

Send an email to support@itgparts.com with the subject line "Data Subject Request" and include: (a) the type of request (access, correction, deletion, restriction, portability, or other); (b) the email address on your Account; (c) any additional information that helps us locate your records; and (d) a description of how you would like to receive a response.

Identity verification.

To protect your information from unauthorized requests, we verify your identity before fulfilling a data subject request. Verification typically consists of (i) confirming the request from the email address registered on the Account, and (ii) requesting confirmation of a recent order detail (such as the date and last four digits of the order total). For sensitive requests (deletion, portability of a full data extract), we may require additional verification such as confirmation of your billing address or recent payment-method last-4. We do not request government-issued ID for verification.

Response timeline.

We respond to data subject requests within thirty (30) calendar days of receiving a verified request, except where applicable law allows a different timeline (for example, under CCPA we may extend by an additional 45 days where reasonably necessary and provide notice within the initial 30-day window). We do not charge for requests, except for repetitive or excessive requests as permitted by law.

7. California Privacy Rights

If you are a resident of California, you have rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

• Right to know what categories of personal information we collect, the sources, the business purposes, and the categories of third parties with whom we share.
• Right to access the specific pieces of personal information we have about you.
• Right to correct inaccurate personal information.
• Right to delete personal information, subject to exceptions.
• Right to limit the use of sensitive personal information.
• Right to opt out of the sale or sharing of personal information — we do NOT sell or share personal information for cross-context behavioral advertising.
• Right to non-discrimination for exercising any of the above rights.

Shine the Light (Cal. Civ. Code § 1798.83).

California residents may request, once per calendar year, a list of the categories of personal information that we disclosed to third parties for those third parties' direct marketing purposes in the immediately preceding calendar year, and the names and addresses of those third parties. We do not disclose personal information to third parties for direct marketing, so our response to such a request is: "no third-party disclosures for direct marketing in the period." Send Shine the Light requests to support@itgparts.com with subject "Shine the Light Request".

Do Not Track and global privacy signals.

Because we do not sell or share personal information for cross-context behavioral advertising, there is no sale or sharing for you to opt out of. A Global Privacy Control (GPC) or similar browser opt-out signal therefore requires no change to how we handle your information — our default practice already matches what such a signal requests. We do not respond differentially to "Do Not Track" browser signals because there is no industry consensus on the meaning of the signal in our service category; we apply the same data-minimization practices to all users regardless of DNT.

Authorized agent.

California residents may designate an authorized agent to make requests on their behalf. The agent must provide written authorization signed by the consumer, and we will verify the consumer's identity through the procedure in Section 6 before fulfilling the request.

8. Children's Privacy and COPPA

The Site is not directed to children under 13 years of age and we do not knowingly collect personal information from children under 13. This Section reflects our compliance with the federal Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501-6506, and 16 C.F.R. Part 312.

We do not knowingly collect, use, or disclose personal information from children under 13 without verifiable parental consent. The Site is intended for adult purchasers of appliance replacement parts, and Account registration requires you to be at least 18 years old (Section 3 of the Terms of Service).

If a parent or legal guardian believes that we have collected personal information from a child under 13 without verifiable parental consent, contact support@itgparts.com immediately and we will promptly investigate and, if confirmed, delete the information. We may require verification of the parent or legal guardian's identity before processing such a request.

9. Data Retention

We retain personal information only for as long as needed to provide the service, comply with legal obligations, and resolve disputes. Specific retention schedules:

• Account information: for as long as the Account is active, plus 12 months after closure for fraud-prevention and re-registration friction. After 12 months, we delete or de-identify Account profile data.
• Order records (including items, prices, shipping addresses, payment-token references): minimum seven (7) years for tax and accounting compliance, then archived or deleted.
• Compatibility Check inputs (photos, model numbers, symptom text, OCR output): up to twelve (12) months for service quality and audit purposes, then aggregated, de-identified, or deleted. We delete sooner upon a verified deletion request.
• Compatibility Check outputs (Ratings, confidence scores, human review notes): retained alongside the related Order or for 12 months if not associated with an Order.
• Professional verification documents: for as long as the Professional Account is active, plus 24 months after downgrade or closure for re-verification continuity.
• Communication content (support emails, refund/warranty claim narratives): five (5) years from the resolution date, for dispute defense.
• Questions, contact requests and call notes that did not lead to a purchase: up to twenty-four (24) months from your last contact, then deleted. If they led to an Order, they are kept with the Order records.
• DMCA notices and counter-notices: minimum five (5) years from filing.
• Server logs (technical information): typically 90 days, longer if needed for ongoing security incident investigation.
• Cookie data: see Section 5 for per-cookie lifetimes.

Retention beyond the above schedules is permitted where required by court order, law enforcement request, regulatory inquiry, or active legal dispute, and is limited to the data scope of that requirement.

10. Security

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• TLS encryption in transit for all connections to the Site.
• Password hashing using bcrypt (12 rounds) — we never store passwords in plaintext.
• AES-256-GCM encryption at rest for high-sensitivity stored data, including admin-managed API credentials and professional-verification documents.
• Role-based access control: customer data is segregated from admin data; admin actions require a separate authentication step.
• Regular dependency auditing (`npm audit`) maintained at zero MODERATE / HIGH / CRITICAL vulnerabilities as a baseline.
• Content-Security-Policy headers with strict-dynamic source policy on script execution.
• Webhook signature verification on all incoming payment and shipping callbacks.

No system is 100% secure, however; we cannot guarantee the absolute security of information transmitted to or from the Site or stored on our systems. If you become aware of a security issue or unauthorized access, contact support@itgparts.com immediately.

11. Data Breach Notification

If we discover that the security of your personal information has been compromised in a manner that triggers notification obligations under applicable state or federal law, we will notify you and the appropriate authorities within the timeframes required by those laws.

Notification scope.

A "compromise" for purposes of notification means unauthorized acquisition of unencrypted personal information that triggers a notification duty under (for example) California Civil Code § 1798.82, New York General Business Law § 899-aa, or the Florida Information Protection Act. Encryption with AES-256-GCM is treated as a safe-harbor against notification duty in most jurisdictions where the encryption keys were not also compromised.

Notification timeline.

We aim to notify affected users without unreasonable delay and in any case within the shorter of (a) the timeframe required by the strictest applicable law (for example, 60 days under most U.S. state laws, sooner for certain financial-sector triggers), or (b) thirty (30) days from confirmation of the compromise. The notice will describe (i) the categories of personal information involved, (ii) the date or estimated date of the compromise, (iii) steps you can take to protect yourself, and (iv) our contact information for follow-up questions.

Notification method.

We will notify affected users by email to the address on file for their Account, with substitute notice (prominent Site posting + press release where required) if email is not feasible at scale. State attorneys general and other regulators will be notified where the applicable state law requires.

12. Where We Operate; U.S.-Directed Service

We are based in the United States and operate the Site from the United States. All of our sub-processors (Section 4) are located in the United States, and your information is stored and processed in the United States.

U.S.-directed service.

The Site is directed to and intended for users located in the United States. We do not offer the Site or the Parts to individuals located in the European Economic Area, the United Kingdom, or Switzerland, and we do not target or knowingly process the personal information of individuals located in those regions. If you choose to access the Site from outside the United States, you do so on your own initiative; your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your location, and you are responsible for compliance with any local laws applicable to you.

Safeguards.

Regardless of where you are located, we protect your information with the technical and organizational measures described in Section 10 (Security), including TLS in transit, AES-256-GCM at rest for high-sensitivity data, role-based access control, and contractual confidentiality obligations on our sub-processors.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always posted at the Site and dated in the header metadata. Material changes will be communicated by reasonable means (for example, prominent notice on the Site for fifteen (15) days or email to account holders). Continued use of the Site after the effective date constitutes acceptance of the updated Policy. If you do not accept a material change, your remedy is to close your Account before the effective date.

14. Contact

Privacy questions, requests, and complaints may be sent to support@itgparts.com or to G & M INNOVATION GROUP INC, 1070 Montgomery Rd, Altamonte Springs, FL 32714. Formal legal notices regarding this Policy must follow the procedure in Section 20 of the Terms of Service.