Privacy Policy

Effective date

This policy took effect on September 24, 2026. It covers the vexnaros.com site as it operates from that date forward.

Who operates this site

Vexnaros is the controller of the data described here, trading at vexnaros.com from 45 River Road, Büro 5, Austin, Texas 26765, United States. Four people run the shop and the site. Any question about this policy reaches the same small team that answers the phone.

What we actually collect

The inquiry form on contact.html and on each item page takes your name, phone, email, the address an item would ship to or be picked up from, the kind of inquiry, your message, the specification you asked about, and the consent tick. Alongside that submission the server automatically records your IP address, your browser's user-agent string, the page that referred you, and the timestamps for when the form was rendered and when it was sent.

The support chat widget keeps the conversation itself and stores a token in your browser so you can return to an open conversation; if you give a name, phone or email in chat, that travels with the token too.

Technical and log data is generated by every visit regardless of whether a form is submitted: server access logs, and cookie or local-storage identifiers described fully in the cookie policy. If you arrive through a paid ad, the URL usually carries an advertising click identifier — gclid from Google, msclkid from Microsoft, or fbclid from Meta — which we describe below.

What each category is used for

Inquiry details exist to let us quote stock, arrange shipping or pickup, and answer the question you actually asked. Chat details exist to keep a conversation continuous across a browser session. Log data exists to keep the site running and to investigate abuse if it happens. Cookie and click identifiers exist to measure whether a paid ad led to an inquiry, and to let the ad platforms build an audience for future campaigns where you've allowed that.

The legal basis for each

Processing an inquiry you send us rests on contract — you're asking us to quote or arrange an item, and we need your details to do that. Server logs and basic security measures rest on legitimate interest in keeping the site working and safe. Analytics storage and advertising storage rest on consent: nothing in that category runs until you actively allow it through the cookie banner, and Consent Mode v2, described below, enforces that on the technical side.

The advertising platforms running on this site

Google Ads and Microsoft Advertising send paid traffic to this site today, and Meta Ads may run a campaign here as well. When a click arrives from one of those platforms, the destination URL usually carries a click identifier: gclid for a Google Ads click, msclkid for a Microsoft Advertising click, and fbclid for a Meta click. Each identifier lets the sending platform match that click back to an ad it served, for measurement, and, where you've allowed it, for building or refining an audience.

Consent Mode v2 and what it holds back

This site runs Google's consent mode. Until you actively allow storage through the cookie banner, four signals are held denied: ad_storage, ad_user_data, ad_personalization and analytics_storage. Denied means the underlying cookies and identifiers for advertising and analytics are not set, and no personalized signal is passed to Google, Microsoft or Meta. The moment you decline, or later withdraw a choice you made, all four signals are set back to denied immediately — nothing about that state is delayed or partial.

Who else receives this data

Google Ireland Ltd and Google LLC receive the gclid identifier and, once you've allowed ad and analytics storage, the consent signals tied to a Google Ads click. Microsoft Ireland Operations Ltd receives msclkid under the same terms for Microsoft Advertising; its own handling of that data is covered by the Microsoft privacy statement at privacy.microsoft.com. Meta Platforms Ireland Ltd receives fbclid where a Meta Ads campaign is running. Beyond the ad platforms, our hosting provider stores the site files and the enquiry database on our behalf, and our mail provider carries the notification email that tells us an inquiry arrived. None of these parties are given more data than the categories described above.

Transfers outside the country of collection

The hosting and mail providers that serve this site operate inside the United States, where the data is collected. Google, Microsoft and Meta each operate internationally and may process a click identifier or consent signal outside the country where you clicked; each of those companies maintains its own cross-border transfer mechanism, including standard contractual clauses where the visitor is in the European Economic Area, as part of their role as the businesses that actually move that data internationally.

How long each category is kept

Inquiries and their email copies are kept for 24 months, long enough to cover a warranty question about an item bought near the end of that window. Chat transcripts are kept for 18 months. Server and access logs are kept for 90 days and then purged on a rolling basis. The record of a consent choice is kept for 6 months, after which the banner will ask again.

How it's protected

Form submissions travel over an encrypted connection to the server. Access to the enquiry database and chat records is limited to the four people who run the shop. Honeypot fields on every form catch most automated spam before a human ever reads it, which keeps the volume of stored submissions closer to genuine inquiries than noise.

Rights under the GDPR

If you're reaching this site from Europe, the GDPR gives you the right to access the data we hold about you, to have it corrected if it's wrong, to have it erased, to restrict how we process it, to receive a copy in a portable format, and to object to processing based on legitimate interest. Where processing rests on consent — the advertising and analytics storage described above — you can withdraw that consent at any time with the same ease you gave it, through the cookie banner or the cookie settings link in the footer.

Rights under US state privacy law

If you're a resident of California, the CCPA, as amended by the CPRA, gives you the right to know what personal information we've collected, to delete it, to correct it, and to opt out of the sale or sharing of personal information — a category into which the advertising identifiers described above fall when you haven't declined them. Residents of other US states with a comparable privacy law have equivalent rights under that state's statute. We do not sell personal information for money; "sharing" here refers specifically to the advertising identifiers sent to Google Ads, Microsoft Advertising and Meta Ads.

Global Privacy Control

If your browser sends the Global Privacy Control signal, we treat it as a valid opt-out of the sale and sharing of personal information without asking you to also click through the cookie banner. Advertising and analytics storage stay denied for that visit and Consent Mode v2 reflects the same denied state described above.

Children

This site is built for adults arranging household and garden purchases. It is not directed at children, and we do not knowingly collect data from anyone under 13. If you believe a child has submitted a form here, write to [email protected] and we'll remove it.

Complaints

If you think we've mishandled your data, you can write to us first at [email protected]. You also have the right to complain directly to a data protection authority — your state Attorney General for a US state privacy matter, the California Privacy Protection Agency if you're a California resident, or your national supervisory authority if you're in Europe.

How to exercise these rights

Email [email protected] or write to Vexnaros, 45 River Road, Büro 5, Austin, Texas 26765, United States, describing what you want — a copy of your data, a correction, deletion, or an opt-out of advertising sharing. We answer within 10 days. The data request page has a form that routes straight to us if you'd rather not compose an email.

Changes to this policy

If this policy changes in a way that affects what we collect or why, we update the effective date at the top of this page and, for a material change, note it on the homepage for a period afterward. We don't send an email announcing routine wording clarifications.

Contact

Reach a person, not a form queue: [email protected], or +1 (448) 555-8118 most afternoons. Postal mail goes to Vexnaros, 45 River Road, Büro 5, Austin, Texas 26765, United States.