Privacy Policy

1. Who we are and scope

XPartsLab is operated by Yuxin Digital Intelligence Technology (Shenzhen) Co., Ltd., Room 302, Building 4, Jinyuda Industrial Park, No. 68 Guangshen Road (Shajing Section), Bao'an District, Shenzhen, Guangdong, China. For personal information collected through xpartslab.com, this company is the controller or business unless another entity is identified at the point of collection.

This Policy applies to website visitors, account users, customer and supplier contacts, quote requesters and other individuals whose personal information we process in connection with XPartsLab. It does not apply to employee data or to independent third-party websites and services governed by their own privacy notices.

2. Personal information we collect

Depending on how you interact with us, we may collect:

• Identity and contact information: name, business email, telephone number, job title, organization and account identifier.
• Account and authentication information: login details, encrypted or hashed password data, account preferences and security events.
• Quote and order information: requested processes, materials, quantities, pricing, purchase orders, shipping and billing details, tax or invoice information, order history and support records.
• Manufacturing content: 3D models, 2D drawings, BOMs, specifications, inspection requirements, images and other files or technical information you submit.
• Payment information: payment status, transaction references and limited billing information. Complete card credentials are handled by payment providers rather than intentionally stored by us.
• Communications: inquiries, emails, chat or contact-form content, quality claims, feedback and other correspondence.
• Device and usage information: IP address, browser and device type, operating system, timestamps, referring page, pages viewed, clicks, session or visitor identifiers, approximate location inferred from IP and diagnostic logs.
• Compliance information: end-use, end-user, destination, export-control, sanctions-screening, fraud-prevention or identity-verification information when reasonably required.
• Derived information: preferences or business-interest indicators inferred from interactions with our services.

Please avoid including personal information in design files unless it is necessary for the transaction. Do not submit sensitive personal information, regulated health information or government identifiers unless we specifically request it through an appropriate channel and you are authorized to provide it.

3. Sources of personal information

We collect personal information:

• directly from you when you register, request a quote, upload files, order or contact us;
• from your organization, colleagues or authorized representatives;
• automatically from browsers, devices, cookies, local storage, server logs and similar technologies;
• from manufacturing, logistics, payment, verification and other service providers involved in a transaction; and
• from lawful public or commercial sources for business-contact verification, security, fraud prevention and trade compliance.

4. How and why we use personal information

We use personal information for the following purposes and, where European or UK data-protection law applies, on the following legal bases:

• Provide quotes and perform contracts: evaluate files, prepare quotes, create accounts, process payments, coordinate production, inspect, ship, provide support and handle claims. The legal basis is performance of a contract or steps requested before entering a contract.
• Operate and improve the services: maintain the website, remember settings, analyze performance, troubleshoot, develop features and manage supplier quality. The legal basis is our legitimate interest in operating and improving a secure B2B manufacturing service.
• Protect users and the business: authenticate users, prevent fraud, secure systems, enforce terms, establish or defend legal claims and maintain audit records. The legal basis is legitimate interests and, where relevant, legal obligations.
• Meet legal and compliance obligations: accounting, tax, customs, sanctions, export controls, regulatory requests and legally required records. The legal basis is compliance with legal obligations or substantial public-interest requirements where applicable.
• Communicate and market: respond to requests, send service notices and, where permitted, send relevant business marketing. The legal basis is contract, legitimate interests or consent, depending on the message and local law.
• Other disclosed purposes: carry out another compatible purpose disclosed when information is collected, or a purpose you authorize. The legal basis is consent or another basis identified at that time.

Where we rely on legitimate interests, we consider whether our purpose is necessary and balanced against your rights. You may object as described in Section 10. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

Fields identified as required are needed to create an account, prepare a requested quote, meet compliance obligations or perform an order. If you do not provide them, we may be unable to provide the relevant service. Automated tools may assist with file analysis, manufacturability checks and quote calculations, but they are not intended to make decisions based solely on personal information that produce legal or similarly significant effects on individuals.

5. How we disclose personal information

We disclose personal information only as reasonably necessary for the purposes described above, including to:

• Manufacturing and supply-chain partners that evaluate, produce, inspect, package or support requested goods;
• Logistics, customs and delivery providers that transport and clear shipments;
• Payment, banking, invoicing and accounting providers that process and reconcile transactions;
• Hosting, storage, communications, security, analytics and other technology providers that support our systems;
• Professional advisers and insurers where needed for legal, audit, risk and claims matters;
• Authorities or other parties where reasonably necessary to comply with law, protect rights and safety, investigate misuse or establish and defend legal claims; and
• A buyer, successor or transaction participant in a merger, financing, reorganization, sale of assets or similar corporate transaction, subject to appropriate confidentiality measures.

We require service providers to handle personal information for authorized purposes and with appropriate protections. Manufacturing files may be shared with prospective or selected suppliers to quote and fulfill your request, subject to confidentiality and access controls appropriate to the transaction.

We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising as those terms are defined by the California Consumer Privacy Act. We also do not use sensitive personal information to infer characteristics about individuals.

6. International data transfers

XPartsLab operates from China and serves customers internationally. Personal information may therefore be transferred to, stored in or accessed from China and other countries where our suppliers and service providers operate. Privacy laws in those countries may differ from the laws where you live.

Where the EEA, UK, Swiss or another jurisdiction's restricted-transfer rules apply, the transfer must rely on a mechanism permitted by that law, which may include an adequacy decision, approved contractual clauses, the UK International Data Transfer Agreement or Addendum, supplementary safeguards, or a permitted derogation. Contact us to request information about the mechanism applicable to your data. This Policy does not itself confirm that every listed mechanism applies to every transfer.

7. Retention

We retain personal information only for as long as reasonably necessary for the purpose collected, including to maintain an account, prepare and fulfill quotes and orders, protect manufacturing records, meet tax, accounting, customs and legal obligations, resolve disputes and enforce agreements. Retention depends on the type and sensitivity of information, the transaction lifecycle, legal limitation periods, security needs and applicable law.

When information is no longer required, we delete, anonymize or securely isolate it, subject to backup cycles and legal holds.

8. Security

We use administrative, technical and physical safeguards designed to protect personal information and manufacturing files, including access controls, secure transmission, role-based permissions, logging, supplier controls and incident-response procedures where appropriate. No system or transmission is completely secure, and we cannot guarantee absolute security.

Protect your credentials, use a unique password and contact us promptly at info@xpartslab.com if you suspect unauthorized account or data access.

9. Cookies and similar technologies

We use cookies, local storage, session storage and scripts for account sessions, authentication, security, shopping-cart and quote functions, country or language preferences, visitor continuity, diagnostics and service performance. The current first-party visitor-continuity and service-monitoring functions are active by default; the performance-monitoring choice below applies on this browser.

You may clear browser storage through your browser settings, although identifiers used by an active first-party function may be recreated on a later visit. Blocking storage may prevent account, cart, quote or related features from working. Because we do not sell or share personal information for cross-context behavioral advertising, Global Privacy Control signals do not change such a practice. Browser "Do Not Track" signals are not standardized, and the site may not respond to them. Where applicable law gives you a right to object or requires a different control, contact us using Section 15; statutory rights remain unaffected by this description of current operation.

10. Your privacy rights

Depending on where you live and subject to legal exceptions, you may have rights to request access to and a copy of personal information; correction; deletion; restriction of processing; data portability; withdrawal of consent; and objection to processing based on legitimate interests or direct marketing. You may also have a right to complain to your local data-protection authority and, in some jurisdictions, appeal our response.

You may object to direct marketing at any time by using the unsubscribe method in the message or contacting us. You may also object to processing based on legitimate interests, including first-party measurement, where applicable law provides that right.

Submit a request to info@xpartslab.com or through our contact page. Describe the right you wish to exercise and the relevant account or interaction. We may verify your identity and authority, request clarification, or decline a request where permitted by law. We will respond within the period required by applicable law and will not discriminate against you for exercising a privacy right.

An authorized agent may submit a request where local law permits. We may require proof of authorization and direct identity confirmation. If European or UK data-protection law applies, you may lodge a complaint with the supervisory authority where you live or work; we encourage you to contact us first so we can try to resolve the concern.

11. Additional U.S. state disclosures

U.S. state privacy laws may provide residents with rights to know or access personal information, obtain a portable copy, correct inaccuracies, delete information, opt out of certain sales, targeted advertising or profiling, limit certain uses of sensitive information, and appeal a decision. These rights apply only where the relevant law covers our processing and are subject to statutory exceptions.

In the preceding 12 months, we may have collected the categories described in Section 2, including identifiers; customer records and commercial information; internet or electronic activity; approximate geolocation; professional or employment-related information; account credentials; communications content submitted to us; and inferences. We collected and used these categories for the purposes in Section 4 and disclosed them to the categories of recipients in Section 5. We did not sell them or share them for cross-context behavioral advertising.

California residents may request access, correction or deletion and may use an authorized agent. Because we do not sell or share personal information as defined by the CCPA, we do not offer a "Do Not Sell or Share My Personal Information" link. We do not knowingly sell or share the personal information of individuals under 16. To submit a request or appeal, use the methods in Section 10 and state your U.S. state of residence.

12. Children's privacy

XPartsLab provides services to adults and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us so we can investigate and delete it where required.

13. Third-party services

The website may link to payment, logistics, social-media or other independent services. Their operators determine their own processing and privacy practices. Review their privacy notices before providing personal information. This Policy does not cover information processed by a third party independently of our instructions.

14. Changes to this Policy

We may update this Policy to reflect changes in our services, practices or legal obligations. We will post the revised Policy with a new effective date and provide additional notice where required. Material changes apply prospectively unless applicable law requires otherwise.

15. Contact us

For privacy questions, requests or complaints, contact:

XPartsLab / Yuxin Digital Intelligence Technology (Shenzhen) Co., Ltd.

Room 302, Building 4, Jinyuda Industrial Park, No. 68 Guangshen Road (Shajing Section), Bao'an District, Shenzhen, Guangdong, China

Email: info@xpartslab.com

This page does not currently identify a separate representative in the EEA or UK. If applicable law requires a representative for the processing connected with your location, you may contact the controller above to request the current representative information.