We keep what an inquiry needs to get a part quoted, and we name every ad platform that sees your click.

The date at the top of this page is the date of the wording you are reading. If we change it, the date changes with it. An inquiry you sent before that date is handled under the wording that applied when you sent it, unless the new wording gives you more.

The controller is Xervilo, 68 Cedar Court, Office 12, Austin, Texas 28613, Austin, Texas, United States. Write to [email protected] or call +1 (565) 555-2353. There is no separate data protection officer. The same desk that reads your bike's speed count reads your privacy question.

From the inquiry form

When you send the form it goes to sonoa73.php, which writes your name, phone, email, address, the kind of inquiry, your message, the specification you asked for (speed count, wheel size, brake mount and so on) and the consent tick. Phone and email are each optional, but we need one of them to reply.

With that record the server stores, automatically, your IP address, your browser's user-agent string, the referring URL, the moment the form was rendered and the moment it was sent. The two timestamps are there to catch bots that fill a form in 0.4 seconds.

From the support chat

The chat widget sends your messages to bipue44.php and keeps the conversation on our server. If you give a name, phone or email in the chat, those are kept with it. A token is saved in your browser's local storage so you can close the tab and come back to the same thread.

Cookie and storage identifiers

Your consent choice is stored in your browser under site_consent_v2. If you allow storage, Google, Microsoft and Meta may set their own cookies. The full list with lifetimes is on the cookie policy.

Advertising click identifiers

If you arrive from an ad, the link carries a click ID: gclid, msclkid or fbclid. Section 06 explains each one.

We do not take payment or card data, and there are no accounts or passwords. Nothing is sold on this site.

• Form and chat content: to check compatibility, find the part and send you an indicative price by email or phone.
• Contact details: to reply, and to follow up once if a part we flagged needs a photo of your rear dropout or a fluid type before we can quote.
• IP, user-agent, timestamps, referrer: to filter spam and abuse, and to work out a fault if a form fails.
• Click identifiers and ad cookies: to count which Google Ads, Microsoft Advertising or Meta campaigns led to an inquiry, so we stop paying for the ones that do not.
• The consent record: to remember your answer and prove which answer you gave.

We do not sell lists. There is no newsletter, so nobody gets one by accident.

People searching for things like an 11 speed road bike chain or bike parts in Austin TX reach this site from paid ads today. Three platforms are involved:

• Google Ads adds gclid to the link you click.
• Microsoft Advertising (Bing and partner sites) adds msclkid.
• Meta Ads (Facebook and Instagram) adds fbclid, where a campaign runs there.

The identifier sits in the address bar whether or not you consent; that is how the platform built the link. What changes with consent is whether a tag on this page reads it and stores it in a cookie. Until you press Allow, it is not stored, and the platforms receive only the cookieless, denied-state signals described in the next section.

None of these platforms has reviewed or vouched for Xervilo. They sell us clicks. That is the whole relationship.

This site runs Consent Mode v2. Before the page loads any ad or analytics tag, it sets ad_storage, ad_user_data, ad_personalization and analytics_storage to denied. In that state no advertising or analytics cookie is written, no user data is passed for ad matching, and nothing is used for personalised ads.

Press Allow on the cookie bar and the four signals switch to granted. Press Decline, or later withdraw through Cookie settings in the footer, and all four are set back to denied at once. Your choice is saved under site_consent_v2 for 6 months, then we ask again.

1. Google Ireland Ltd / Google LLC runs Google Ads, attaches gclid to a click and receives the consent signals. Policy: policies.google.com/privacy.
2. Microsoft Ireland Operations Ltd runs Microsoft Advertising and attaches msclkid. Its handling is set out in the Microsoft privacy statement at privacy.microsoft.com/privacystatement.
3. Meta Platforms Ireland Ltd runs Meta Ads and attaches fbclid where a campaign runs there. Policy: facebook.com/privacy/policy.
4. Our hosting provider serves the site and stores the inquiry database and chat transcripts on its servers.
5. Our mail provider carries the notification of each inquiry to the desk's inbox, and carries our reply back to you.

If a part has to ship to you, the carrier gets your name and delivery address at that point, after you have agreed to an order by email. Not before.

If you write to us from the EU, the UK or Switzerland, your inquiry is processed in the United States. That transfer is lawful because you asked us to answer you (GDPR Art. 49(1)(b) for the inquiry itself) and, for the ad platforms, because Google, Microsoft and Meta transfer under the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses. Ask us and we will tell you which mechanism covers which recipient.

Every page and form submission travels over TLS. The inquiry store sits outside the public web folder and can only be opened through a password-protected operator panel. Only the people who answer inquiries can log in. We do not ask for card numbers, so there are none to lose. If we learn of a breach that puts your data at risk, we will tell you and any authority the law requires, without undue delay.

• Access: a copy of everything we hold on you.
• Rectification: fix a wrong email, a wrong address, a wrong wheel size.
• Erasure: delete it, unless we must keep a record by law.
• Restriction: freeze use while a dispute is settled.
• Portability: your inquiry data in a machine-readable file.
• Objection: to anything we do on legitimate interest, including ad measurement.
• Withdrawing consent: at any time, through Cookie settings in the footer, without affecting what happened before.

You can ask to know what personal information we collected and why, ask us to delete or correct it, and limit use of sensitive information (we do not collect any). We do not sell personal information for money. Letting an ad platform cookie run after you press Allow can count as "sharing" for cross-context behavioural advertising under the CCPA, so you can opt out of sale or sharing: press Decline, use Cookie settings in the footer, or send a Global Privacy Control signal. We will not treat you differently for using any of these rights. Texas, Colorado, Virginia, Connecticut and the other states with comparable laws are handled the same way.

When a request arrives with the Sec-GPC: 1 header, or the browser reports Global Privacy Control as on, the four Consent Mode signals stay denied, no ad cookie is written and the cookie bar does not nag you. You can still press Allow yourself if you want to, but we will not prompt it.

This site is not directed at children under 13, and we do not knowingly take data from anyone under 16. If a 20 inch ISO 406 tyre is needed for your child's bike, a parent or guardian sends the inquiry. If you think a child has written to us, email [email protected] and we delete it.

You may complain to your state Attorney General. In California, you may also complain to the California Privacy Protection Agency. If you are in the EU or UK, you may complain to the data protection authority where you live or work, for example the ICO in the UK.

Use the data request form, email [email protected], or write to Xervilo, 68 Cedar Court, Office 12, Austin, Texas 28613, United States. Tell us the email or phone you used with us so we can find the record. We answer within 10 days. If we need to confirm it is you, we will ask for one detail only you would know, such as the bike you asked about.

We update the date at the top and note what changed in the opening of the page. If a change widens what we collect or who receives it, we ask for consent again through the cookie bar, and anyone with an open inquiry hears about it by email.