Privacy Policy
Last updated · May 26, 2026
The short version
Express Parts Depot is a family-run business that sells genuine OEM BMW parts — new and used. We collect the minimum information needed to take your offer, complete your order, ship the part, and answer your questions. We don't sell your data, we don't email-spam you, and we don't share anything with advertisers that you haven't already given them via cookies in your browser.
The fastest way to understand what we hold about you is to use the corner widget on any of our product pages — click Check status, enter your email, and you'll see every offer or order tied to that address.
1. What we collect
| Data | Why | Stored where |
|---|---|---|
| Email address | So we can reply on the page when you submit an offer or ask a question. You enter this yourself. | Our database |
| Offer amount, optional message, product slug | To process the offer/inquiry and quote you a final price. | Our database |
| IP address & browser user agent | Fraud / abuse detection (e.g. rate-limiting offer spam from one IP). | Our database, admin-visible only |
| Shipping address & phone (when you pay) | So Stripe can process the charge and we can ship the package. | Stripe (we never see your card details) |
| Payment intent ID & receipt URL | So we can refund you if needed and you can re-download your receipt. | Our database (no card data) |
| Tracking number & carrier (after we ship) | So you can track your package from the corner widget. | Our database |
| Conversation messages | Per-offer chat thread between you and us. | Our database |
2. What we don't collect
- Card numbers, CVV, expiry — these go directly from your browser to Stripe over their secure form. We never touch them.
- Browsing history outside our site.
- Anything from minors. Our site is for buyers 18+ shopping for BMW parts; we don't knowingly collect data from children.
3. Cookies & local storage
We use the minimum needed to make the site work:
- Essential — buyer state: when you submit an offer or message, your browser stores an
offer_id+ access token inlocalStorageso the corner widget can show your status when you return. Clearing your browser data clears this; you can recover access at any time by entering your email in the Check status form. - Essential — admin sessions: if you're a staff admin, a session cookie keeps you logged in. HttpOnly, Secure, SameSite=Strict. Buyers don't have this cookie.
- Marketing — Meta (Facebook) Pixel: if you've allowed Meta to track you elsewhere, our site fires Pixel events for page views, offer submissions, and purchases. This helps us measure ad performance. Use a browser extension or your Meta ad preferences to opt out — we don't have a separate opt-out for our site.
- Operational — Cloudflare: Cloudflare sets short-lived cookies for DDoS / bot protection on every site it proxies.
4. Who we share with
| Recipient | What & why |
|---|---|
| Stripe (payment processor) | Your name, email, shipping address, and card details when you check out. See stripe.com/privacy. |
| USPS / UPS / FedEx / DHL | The shipping address and our return address on the label, so the package reaches you. |
| Cloudflare (hosting / CDN) | Your IP and request metadata as they proxy traffic to our origin server. See cloudflare.com/privacypolicy. |
| Meta (Facebook Pixel) | Aggregate event data (page view, offer, purchase). Only if you haven't blocked Meta tracking. See facebook.com/privacy/policy. |
| eBay | Only if you choose to purchase via our eBay listing instead of direct. We don't share your direct-purchase data with eBay. |
We don't sell, rent, or otherwise commercialize your personal information.
5. Where your data lives
Our database runs on a single Vultr virtual private server located in the United States. Backups are stored on the same server filesystem. All transit is TLS-encrypted (Cloudflare → our origin, browser → Cloudflare, our server → Stripe).
6. How long we keep it
- Active offers and orders: retained indefinitely while we may need them for warranty / refund / dispute resolution.
- Conversation messages: kept with the offer record.
- IP and user-agent logs: 12 months for fraud forensics.
- Refunded / cancelled offers: kept for at least 7 years for tax and accounting purposes (US IRS requirement).
7. Your rights
Regardless of where you live, you can ask us to:
- Show you everything we have on you
- Correct anything that's wrong
- Delete your data (we may need to keep order records to satisfy tax law — we'll redact the rest)
- Export your data in a portable format
- Opt out of the Meta Pixel — adjust your Meta ad preferences or block third-party tracking in your browser
If you're in California (CCPA) or the EU/UK (GDPR), the rights above apply specifically to you and you also have the right to lodge a complaint with your regulator. To exercise any of these, open the corner widget on any product page, click Start a conversation, enter your email, and tell us what you'd like done. We'll confirm receipt within 7 days and complete the request within 30 days.
8. Security
Card data never touches our servers — Stripe handles the entire payment flow. For everything we do store: password hashing uses scrypt with random salts, admin sessions use HttpOnly + Secure + SameSite=Strict cookies with CSRF protection, the database file is mode 600 on a non-root volume, and the origin server is firewalled to accept HTTP/HTTPS only from Cloudflare's IP ranges. SSH is key-only with brute-force lockout. No system is unbreakable — if we ever discover a breach, we'll notify affected buyers within 72 hours and disclose what was exposed.
9. Children
We don't market to or knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us via the corner widget and we'll delete it.
10. Changes to this policy
We'll update the Last updated date at the top of this page when anything changes. For material changes (new data collection, new third-party sharing, changes to retention) we'll also flag it in the corner widget on your next visit.
11. Contact
The fastest way to reach us is the corner widget on any product page — click Start a conversation. We're a family-run shop and we read every message.
For anything that needs a written paper trail (data-access requests, refund disputes, legal inquiries), email support@expresspartsdepot.us.
Postal:
Express Parts Depot
PO Box 9
State Line, PA 17263
USA