Privacy Notice

1. Who we are and scope

XFabro is the trading brand used on this website by Yuhe Intelligent Manufacturing Technology (Shenzhen) Co., Ltd., Room 302, Building 4, Jinyuda Industrial Park, No. 68 Guangshen Road (Shajing Section), Baoan District, Shenzhen, Guangdong, China. For personal information collected through this Site and our direct customer relationships, this company is the controller or business unless another notice states otherwise.

This Notice applies to website visitors, customer and supplier contacts, account users, quote recipients, purchasers, and people communicating with us. It does not govern a third-party website or service linked from the Site.

2. Personal information we collect

2.1 Identity, contact, and account data

• Name, company, role, email address, telephone number, account identifier, login credentials, language, and communication preferences.
• Billing and delivery contacts, addresses, tax or invoice details, and authorized-user information.

2.2 Quote, project, and transaction data

• Requests, quotes, orders, products, quantities, prices, payment and reconciliation status, shipping, delivery, quality, support, and after-sales records.
• CAD models, drawings, BOMs, specifications, process requirements, inspection evidence, and related communications. These are normally business and technical data but may include personal information.
• Payment providers may process card or banking details. We do not intend to store complete payment-card numbers on the Site.

2.3 Device, usage, monitoring, and security data

• IP address, browser and device type, operating system, language, screen size, timestamps, referring and landing pages, pages viewed, interactions, session or visitor identifiers, and diagnostic or security events.
• Browser storage and similar technology data described in Section 6.

2.4 First-party website monitoring data

Our first-party monitoring mechanism automatically records information needed to operate, secure, troubleshoot, and measure the Site, including:

• Page paths and URLs, referrers, load and navigation timing, mobile-device indicators, timestamps, session identifiers, visitor identifiers and, when available, associated customer or company identifiers.
• Interactions with buttons, links, and supported form controls, together with element metadata such as an element's type, identifier, name, class, link destination, visible label, and page location.
• For supported text-entry controls, the current configuration reports the trimmed character count rather than the entered text. For selection controls, the selected value may be reported. Password, file-upload, and hidden fields are excluded from this interaction monitor.
• Action duration and outcome, related request counts and errors, requested endpoint, page-presence heartbeats, and JavaScript error details such as the message, source, line, column, and abbreviated stack trace.

This mechanism is not designed to make audio or video recordings, capture screenshots, or record the content typed into monitored text fields. Information that you intentionally submit through a contact, quote, account, or order function is processed separately as described in Sections 2.1 and 2.2.

Please do not include personal information in manufacturing files unless it is necessary for the project. Do not submit regulated personal data, health information, government identifiers, or information about children unless we have expressly agreed in writing and appropriate safeguards are in place.

3. Sources of information

We collect information directly from you; from your employer, colleagues, or authorized representatives; automatically from your device and Site use; and from payment, logistics, manufacturing, fraud-prevention, or other service providers involved in your transaction. We may also receive business contact information from referral partners or public business sources where permitted by law.

4. Purposes and legal bases

We process personal information for the following purposes and, where the GDPR or UK GDPR applies, on the following legal bases:

• Contract: to create and manage accounts; prepare quotes; review files; accept, manufacture, inspect, deliver, invoice, and support orders; and communicate about a requested service.
• Legitimate interests: to operate and improve the Site and services; maintain business records; protect accounts and systems; detect fraud and abuse; manage suppliers; resolve disputes; and understand service performance, where those interests are not overridden by individual rights.
• Legal obligations: to keep tax, customs, accounting, product, sanctions, export-control, and compliance records and respond to lawful requests.
• Consent: for optional marketing, non-essential cookies or similar technologies, or another purpose where consent is required. You may withdraw consent at any time without affecting earlier lawful processing.

We may use automated tools to assist pricing, file analysis, fraud screening, and routing. We do not intend to make a decision that produces legal or similarly significant effects about an individual solely by automated means without providing any notice and rights required by law.

5. How we disclose information

We disclose only what is reasonably necessary to:

• Affiliates, personnel, approved manufacturers, material suppliers, inspectors, and other production partners that support quoting and fulfillment.
• Cloud hosting, content delivery, communications, security, analytics, customer-support, file-storage, and information-technology providers.
• Payment processors, banks, credit providers, carriers, freight forwarders, customs agents, and tax or invoicing providers.
• Professional advisers, auditors, insurers, and transaction counterparties, subject to appropriate confidentiality protections.
• Courts, regulators, law enforcement, or other parties when required by law or reasonably necessary to protect rights, safety, and security.

If our business or assets are reorganized, financed, sold, or transferred, information may be disclosed under appropriate safeguards and transferred subject to this Notice or a replacement notice.

6. Cookies, browser storage, and website monitoring

We use cookies, local storage, session storage, and similar technologies for account sessions, authentication, shopping-cart functions, region or language preferences, security, fraud prevention, visitor and session identification, duplicate-event control, diagnostics, and service performance.

The first-party monitoring described in Section 2.4 operates when Site pages load and sends monitoring events to XFabro's monitoring endpoint. We use those events to maintain availability and security, investigate errors and failed requests, measure response and page-load performance, understand whether Site functions work as intended, and support customers who experience technical problems. Where the GDPR or UK GDPR applies, we rely on our legitimate interests for necessary security, diagnostics, and service operation, subject to the balancing described in Section 4; we rely on consent where applicable law requires it.

Strictly necessary technologies operate because the Site cannot provide the requested function securely without them. A technology that is not strictly necessary will be used only after any consent or other choice required by applicable law has been obtained. Browser controls may block or delete stored data, but doing so can affect Site functions.

We do not currently use third-party advertising cookies on the Site. If our practices change, we will update this Notice and provide any legally required consent or opt-out control.

7. Sale, sharing, and targeted advertising

We do not sell personal information for money. Based on our current practices, we do not share personal information for cross-context behavioral advertising and do not process it for targeted advertising as those terms are defined by applicable US state privacy laws.

We therefore do not currently display a "Do Not Sell or Share My Personal Information" link. If these practices change, we will provide the required notice, opt-out method, and recognition of legally required browser-based opt-out signals such as Global Privacy Control.

8. International transfers

XFabro operates from China and serves customers internationally. Personal information may be processed in China and in countries where our customers, manufacturers, carriers, payment providers, cloud providers, and professional advisers operate. Those countries may have different data-protection laws.

Before making an international transfer that requires a safeguard under the GDPR, UK GDPR, or another applicable law, we will identify and implement an available lawful mechanism. Depending on the circumstances, this may include an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, and supplementary technical and organizational measures. You may contact us for information about the safeguard applicable to your data, subject to lawful redactions.

9. Retention

We retain personal information only for as long as reasonably necessary for the purpose collected, including to provide quotes and orders, maintain accounts, meet tax, customs, product, accounting, and legal obligations, enforce agreements, and resolve disputes.

Retention depends on the record type, contract duration, limitation periods, legal requirements, sensitivity, and risk. When information is no longer required, we delete, anonymize, or securely isolate it unless lawful archival retention is necessary. You may ask about the criteria applicable to a particular record.

10. Security

We use administrative, technical, and physical safeguards designed for the nature of the information, including access controls, role-based permissions, encrypted transmission, logging, backups, supplier controls, and incident procedures. No system is completely secure, and we cannot guarantee absolute security.

If a personal-data breach occurs, we will investigate, mitigate, and notify affected individuals and authorities when required by applicable law. Contact us promptly if you believe an account, file, or communication has been compromised.

11. Your privacy rights

Depending on your location and subject to legal exceptions, you may have the right to:

• Know whether we process your personal information and access or obtain a copy of it.
• Correct inaccurate information and, in some cases, complete incomplete information.
• Request deletion, restriction, or portability.
• Object to processing based on legitimate interests or to direct marketing.
• Withdraw consent and manage optional marketing choices.
• Opt out of sale, sharing, targeted advertising, or certain profiling if we engage in those activities.
• Appeal a denied request where applicable, and not receive discriminatory treatment for exercising a right.
• Complain to a competent data-protection or consumer-protection authority. EEA and UK individuals may complain to the supervisory authority where they live, work, or believe an infringement occurred.

Submit a request through our Contact page or email support@xfabro.com with the subject "Privacy Request." Describe the right and the account, email, or transaction concerned. We may verify identity and authority proportionately and will respond within the period required by applicable law.

An authorized agent may submit a request where permitted. We may ask for proof of authorization and direct identity verification. Some information may be retained or withheld where an exception applies, including transaction completion, security, legal compliance, recordkeeping, or legal claims.

12. United States state disclosures

For residents of US states with applicable comprehensive privacy laws, the categories collected during the preceding 12 months are described in Section 2: identifiers and contact data; customer and transaction records; commercial information; internet or electronic activity; approximate location inferred from IP address; professional or employment-related information; account credentials; and inferences limited to service, security, and customer-support needs.

We collect these categories from the sources in Section 3, use them for the purposes in Section 4, and disclose them to the recipient categories in Section 5. We use account credentials and other information treated as sensitive only to provide requested services, secure accounts, process transactions, and meet legal obligations—not to infer personal characteristics.

We do not offer a financial incentive for personal information. California residents may exercise applicable rights to know, access, correct, delete, and obtain information about collection and disclosure. Rights relating to sale or sharing are described in Section 7. Residents of other covered states may exercise the rights provided by their applicable state law, including an appeal where required.

13. Children

The Site and Services are intended for business users and adults and are not directed to children under 13 or the higher minimum age established by applicable law. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us so we can investigate and delete it where required.

14. Changes and contact

We may update this Notice to reflect changes in law, technology, or our practices. We will post the revised Notice with a new date and provide additional notice or obtain consent when required. A material change will not be applied retroactively in a way that unlawfully reduces your rights.

Privacy questions and requests may be sent through our Contact page or to support@xfabro.com. Postal requests may be sent to: Privacy Contact, Yuhe Intelligent Manufacturing Technology (Shenzhen) Co., Ltd., Room 302, Building 4, Jinyuda Industrial Park, No. 68 Guangshen Road (Shajing Section), Baoan District, Shenzhen, Guangdong, China.