Supreme Fab Works Privacy Policy

1. Scope and who we are

This Privacy Policy describes how Supreme Fab Works LLC ("SFW," "we," "us," or "our") collects, uses, discloses, protects, and retains personal information when you use our website, online store, customer account, My Garage and Build Manager, wishlists or shared builds, quote and installation tools, estimate approvals, the SFW community, contact forms, or other services that link to this policy.

Our website is a general-audience automotive parts, fabrication, and installation website. It is not designed or directed to children under 13.

2. Information we collect

Depending on how you use SFW, we may collect the following categories of information:

• Identity and contact information: name, email address, telephone number, billing/shipping address, and account identifiers.
• Order and commercial information: products viewed, cart contents, purchases, quotes, returns, installation requests, customer-service history, and transaction records.
• Vehicle and build information: year, make, model, trim, drivetrain, saved builds, selected parts, installed equipment, fitment notes, and—when you choose to provide it—a vehicle identification number (VIN). A VIN is optional: you can browse, save builds, and request a quote without one, and we ask for it only when a specific fitment or service workflow needs it. Full VINs are treated as private account data, are encrypted at rest in the SFW backend, and are not intended for public build or wishlist links.
• Account and preference information: saved vehicles, builds, favorites, display preferences, notification choices, and privacy choices.
• Communications: messages, quote requests, install notes, support requests, and information you provide when contacting the shop.
• Estimate authorization (e-signature) records: when you approve or decline an estimate online we record your typed signature name, the decision for each job, the authorization text you agreed to, the time of signing, a keyed hash of your network address (never the address itself), and a shortened browser identifier. These records prove that work was authorized and are kept with the estimate as a business record.
• Community contributions: discussion posts, verified-owner reviews, photos, captions, and alt text you submit to the SFW community. Approved community content, including photos, is public and may be shown on product pages and shared by other visitors; do not include private information in it.
• Device and usage information: browser/device information, page interactions, cookie or similar technology identifiers, and diagnostics needed to operate and secure the website. Storefront fault reports keep only the browser family (for example "Chrome"), never the full User-Agent string.
• Security incident context: when our abuse controls flag a request, the IP address, browser identifier, and network location of that request are stored encrypted for at most 30 days so that an administrator can investigate. Revealing that context requires a documented reason and is itself audited.
• Payment information: payment card processing is handled by Shopify and payment providers. SFW does not intentionally store complete payment-card numbers or card security codes in the Build Manager or Cloudflare Worker database.

We collect information directly from you, automatically from your interaction with the website, from Shopify and service providers supporting transactions or account functions, and from sources you direct us to use.

3. How we use information

We use personal information for purposes that include:

• providing the storefront, cart, checkout, customer accounts, My Garage, Build Manager, wishlists, quotes, estimates, installation planning, and the SFW community;
• processing orders, payments, shipping, drop-ship fulfillment, returns, refunds, and customer support;
• checking product and vehicle fitment and preserving customer-selected build information;
• maintaining account security, preventing abuse or fraud, troubleshooting faults, and protecting the website and customers;
• communicating about orders, quotes, appointments, builds, services, and account activity;
• remembering optional preferences and, where permitted by your privacy choices, measuring site performance or supporting marketing;
• sending email through Brevo and text messages through Twilio, which act as our processors; text-message consent is collected separately, is never a condition of purchase, and can be withdrawn by replying STOP;
• meeting tax, accounting, legal, warranty, safety, dispute, and regulatory obligations; and
• improving our products, services, website, and customer experience using information we are permitted to use for those purposes.

4. How we disclose information

We disclose personal information only to the service providers and other recipients needed to operate SFW. The providers we currently use are:

• Shopify Inc. — storefront, customer accounts, checkout, payments, order records, fraud prevention, and the Customer Privacy consent system.
• Cloudflare, Inc. — hosting and security for the SFW Build Manager (Workers, D1 database, R2 media storage, queues, and network protection). Cloudflare processes request metadata such as IP addresses to deliver and protect the site.
• Brevo (Sendinblue SAS) — transactional email such as quote confirmations, estimate links, build notifications, and account messages. Brevo receives your email address, first name, and the build or vehicle label needed for the message.
• Turn 14 Distribution, Inc. — wholesale distributor that ships some orders directly to you. For a drop-ship order Turn 14 receives the recipient name, shipping address, phone number, and email address needed for delivery and carrier notifications.
• U.S. National Highway Traffic Safety Administration (NHTSA vPIC) — when you use VIN decoding, the VIN is sent to NHTSA's public vPIC service to return manufacturer-reported vehicle attributes. No other personal information accompanies it.
• Google LLC (Google Calendar) — when the shop connects its calendar, appointment times and the vehicle label are written to the shop's Google Calendar so technicians can plan work. Google Search Console and Merchant Center, when connected, receive product and site data, not customer records.
• Meta Platforms, Inc. (Instagram embeds) — build stories and service pages can show embedded Instagram posts. The embed is not loaded until you allow marketing technologies in Privacy choices or click the post; when it loads, Meta receives your IP address and browser data under Meta's privacy policy.
• Google and Yelp review widgets — load only after preference and analytics technologies are allowed, and then receive your IP address and browser data from the widget provider.
• Intuit Inc. (QuickBooks Online) — when the shop connects its accounting, invoice and payment records including the customer name on the invoice are synchronized for bookkeeping.
• Professional advisers, regulators, courts, law enforcement, or other parties when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or handle a dispute.
• A successor or transaction counterparty in connection with a merger, financing, acquisition, sale, or transfer of all or part of the business, subject to applicable law.

We do not sell personal information for money. Some advertising or cross-context behavioral advertising technologies can be considered a "sale" or "sharing" under certain U.S. state privacy laws even when no money changes hands. SFW does not currently run such advertising technologies on the storefront; the Do Not Sell or Share My Personal Information link in the footer and the Privacy choices control record your opt-out through Shopify Customer Privacy, and recognized opt-out preference signals are honored, so the choice stays in force if that ever changes.

5. Cookies, tracking, and privacy signals

Necessary technologies may be used for store operation, security, fraud prevention, cart, checkout, accounts, and features you request. Optional preference, analytics, and marketing technologies are controlled through the SFW Privacy choices interface where consent or choice is required.

You can reopen Privacy choices from the website and change or withdraw optional choices. Where configured and legally required, Shopify Customer Privacy is the authoritative consent and sale/share opt-out state.

Global Privacy Control (GPC): where applicable, we recognize GPC or another legally required opt-out preference signal for sale/sharing choices through the configured Shopify privacy system. Legacy Do Not Track (DNT): browsers may send older DNT signals that do not have a uniform legal or technical standard. We do not represent that every legacy DNT signal changes site behavior; use Privacy choices or GPC for supported controls.

Third parties may collect information over time or across websites only to the extent their technologies are present and permitted to operate. Instagram embeds and review widgets are click-to-load or consent-gated as described above; optional third-party analytics, marketing, social, or review technologies are not enabled in a way that bypasses legally required privacy choices.

6. Your privacy rights and choices

Depending on where you live and which privacy law applies, you may have rights to request access to personal information, a portable copy, correction, deletion, information about categories of collection or disclosure, opt-out of sale/sharing or targeted advertising, limitation of certain sensitive-personal-information uses, and freedom from unlawful discrimination for exercising a privacy right.

Even when a specific state privacy statute does not apply to SFW because of statutory thresholds or exemptions, you may contact us to request reasonable access, correction, or deletion of personal information associated with your SFW account, subject to identity verification, legal obligations, transaction records we must retain, fraud/security needs, and other permitted exceptions.

To make a privacy request, email supremefabworks@gmail.com with the subject Privacy Request. Please do not send a full VIN, payment-card number, government identification, password, or other unnecessary sensitive information by ordinary email. We may need to verify your identity before disclosing, correcting, or deleting account information. Requests made through your Shopify account are processed automatically: an export is prepared for delivery, and a deletion request removes contact, notification, and VIN data immediately and pseudonymizes any estimate, invoice, or vehicle record that we must keep for tax, warranty, or dispute reasons. We respond within 45 days of receipt as California law requires; our internal target is 30 days.

California residents

California's online privacy laws may require disclosures even when a business does not meet every threshold of the California Consumer Privacy Act (CCPA). If the CCPA applies to SFW for a relevant period, California consumers may exercise the rights provided by that law, including applicable rights to know/access, correct, delete, opt out of sale/sharing, limit qualifying sensitive-personal-information uses, and receive non-discriminatory treatment. The separate sale/share control in Privacy choices and the footer's Do Not Sell or Share My Personal Information link are available for that purpose.

7. Children's Privacy

SFW is committed to protecting children's privacy and encourages parents and guardians to take an active role in their children's online activities. Our website and services are intended for a general adult automotive audience and are not directed to children under 13.

We do not knowingly collect personal information online from a child under 13 without a process that satisfies applicable parental-notice and verifiable-parental-consent requirements. If we learn that personal information was submitted by a child under 13 without the required authorization, we will take reasonable steps to stop using the information for non-required purposes and delete it, subject to limited legal or security obligations. Parents or guardians who believe a child under 13 provided personal information to SFW should contact us at supremefabworks@gmail.com.

We do not knowingly sell or share for cross-context behavioral advertising the personal information of consumers under 16 without the affirmative authorization required by applicable law. We do not use known child personal information for targeted advertising. Posting in the SFW community requires that you are 18 or older or have a parent or guardian's permission. If SFW ever introduces a service directed to children or intentionally collects age information for a child-facing feature, that feature must receive a separate privacy and parental-consent review before launch.

Personal information known to be collected from children must not be retained indefinitely and must be deleted when it is no longer reasonably necessary for the specific purpose for which it was collected, subject to applicable law.

8. Public build, wishlist, and community sharing

When you intentionally create a shareable build or wishlist, the public link is designed to expose only the information needed for that shared list, such as the display name you choose, vehicle/build description, and shared products. SFW does not intend public build/wishlist links to expose a full VIN, shipping address, private contact information, private account identifiers, or protected staff/admin information.

Community discussions, verified-owner reviews, and the photos attached to them are reviewed by staff and then published where any visitor can see them. Treat everything you post to the community as public.

9. Data retention and security

We retain personal information only for as long as reasonably necessary for the purposes described in this policy. Retention periods vary by category; the schedules below are enforced automatically by the SFW Build Manager.

• Account, vehicle, VIN, and build records: while the account or requested build/service relationship remains active and afterward only as reasonably necessary for support, warranty, security, dispute, or legal obligations. A verified deletion request removes contact and VIN data immediately.
• Order, estimate, invoice, and transaction records: as required for fulfillment, returns, warranties, accounting, tax, chargeback, and legal obligations. After a deletion request these records keep only the transaction and a pseudonymous customer key, and e-signature records lose the signer's name and browser identifier.
• Quote requests: 3 years after submission (VIN, phone, and notes are encrypted while stored).
• Build notification history: 180 days.
• Storefront fault reports: 90 days.
• Privacy-choice records: 24 months. SFW's supplemental consent log stores the event, policy version, choices, and Shopify consent identifier; it is designed not to store raw IP addresses, User-Agent strings, or browser fingerprints.
• Security incident context: encrypted IP/browser context for a flagged request, at most 30 days; administrator audit records of reveals and privacy actions, 365 days.
• Copies of your data prepared for a privacy request: encrypted and deleted 30 days after the request completes.
• Marketing information: until consent is withdrawn, an opt-out is received, or the information is no longer needed, while retaining suppression information when necessary to honor an opt-out.

We use reasonable administrative and technical safeguards appropriate to the information and service. The SFW Build Manager is designed to keep private account data behind server-side authorization; full VIN data, quote details, and security incident context are encrypted at rest in the SFW backend. If a security incident affects your personal information we follow our incident-response procedure, including the notices required by California Civil Code section 1798.82. No method of transmission or storage can be guaranteed perfectly secure.

10. International visitors and future markets

SFW is based in California, United States. The storefront may be visible outside the United States even when checkout or shipping is not offered there. Enabling a new international sales market may create additional privacy, cookie, consumer-contract, tax, warranty, product-safety, and marketing obligations. SFW should review those requirements before intentionally opening a new market rather than relying on this policy alone.

11. Third-party websites and services

The site may link to third-party websites, manufacturers, social networks, review services, shipping providers, or payment services. Their privacy practices are governed by their own notices. Review a third party's policy before providing information directly to it.

12. Changes to this policy

We may update this policy when our services, technology, vendors, legal obligations, or data practices materially change. The effective date and policy version at the top identify the current version; the same version string is recorded with every privacy choice and privacy request.

13. Contact Supreme Fab Works

View Legal & policies