Privacy Policy

About this policy

This Privacy Policy explains how INOVIT Inc. ("Hartes Metal", "we", "us" or "our") collects, uses, discloses, keeps and protects personal information.

It applies when you:

• visit hartesmetal.com or another Hartes Metal website or storefront;
• buy or ask about Hartes Metal products;
• contact Hartes Metal by email, phone, website chat or form;
• contact a Hartes Metal Facebook Page or Instagram account;
• send a message through Messenger, Instagram Direct or another connected channel; or
• otherwise use a service provided by Hartes Metal.

If you are a California resident, the section Your California privacy rights describes the additional rights you have under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"). This policy is also our notice at collection under the CCPA.

Our roles

For customer, sales and messaging information associated with Hartes Metal:

• INOVIT Inc. is the business responsible for your personal information, and owns the connected Meta App and the relevant business assets;
• INOVIT Inc. decides why personal information is collected and how it is used;
• INOVIT Inc. is responsible for its relationship with customers; and
• INOVIT Inc. is responsible for providing, securing and supporting its business systems.

Our service providers process personal information on our behalf and under our instructions.

Information we collect

Depending on how you interact with Hartes Metal, we may collect the following. The CCPA category each item falls into is shown in brackets.

Contact information (identifiers; customer records)

• your name;
• email address;
• telephone number;
• delivery or billing address;
• organization and job title; and
• communication preferences.

Customer and transaction information (commercial information; customer records; inferences)

• enquiries and product interests;
• quotes, orders, invoices and payment status;
• delivery, pickup and fulfillment information;
• vehicle, wheel, tire and fitment details;
• warranty or service requests, including photos you send us; and
• records of communications with us.

Account information (identifiers; sensitive personal information)

If you create an account, we keep your login email and a protected form of your password. We use these only to provide and secure your account.

Payment information

Card payments are processed by our payment provider, Stripe. We do not receive or store your full card number. We receive limited details such as the card type, the last four digits, the billing ZIP code and whether the payment succeeded.

Meta and social messaging information (identifiers; electronic and visual information)

When you communicate with a Hartes Metal Facebook Page, Instagram account, Messenger account or another connected Meta service, we may process:

• your name and username;
• your profile image;
• Meta platform-scoped identifiers;
• messages, replies and comments;
• images, documents and other attachments you send;
• timestamps, reactions and postbacks;
• message delivery and read status;
• conversation and routing metadata; and
• other information Meta provides through its authorized APIs.

We do not request or store your Facebook or Instagram password.

Technical information (internet or other electronic network activity; approximate geolocation)

We may collect:

• IP address;
• browser and device information;
• session and authentication records;
• cookie and local-storage identifiers;
• application logs and diagnostic information;
• approximate location derived from an IP address; and
• activity performed through a Hartes Metal service.

We do not collect precise geolocation, and we do not intentionally collect other sensitive personal information such as government ID numbers, health information or biometric information.

How we collect information

We may collect information:

• directly from you;
• when you use a Hartes Metal website, storefront or account;
• when you communicate with a Hartes Metal employee or representative;
• from authorized Hartes Metal dealers, when you buy through one or make a warranty claim through one;
• through Facebook, Instagram, Messenger or another connected service;
• through our business systems;
• from authorized service providers and integrations, such as our payment and shipping providers;
• through cookies, logs and similar technologies; and
• where permitted, from publicly available sources.

How we use information

We may use personal information to:

• respond to enquiries and customer messages;
• recommend products and provide fitment information;
• prepare quotes and process orders;
• calculate sales tax, take payment, and arrange delivery, pickup and fulfillment;
• provide customer service and warranty support;
• maintain customer and transaction records;
• route messages to an appropriate team member;
• prepare or send authorized responses;
• operate integrations selected by Hartes Metal;
• detect and prevent fraud, abuse and security incidents;
• comply with legal, tax, accounting and regulatory obligations;
• improve our products, services and customer experience; and
• produce aggregated or de-identified business information.

We do not use sensitive personal information to infer characteristics about you.

Sale and sharing of personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the CCPA. We have not done so in the past 12 months.

Customer conversations are not used for unrelated third-party advertising.

We do not knowingly sell or share the personal information of consumers under 16.

Automated and AI-assisted features

Hartes Metal may enable automated or AI-assisted features within its business systems, including the chat on our website.

These features may process relevant message content and business information to:

• classify an enquiry;
• retrieve product or order information;
• summarize a conversation;
• prepare a response draft; or
• generate an automated response.

Hartes Metal controls whether these features are enabled and is responsible for their configuration and monitoring. We do not use them to make decisions that produce legal or similarly significant effects about you.

Automated output may be incomplete or inaccurate. Important product, fitment, pricing, warranty or safety information should be confirmed before relying on it.

Disclosure of information

We may disclose personal information to:

• authorized Hartes Metal employees and representatives;
• authorized Hartes Metal dealers, where needed to complete a sale, fitment or warranty claim;
• software and infrastructure service providers;
• hosting, database and infrastructure providers;
• payment, delivery and fulfillment providers;
• sales tax calculation and filing providers, where used;
• email, communications and customer-support providers;
• security, monitoring and error-reporting providers;
• AI service providers when an authorized AI feature is enabled;
• Meta as required to operate a connected integration;
• professional advisers, auditors and insurers;
• regulators, courts or law-enforcement agencies where legally required; and
• a successor organization as part of a lawful merger, acquisition or business transfer.

Service providers may only process information for the purposes we authorize and under contracts that include confidentiality, security and use restrictions.

In the past 12 months we have disclosed each category of information listed under Information we collect for a business purpose to the kinds of recipients listed above.

Where information is processed

We are based in the United States, and we process and store personal information in the United States only. Our service providers process it in the United States on our behalf.

Data retention

We keep personal information only for as long as reasonably required to:

• provide products or services;
• respond to enquiries;
• complete and support transactions, including warranty claims;
• satisfy contractual, tax, accounting or legal obligations;
• maintain necessary security and audit records;
• resolve disputes; and
• enforce applicable agreements.

When personal information is no longer reasonably required, we take reasonable steps to delete or de-identify it.

Residual copies may remain in protected backups until those backups are rotated or securely destroyed.

Security

Hartes Metal uses administrative, technical and organizational safeguards designed to protect personal information from loss, misuse and unauthorized access, modification or disclosure.

These safeguards may include:

• tenant isolation and role-based access controls;
• encryption in transit and, where appropriate, at rest;
• authentication and session controls;
• system logging and security monitoring;
• backup and recovery controls; and
• access restrictions for personnel and service providers.

No online service can guarantee absolute security. Please tell us promptly if you believe your information or account has been accessed without authorization. If a breach affects you, we will notify you as required by the laws of your state.

Your California privacy rights

If you are a California resident, you have the right to:

• Know what personal information we have collected about you, the categories of sources, the purposes, and the categories of third parties we disclose it to, and to get a copy of the specific pieces of information;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information (we do not sell or share it); and
• Not be discriminated against for exercising any of these rights.

We use sensitive personal information (your account login) only to provide and secure your account, so the right to limit its use does not apply.

How to make a request

Email privacy@inovit.com with the subject "California Privacy Request", or call +1 626 444 4775.

We will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time, up to a further 45 days, we will tell you why.

Verification

To protect your information, we verify requests by matching details you give us against the information we hold, such as your email address, phone number and order numbers. We will not ask for your password.

Authorized agents

You can use an authorized agent to make a request for you. We may ask the agent for your signed permission, and ask you to confirm your identity with us directly.

Shine the Light

California Civil Code section 1798.83 lets California residents ask which personal information we disclosed to third parties for their own direct marketing in the past year. We do not make such disclosures.

Residents of other states

Several other states, including Colorado, Connecticut, Virginia and Texas, give their residents privacy rights similar to those above. Wherever you live in the United States, you may ask us to access, correct or delete your personal information using the contact details below, and we will handle your request as the law of your state requires. If we decline a request, you can appeal by replying to our decision, and we will tell you the outcome of the appeal.

Meta Data Deletion

You may ask us to delete personal information received or created through Facebook, Instagram, Messenger or another Meta service.

How to submit a request

You may:

• contact the relevant Hartes Metal Facebook Page or Instagram account through the same channel; or
• email privacy@inovit.com with the subject:

Hartes Metal Meta Data Deletion Request

Include:

• your name;
• the Facebook Page or Instagram account involved;
• your platform username or profile URL, if available;
• the approximate date of the conversation;
• the state or country you are located in; and
• a description of the information you want deleted.

Do not send your password, access token, payment card number or other authentication secret.

Privacy requests are handled by INOVIT Inc. for information processed through its business systems.

Verification

To prevent unauthorized deletion, we may verify:

• your association with the relevant profile or conversation;
• control of a relevant email address or account;
• your authority to act for another person; and
• information reasonably required to locate the relevant records.

Verification information will only be used to assess and complete the request.

Information that may be deleted

Subject to applicable law and valid retention requirements, deletion may include:

• Meta platform-scoped identifiers;
• names, usernames and profile images stored in Hartes Metal systems;
• messages, replies, comments and attachments;
• delivery, read, reaction and conversation metadata;
• linked customer or contact records;
• stored webhook events;
• automated classifications and summaries;
• AI-generated response drafts; and
• other derived records associated with the conversation.

Information we may keep

We may keep limited information where reasonably necessary to:

• comply with legal, tax, accounting or regulatory obligations;
• establish, exercise or defend legal claims;
• detect fraud, abuse or security incidents;
• preserve necessary audit records;
• document completion of the deletion request; or
• satisfy another lawful retention requirement.

De-identified information that can no longer reasonably identify a person may also be kept.

Residual copies may remain in protected backups until the applicable backup is rotated or securely destroyed.

Processing and confirmation

We will process a verified request without unreasonable delay.

When processing is complete, we will confirm it or explain any information that could not lawfully be deleted.

Deleting information from Hartes Metal does not automatically delete information held independently by Meta. To manage information held by Meta, use the privacy and account controls provided by the relevant Meta service.

Cookies

Hartes Metal websites and services may use cookies and similar technologies for:

• authentication and session continuity;
• security and fraud prevention;
• shopping cart and user preferences;
• website operation and performance; and
• first-party analytics that we do not use for advertising.

You can block or delete cookies in your browser settings. Some parts of the site, such as the cart and your account, will not work without them.

Do Not Track and Global Privacy Control. Our website does not change its behavior when it receives a "Do Not Track" signal. Because we do not sell or share personal information, there is nothing for a Global Privacy Control signal to opt you out of. If that changes, we will honor the signal as an opt-out request.

Marketing communications

We may send service messages needed to respond to an enquiry or administer an order.

We only send marketing emails where you have signed up or bought from us and not opted out. Every marketing email has an unsubscribe link, and you can also unsubscribe by contacting us.

Text messages. If you opt in, we may send marketing text messages to the mobile number you give us, including by automated means. Consent is not a condition of purchase. Message frequency varies, and message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. We do not share your mobile number or your text-message consent with third parties for their own marketing.

Unsubscribing from marketing does not stop necessary order, transaction, security or legal notices.

Children

Hartes Metal provides products and services intended for businesses and adult customers. Our services are not directed to children under 16, and we do not knowingly collect personal information from children under 13.

If you believe a child has given us personal information, contact us so that we can investigate and delete it.

Privacy complaints

You may contact us with a question or complaint about how personal information has been handled.

Please give us enough information to understand and investigate the issue. We will acknowledge and respond within a reasonable period.

If you are not satisfied with our response, you may contact your state Attorney General. California residents may also contact the California Privacy Protection Agency (cppa.ca.gov).

Changes to this policy

We may update this policy when our services, practices or legal obligations change. We review it at least once every 12 months.

The current version will be published on this page with its effective date. If a change is material, we will give additional notice where reasonably appropriate.

Contact

Privacy contact

INOVIT Inc.

Email: privacy@inovit.com

Telephone: +1 626 444 4775

Address: 5120 Commerce Drive, Baldwin Park, CA 91706, United States