Privacy Policy

Effective: November 2, 2026

Zona Motorsports, LLC ("Zona", "we") designs, fabricates and sells off-road suspension parts and runs an install and fabrication shop in Tucson, Arizona. This policy explains what we collect through zonamotorsports.com and at the shop, why, who else handles it, and what you can ask us to do about it. The Zona Shop staff app has its own privacy policy.

The short version

We collect what we need to sell you parts, work on your vehicle, and run the business.
We don't sell your information for money. We do use Google and Meta tags on the public parts of the site. See "Cookies and tracking" below.
We never see or store your full card number. Stripe handles card payments.
No mobile information is shared for marketing. See the text message section below.
You can close your account yourself from your account's security page. That removes your login, saved addresses and marketing consents. Your orders and invoices stay, because we need them for tax and warranty. For anything more, contact us and a person will handle your request.

What we collect

When you browse the site

Our own analytics: pages and products you view, when you add to cart or start checkout, the site you came from, your landing page, your device type (desktop, mobile or tablet), and your approximate country and region. A cookie groups these into visits. We don't store your IP address in these records. If you go on to buy, the visit is linked to your order so we can see what led to the sale.
What Google and Meta collect through their tags (see "Cookies and tracking" below).
Your IP address and browser details, which our hosting provider handles to serve the site and which we use briefly to limit abuse.
The vehicle you pick so we can show parts that fit. If you enter a VIN, we send it to the U.S. government's free NHTSA vPIC lookup to work out the year, make and model, and we keep the vehicle and VIN in a cookie in your browser.

When you make an account or sign in

Your name, email address and password or sign-in code, handled by Clerk, our sign-in provider. We keep your name and email and never see your password. If you sign in with another account we offer, such as Google or Apple, that company gives Clerk your account details. If you sign in with a phone code, Clerk sends the code. Clerk also keeps security records such as IP address, device type and sign-in times.
What you save in your account: addresses and vehicles.

When you buy from us

Your name, email, shipping address and, if you give it, your phone number (for the carrier).
What you ordered, including options and vehicle details you entered, any discount code, shipping choice, tax, totals, tracking numbers, refunds and disputes.
Payment details go straight to Stripe on its hosted checkout page. We don't receive your full card number. We get the payment type (for example card or Affirm) and a confirmation from Stripe. For a payment taken at the shop, staff may note the last four digits or a check number.
If you're a dealer or tax-exempt buyer, your exemption details on each sale.

When your vehicle comes to the shop

Your name, email, phone number, company and address.
Your vehicle: VIN, year, make, model, trim, engine, color, plate and state, mileage, fuel level, and condition notes.
Photos of your vehicle and the work, taken at check-in and during the job. Some are shared with you in your account. Others stay internal.
Your signature at drop-off, with your name, the date, and the wording you signed.
Estimates, what you approved or declined, invoices, payments and deposits, appointment times, and staff notes.
When you answer an estimate online, the name you enter, the time, your IP address and your browser and device type. That's our record of what you authorized.

When you send a form or contact us

What you enter on our contact, install quote and dealer inquiry forms: name, email, phone, vehicle, the work you want, budget and your message.
Your email address if you sign up for the newsletter, with the date and where you signed up.
We create a customer record from a form. Staff may add where you heard about us, who referred you, events you came to, follow-up tasks and notes, and why a quote didn't go ahead.
Emails and calls with us. Texts you send to the shop's own number, (520) 405-0117, go to the shop's phone and aren't part of the texting system described below.

When you apply to be a dealer

Business name, entity type, EIN, tax license number, years in business, website, addresses, contact names and details, what you sell and where.
Your resale certificate and any photo you upload.
Your signature on the dealer terms, with your title, the time, your IP address, your browser and device type, and a copy of the terms you agreed to.

From our earlier systems

Customer, order and invoice records from our previous online store (Shopify) and from QuickBooks were copied into this system when it launched. That includes the marketing email choices you made with the old store.

How we use it

To take and deliver orders, do the work on your vehicle, and handle returns, refunds and warranty questions.
To send order, shipping, estimate, invoice and appointment messages.
To run your account and dealer pricing, and to review dealer applications.
To calculate sales tax, keep our books, and meet tax and legal duties.
To understand how the site is used and improve it, and to measure and run our advertising.
To send marketing email or texts, only to people who agreed to them.
To prevent fraud and abuse and keep the site secure.

With your verbal permission, we may show photos of your vehicle in the Builds gallery on our website and on our social media. We ask first. If you'd like a photo of your vehicle taken down, email us at info@zonamotorsports.com and we'll remove it from our website and our own social media posts.

Who else handles your information

These companies handle information for us so we can do the things above. Each one has its own privacy policy.

Stripe takes our online payments, including invoice pay links, and calculates sales tax from your address. We may also use Stripe for card payments at the shop. Your shipping details are sent to Stripe with your order. Affirm handles your application if you choose to pay over time, where that's offered at checkout.
Clerk runs sign-in, and uses Cloudflare Turnstile to block bots at sign-up.
Shippo and the carriers we ship with (USPS, UPS, FedEx and freight companies) get your name, address, email and phone number, if you gave one, to quote and deliver your order.
Suppliers who ship directly to you. On the rare parts a supplier ships for us, that supplier gets your name, shipping address and phone number on our purchase order.
Resend delivers our email. Twilio delivers our texts.
Vercel hosts the website, Neon hosts the database, and Cloudflare provides DNS and file storage (R2), including photos, signatures and documents. All three are based in the United States.
Google (Analytics, Google tag, Merchant Center) and Meta (Pixel) receive browsing and purchase events from the site. See below.
Intuit QuickBooks Online holds our books. Our bookkeeper enters sales by hand today, and we may connect it directly later. Your name, sale details, and possibly your email and phone number end up there.
Expo and Apple deliver notifications to staff phones through our staff app. Those notifications can include staff chat messages about your job.
NHTSA (a U.S. government agency) receives a VIN for lookup, with nothing else about you.
The contractor who builds and runs this website and shop system for us, our accountants and our advisers, when they need access to do that work.

We may also share information when the law requires it, to protect our rights or people's safety, or if the business is sold or reorganized.

Cookies and tracking

We use these first-party cookies:

cart_token remembers your cart for 90 days.
t3d_sid groups your visits for our own analytics. It lasts one year. A new visit starts after 30 minutes away.
garage remembers your vehicle, and VIN if you entered one, for one year.
discount_code remembers a code you entered for 7 days.
dealer_app lets you return to a dealer application for 30 days.
shop-checkout-session opens your order confirmation after you pay, for 24 hours.

Clerk sets its own cookies to keep you signed in, and Stripe sets its own on its checkout page. Your browser also keeps a small note of orders already reported to the tags below, so a reload doesn't count a sale twice.

Google and Meta tags. We use Google Analytics, the Google tag, Google Merchant Center's conversion tag and the Meta Pixel. They set their own cookies, can recognize your browser across other sites and apps, and are used to measure and target advertising. On our public pages, including the cart and checkout address pages, they receive the pages you view, the products you view or add to your cart, when you start checkout, and on the confirmation page your order number, total, tax, shipping and items. Our site doesn't send them your name, email, phone number or address, and we don't turn on their features that collect those details from forms on our pages. We don't run these tags on account, order status, estimate, invoice, dealer application or sign-in pages. We don't show a cookie banner. Our product feed to Merchant Center lists products only, with nothing about you.

Your choices. You can block or delete cookies in your browser; the cart won't work without them. If your browser sends a Global Privacy Control signal, we don't load the Google or Meta tags at all. Our own analytics still run. Google and Meta offer their own ad settings at Google Ad Settings and in your Facebook and Instagram account settings.

Do Not Track. Our site doesn't respond to the older Do Not Track browser setting. It does respond to Global Privacy Control as described above.

Videos on our pages may play from YouTube's privacy-enhanced mode, and YouTube handles what happens when you play one.

Text Messages (SMS)

Zona Motorsports, LLC sends text messages about your service work: booking confirmations and appointment reminders, estimates for your approval, and notices when your vehicle is ready for pickup. We text only customers who give us their mobile number and agree to receive these messages, whether in person at the shop, over the phone, or when booking. Consent to receive texts is not a condition of any purchase.

Marketing texts are separate. Agreeing to texts about your service work doesn't sign you up for marketing texts. We would send you a marketing text, such as an invitation to an event, only if you also agreed separately and in writing to receive them. That consent is not a condition of any purchase either, and saying no doesn't affect your service texts.

Service texts come from our toll-free number, (866) 282-9662. Message frequency varies with your appointments, usually a few messages per job. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. We don't send these texts overnight.

Reply STOP to any message to stop receiving texts; you will get one confirmation and no further messages. Reply START to turn them back on. Reply HELP for help, or contact us at (520) 405-0117 or bobby@zonamotorsports.com.

We use your mobile number to send you these messages and to reach you about your job. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third party. Our messaging provider (Twilio) processes your number only to deliver our texts. If you give a phone number with an order, it goes to the companies that deliver that order, only to deliver it.

Email choices

Order, shipping, estimate and invoice emails are part of doing business with us, so they don't have an unsubscribe. Marketing email goes only to people who agreed to it. Every one has an unsubscribe link and our mailing address. Appointment reminder emails have their own link to stop them. We'll still confirm bookings and tell you when your vehicle is ready.

How long we keep it

Some periods are set in our system:

Our website analytics: about 25 months (760 days), then deleted.
Dealer application drafts: 30 days after the last change, then deleted with their files.
Declined dealer applications and declined certificate renewals: one year, then deleted with their EIN and files.
Estimate approval links stop working after 14 days. Invoice links don't expire. The records behind them stay.
Check-in photos that never get attached to a job: deleted after about 48 hours.
Cookies: as listed above.

Other records we keep for these periods:

Orders, invoices, payments and job records, including check-in signatures and job photos: 7 years.
Your customer account details, such as contact details, saved addresses and vehicles: while your account is open. After it's closed, we keep only what our financial records need.
Form submissions: 2 years.
Copies of the emails and texts we send: 3 years.

Anything else, such as approved dealer records, we keep for as long as we need it to run the business, handle warranty questions and meet tax and legal duties.

Our database host keeps restore points for 7 days. We may also keep separate encrypted database backups for up to 90 days, and backup copies of photos and documents can be kept longer. So deleted information can stay in backups for a while after we delete it.

Your choices and requests

You can update your name, addresses and saved vehicles in your account, and you can manage payment methods stored at Stripe from your account's billing link.

To close your account, use Close account on your account's security page: it removes your login, saved addresses and marketing consents, and keeps your orders and invoices. To see, correct or delete anything else, or to stop marketing, contact us using the details at the end of this policy, and a person will handle it:

Email us at info@zonamotorsports.com and tell us what you want done. You can also call.
We'll confirm it's you, usually by replying to the email or phone number we have on file. We don't ask for more than we need to do that.
We'll tell you what we did, and what we kept and why.

Our owner handles privacy requests personally. We aim to reply within 24 to 48 hours.

We can't delete everything. We keep records we need for tax, accounting, warranty, signed authorizations, disputes and safety, and information already held by carriers, Stripe and other companies stays under their own rules. Closing your sign-in removes your login but not your order or job history, so ask us if you want more than that.

California

California Online Privacy Protection Act. This policy lists the kinds of information we collect, who we share it with, how to review or change it, how we announce changes, and how we respond to Do Not Track. Third parties can collect information about your activity over time and across sites through the Google and Meta tags described above.

California Consumer Privacy Act (CCPA). The CCPA applies to businesses over certain size limits. Our annual revenue is well under its threshold, so we don't believe it applies to us today. If it does apply, or comes to apply, California residents have these rights:

To know what personal information we collected, where from, why, and who received it.
To have it corrected or deleted, with the legal exceptions.
To opt out of the "sale" or "sharing" of personal information, and to limit the use of sensitive personal information.
To use an authorized agent, and not to be treated worse for using these rights.

The categories we collect are identifiers and contact details; commercial information such as orders and invoices; internet activity on our site; approximate location; photos and signatures; vehicle information; business and tax details from dealers, including EINs; and account login details. The sections above give the sources, the purposes and who receives each one.

We don't sell personal information for money. Our use of Google and Meta advertising tags could count as "sharing" under California law. Browsing with Global Privacy Control on stops those tags, or you can contact us. We don't knowingly sell or share the information of anyone under 16.

Whether or not the CCPA applies, you can use the contact process above. California residents can also ask us about disclosures to third parties for their own direct marketing. We don't make those.

Outside the United States

We take orders from other countries, but we're based in the United States and so are our hosting providers. We don't currently target people in the European Union or United Kingdom, and this policy doesn't make promises under their data protection laws. If you contact us from outside the U.S., your information is handled in the U.S.

Children

Our site and shop are for adults and businesses, not children. We don't knowingly collect personal information from children under 13. If you think a child has given us information, contact us and we'll delete it.

Security

The site uses HTTPS, and card details stay with Stripe.
Dealer EINs are encrypted in our database. Signatures and resale certificates are kept in private storage that only authorized staff can reach.
Staff see what their role allows, and many changes are logged.

Some things work by private link instead of a login, so treat them like a password. Estimate and invoice links open without signing in, for anyone who has the link. Photos from check-in and your job are kept in private storage: staff open them through our shop system, and you see the ones we share with you in your account.

No system is perfectly secure, and we can't promise that yours will never be affected. Tell us right away if you think something is wrong.

Changes to this policy

We'll post any changes on this page and update the effective date. If a change is significant, we'll put a notice on the site or email you if we have your address.