- Home
- Privacy
Privacy policy
We keep what you send us for 24 months and hold every ad signal at denied until you say yes.
Nineteen short disclosures. The first is open. The rest open when you want them, or all at once.
No accounts, no passwords, no card data. This site takes inquiries and nothing else.
Each heading below is a full sentence, so you can read the page by its headings alone and open only what you need. A link to a section, such as privacy.html#consent-mode, opens that section directly.
01This policy took effect on October 6, 2026.Effective date
This version of the privacy policy applies from October 6, 2026, and was last updated on that date. It covers go-tto.shop, its inquiry form, its support chat and its consent banner.
02Go Tto, trading at go-tto.shop from Austin, Texas, decides what happens to your data.Who is responsible
The controller of personal data collected on this site is Go Tto, trading as Gotto at go-tto.shop.
Postal address: 51 Oak Lane, Austin, Texas 02304, United States. Email: [email protected]. Phone: +1 (652) 555-4231.
03We collect what you type into the form or chat, a few technical details, one consent record and any ad click identifier in the link.What we collect
The inquiry form sends us your name, phone, email, address, the kind of inquiry, your message, the requested specification and the consent tick. With it, automatically, the server records your IP address, your browser's user-agent string, the referring URL, the moment the form was rendered and the moment it was sent.
The support chat keeps the conversation you write, plus any name, phone or email you choose to give, and stores a token in your browser so you can come back to the same conversation.
Server and access logs record IP address, time, page requested and user-agent for every request.
Your consent choice is stored in your browser under site_consent_v2. Nothing else on this site persists a choice.
Advertising click identifiers: when you arrive from an ad, the link carries gclid, msclkid or fbclid. Those are read by the ad platform's tag only after you allow storage.
We take no account, no password, no payment and no card data. Nothing is sold on this site.
04Each piece of data has one job, and answering you is the main one.What it is used for
- Form and chat content: to answer your question, write a quote, plan an install and handle warranty or configuration support.
- IP, user-agent, timestamps and the two hidden form fields: to filter spam and automated submissions.
- Server logs: to keep the site running and investigate faults or abuse.
- Consent record: to remember your choice so the banner does not ask again.
- Click identifiers and ad cookies, only with consent: to measure which Google Ads, Microsoft Advertising or Meta Ads campaigns lead to inquiries.
05We rely on consent for advertising, on contract steps for inquiries, and on legitimate interest for security.Legal bases
| Purpose | Legal basis |
|---|---|
| Answering an inquiry, quoting | Steps taken at your request before entering a contract, plus your consent tick |
| Orders, warranty, support | Performance of a contract |
| Support chat | Consent, and steps before a contract |
| Spam filtering, server logs | Legitimate interest in keeping the site safe and working |
| Remembering your consent choice | Legal obligation to record consent, and legitimate interest |
| Ad measurement, click identifiers | Consent, withdrawable at any time |
06Google Ads, Microsoft Advertising and Meta Ads send visitors here, and each tags its click.Advertising platforms
This site receives paid traffic today. Google Ads and Microsoft Advertising run campaigns that link here, and Meta Ads does when a campaign runs there.
- Google Ads adds
gclidto the link you clicked. - Microsoft Advertising adds
msclkid. - Meta Ads adds
fbclid.
These identifiers tie your click to the ad that produced it. The platform tags on this site only store or send them after you press Allow on the banner. If you decline, the identifier stays in the address bar and goes nowhere. Running ads on a platform does not mean that platform has checked anything on this site, and we make no such claim.
07Consent Mode v2 keeps all four advertising and analytics signals denied until you allow them.Consent Mode v2
Before any tag loads, this site sets Google consent mode v2 defaults with ad_storage, ad_user_data, ad_personalization and analytics_storage all set to denied.
They switch to granted only when you press Allow. When you press Decline, or later withdraw through Cookie settings in the footer, all four are set back to denied at that moment, and the change is stored under site_consent_v2.
While the signals are denied, no advertising or analytics cookie is written. The cookie notice lists each identifier in a ledger.
08Five outside parties receive data, and we name each one.Who receives it
- Google Ireland Ltd / Google LLC for Google Ads, which attaches gclid to a click and receives the consent signals.
- Microsoft Ireland Operations Ltd for Microsoft Advertising, which attaches msclkid. Its handling is covered by the Microsoft privacy statement at privacy.microsoft.com/privacystatement.
- Meta Platforms Ireland Ltd for Meta Ads, which attaches fbclid, where a campaign runs there.
- Our hosting provider, which serves this site and stores the inquiry database.
- Our mail provider, which carries the notification of each inquiry to our inbox.
We do not sell personal data and we do not hand inquiry content to the ad platforms.
09Data from European visitors travels to the United States under recognised safeguards.International transfers
We are based in the United States and our systems sit there. If you write to us from the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the US. Google, Microsoft and Meta transfer between their Irish and US entities. These transfers rely on the EU-US Data Privacy Framework where the recipient participates, and otherwise on the European Commission's standard contractual clauses.
10Nothing is kept indefinitely, and the longest period is 24 months.Retention
| Category | Period |
|---|---|
| Inquiries and their email copies | 24 months |
| Chat transcripts | 18 months |
| Server and access logs | 90 days |
| Record of a consent choice | 12 months |
11The site runs over HTTPS and the inquiry store is closed to the public.Security
Every page and form submission travels encrypted over HTTPS. Inquiries and chat transcripts sit outside the public web folder, behind a password-protected operator panel only our team uses. Hidden honeypot fields and timing checks keep automated junk out. We take no card data, so there is none to lose.
12If you write from Europe, the GDPR gives you seven rights over your data.GDPR rights
Under the GDPR and the UK GDPR you may ask us for:
- access to the data we hold about you, and a copy of it;
- rectification of anything wrong;
- erasure;
- restriction of processing while a dispute is settled;
- portability, in a machine-readable file;
- objection to processing based on legitimate interest;
- withdrawal of consent at any time, without affecting what was done before.
13Californians and residents of other US states with privacy laws can opt out of sale or sharing.US state rights
Under the California Consumer Privacy Act as amended by the CPRA (CCPA), and the comparable laws of other states in force, including Texas, you have the right to know what we collect, to delete it, to correct it, and to opt out of the sale or sharing of personal data for cross-context behavioural advertising. We do not sell personal data for money. Allowing ad cookies may count as sharing; pressing Decline, or withdrawing in Cookie settings, opts you out. We do not treat you differently for using any of these rights.
14A Global Privacy Control signal from your browser counts as an opt-out, no questions asked.Global Privacy Control
If your browser sends the Sec-GPC header, we honour Global Privacy Control as an opt-out of sale and sharing. The four consent signals stay denied and the banner does not ask you again.
15This is a business hardware site and it is not meant for children.Children
The site is not directed at children under 16 and we do not knowingly collect their data. If a child has sent us something, tell us and we delete it.
16You can complain to a regulator, and you do not need to come to us first.Complaints
In the United States you may complain to your state Attorney General, and in California also to the California Privacy Protection Agency. In Europe you may complain to the data protection authority of the country where you live or work.
17Write to us and we answer any data request within 10 days.Making a request
Use the data request form, email [email protected], or write to Go Tto, 51 Oak Lane, Austin, Texas 02304, United States. Say which right you are using and give the email or phone you used with us so we can find the record. We may ask one question to confirm it is you. We answer within 10 days, free of charge.
18When this policy changes, the date at the top changes and the banner asks again if consent is affected.Changes
We publish every change on this page with a new effective date. If a change touches what the consent banner covers, we reset the stored choice and the banner asks you again. If you have an open inquiry with us and the change is material, we tell you by email.
19A person reads every privacy question sent to our inbox or phone line.Contact
Email [email protected], call +1 (652) 555-4231, or write to Go Tto, 51 Oak Lane, Austin, Texas 02304, United States. The terms and the cookie notice sit alongside this policy.