Privacy Policy
This privacy policy explains how STARGO Motor handles the inquiry and contact information you submit through this website. We use it only to respond to your dealer, distribution, or product inquiries.
Legal
Version 2.0 · Last updated: 27 August 2026
This policy explains what personal data this website collects, why, who else receives it, and how long it is kept. It covers www.stargomoto.com and the inquiry forms and on-site assistant reachable from it.
Blocks marked “Draft · pending counsel review” are complete drafts whose content is a legal determination — legal basis, retention, transfer mechanism, applicable regime — and has not yet been confirmed by our legal counsel. Everything outside those blocks describes what this website actually does today.
1. Who we are
STARGO is the export brand of the company named below, which is the controller of the personal data described in this policy and is established in the People’s Republic of China.
Guangxi Xinli New Energy Technology Co., Ltd.
Brand: STARGO
Website: https://www.stargomoto.com
Email: sales@stargomoto.com
Country of establishment: China
2. What this policy covers
- The public pages of this website.
- The dealer, distribution and product inquiry forms.
- The on-site assistant available on the home page.
It does not cover the private administration area, which is used only by authorised STARGO staff, nor any third-party platform you reach by following a link from here — a marketplace listing, a social profile, WhatsApp or your own email client. Those run under their own terms and notices. This is a business-to-business site and is not directed to children.
3. The data we collect
When you submit an inquiry form, we receive:
- Company name, contact name, email address, country or market — all required.
- Phone number, WhatsApp number and preferred contact channel, where you provide them.
- Business type, product or category of interest, order quantity and your message.
- Your explicit confirmation that you have read this policy — the form cannot be submitted without it.
- Context appended to your message so the sales team can answer without asking again: the page you submitted from, your first landing page, the referring site and any campaign or AI-engine parameters in the URL.
In addition:
- The IP address a submission came from is written to an audit-log entry alongside the inquiry, and is used as the key for form rate limiting.
- If you use the on-site assistant, the text you type and the conversation history are sent to the language-model provider named in section 6. If that conversation is identified as a sales inquiry, it is stored as an inquiry record and pushed to the export team.
- Page views are measured in aggregate by Vercel Web Analytics, which loads on every page.
- A small number of values are kept in your own browser — the full list is in section 8.
We do not ask for, and this website has no field for, payment card details, bank details, government identifiers or any special category of personal data.
4. Why we use it, and our legal basis
Draft · pending counsel review
| Purpose | Data used | Proposed legal basis |
|---|---|---|
| Answering your dealer, distribution or product inquiry | Inquiry form fields | Steps taken at your request prior to entering into a contract, and your consent given at submission (GDPR Art. 6(1)(b) and 6(1)(a)) |
| Alerting the export team by email and WeChat push | Inquiry form fields | Our legitimate interest in operating a sales function (GDPR Art. 6(1)(f)) |
| Running the on-site assistant and extracting an inquiry from the conversation | Chat text and conversation history | Your consent, given by choosing to type into the assistant (GDPR Art. 6(1)(a)) |
| Security, abuse prevention and audit logging | IP address, request metadata | Our legitimate interest in protecting the site and keeping a record of changes (GDPR Art. 6(1)(f)) |
| Aggregate audience measurement | Page-view data | Our legitimate interest in understanding which pages are useful (GDPR Art. 6(1)(f)) |
Where a purpose rests on legitimate interests, we have to balance that interest against your rights; the balancing assessment behind each row is part of what counsel must confirm.
5. How long we keep it
Draft · pending counsel review
- Inquiry records: for the duration of the commercial relationship, and 24 months after the last contact where no relationship follows.
- Audit-log entries containing an IP address: 12 months.
- Assistant conversations: not retained by us except where the conversation became an inquiry record; the language-model provider’s own retention applies to the copy it received.
- Page-view data: retained by the analytics provider in aggregate form only.
These periods are a proposal. The retention that applies to export documentation and to commercial correspondence may be set by tax, customs and company law in more than one jurisdiction, and counsel must confirm each figure before it is relied upon.
The values stored in your own browser (section 8) are not held by us at all: they stay on your device until you clear them or the browser session ends.
6. Who processes data on our behalf
These are the services this website actually sends personal data to. Nothing else receives it, and we do not sell personal data or share it for advertising.
| Recipient | Role | What it receives | Why |
|---|---|---|---|
| Vercel | Hosting, CDN, serverless functions and Web Analytics | Every request to this website: IP address, user agent, requested URL and referrer. Form and chat submissions pass through its serverless functions in transit. | Serving the site and running the inquiry and assistant endpoints; aggregate audience measurement. |
| Supabase | Database and authentication platform | Your inquiry record (every field you submit), any inquiry captured from the on-site assistant, and an audit-log entry holding the IP address the submission came from. Public pages also read published site content from Supabase directly in your browser, which exposes your IP address to it. | Storing and managing dealer inquiries; serving content maintained in the CMS. |
| Resend | Transactional email delivery | The new-inquiry notification sent to STARGO’s own inbox: company, contact name, email, phone, country and your message. | Alerting the export team that an inquiry has arrived. |
| DeepSeek or Google (Gemini) | Large-language-model provider behind the on-site assistant | The text you type into the assistant and the conversation history sent with it. Which of the two receives it depends on the site’s configuration: DeepSeek is used when its key is configured, otherwise Gemini. | Generating the assistant’s replies and extracting inquiry details from the conversation. |
| Server酱 (sctapi.ftqq.com) | WeChat push notification | A summary of an assistant conversation identified as a sales inquiry: name, company, country, model of interest, quantity and any contact details you gave in the chat. | Alerting the export team in WeChat so an inquiry is not missed. |
| Shopify (only when a storefront is connected) | Storefront catalogue and hosted checkout | Your IP address and request data when a product page queries the storefront from your browser, and — if you follow a direct purchase link — whatever you enter at its checkout, which runs on its own domain. | Showing live storefront listings and completing a direct purchase outside this website. |
| Vercel KV or Upstash Redis (only when attached) | Rate-limit counter | A counter keyed on your IP address. | Blocking automated abuse of the public forms. When no such store is attached the counter stays in the memory of the serverless instance. |
If you choose to reach us through WhatsApp, email, a marketplace listing or a social profile, that exchange takes place on that provider’s platform under its own privacy notice.
7. International transfers
Draft · pending counsel review
We are established in China and the recipients in section 6 operate infrastructure in several jurisdictions, so data you submit is processed outside your own country in most cases.
Where personal data of individuals in the EEA or the UK leaves those areas, the intended transfer mechanism is the European Commission’s Standard Contractual Clauses (or the UK International Data Transfer Addendum) with the relevant processor, supported by a transfer risk assessment. The signed data-processing agreement and the transfer mechanism actually in force for each recipient are pending counsel confirmation, and the mechanism required for transfers out of China under the Personal Information Protection Law is being assessed separately.
8. Cookies and browser storage
This website sets no cookies of its own — there is no cookie-writing code anywhere in its source. It uses your browser’s local and session storage for the small number of preferences listed below, and loads no advertising, remarketing, profiling or cross-site tracking script: its content security policy permits scripts only from this site and from Vercel’s analytics endpoint.
| Name | Type | Set by | Purpose | Lifetime |
|---|---|---|---|---|
stargo-cookie-consent | localStorage | This site | Records whether you accepted or rejected the cookie notice, so the banner is shown once. | Until you clear this site’s data |
stargo.chatTeaserDismissed | localStorage | This site | Records that you closed the one-time prompt from the chat assistant, so it is not shown again. | Until you clear this site’s data |
stargo-language | localStorage | This site | Remembers your interface language. | Until you clear this site’s data |
theme | localStorage | This site | Remembers your light or dark appearance preference. | Until you clear this site’s data |
stargo-intro-played | sessionStorage | This site | Stops the opening animation replaying on every page in the same tab. | End of the browser session |
stargo_first_touch | sessionStorage | This site | Records the landing page, referrer and any campaign or AI-engine parameters of your first visit in this tab, so an inquiry you choose to submit carries its source. | End of the browser session |
sb-…-auth-token | localStorage | Supabase | Holds a signed-in administrator’s session. Written only after a successful sign-in to the private admin area; it is never created by browsing the public site. | Until sign-out or expiry |
The banner you see on your first visit records your choice under stargo-cookie-consent so that it is shown once. You should know exactly what that choice does today: it does not switch off the aggregate page-view measurement, because that measurement is the only analytics on the site and it sets nothing in your browser. You can clear every value above at any time through your browser’s site-data settings, and the site keeps working without them.
9. Your rights
You can ask us to:
- Give you a copy of the personal data we hold about you.
- Correct data that is wrong or incomplete.
- Delete data we no longer have a reason to hold.
- Restrict how we use it while a question about it is resolved.
- Send you, or another provider, a portable copy of what you gave us.
- Stop using it where we rely on a legitimate interest, or withdraw a consent you gave — withdrawal does not affect what was done before it.
Write to sales@stargomoto.com with “Data request” in the subject line. We may ask you for enough information to confirm the request comes from you, and we do not charge for it.
10. Complaints to a supervisory authority
Draft · pending counsel review
If you are not satisfied with how we handled your request, you can complain to the data protection authority for your country. We ask that you contact us first so we can try to put it right. Which regimes apply to this website — EU GDPR, UK GDPR, the PRC Personal Information Protection Law, and any US state privacy law — which authority is the lead one, and the statutory deadline within which we must answer you, are pending counsel confirmation; until that lands we aim to answer any request within one month of verifying it.
11. How we protect your data
- The site is served over HTTPS only, with HTTP Strict Transport Security set for one year across subdomains.
- A content security policy restricts scripts to this site and the analytics endpoint, blocks framing of the site entirely, and disallows plugin content.
- Responses carry nosniff, deny-framing, strict-origin-when-cross-origin referrer and a permissions policy that denies camera, microphone and geolocation.
- The inquiry endpoint validates every field on the server, rate-limits by IP, carries a hidden anti-bot field, and refuses any submission without the consent confirmation.
- Database credentials with write access are held only server-side; every inquiry write is recorded in an audit log.
- The administration area requires a sign-in and is excluded from search indexing.
- Security researchers: our contact and disclosure details are published at /.well-known/security.txt.
No transmission over the internet can be guaranteed secure, and these measures reduce risk rather than remove it.
12. Changes to this policy
We update this policy when what the website does changes, or when counsel completes a review of the sections marked above. The version and date at the top of the page always reflect the current text.
| Version | Date | Change |
|---|---|---|
| 1.0 | 27 March 2026 | First published privacy policy. |
| 2.0 | 27 August 2026 | Restructured: named controller, purpose-by-purpose legal basis, retention, processor list, international transfers, cookie and browser-storage inventory, supervisory-authority route, security summary and this version history. Sections that are a legal determination are marked as pending counsel review. |
13. Contact us
Questions about this policy, or a request about your data:
Guangxi Xinli New Energy Technology Co., Ltd.
Attention: Legal / data protection
Email: sales@stargomoto.com
Website: https://www.stargomoto.com