We name every category of data our site visit form and chat actually collect, and how long we keep it.

01Effective date

This policy took effect on September 7, 2026, and it governs every visit to xodaqu.com from that date. If we bring in a new data collection point — a new form field, a new ad platform — we update this document before that collection starts, not after.

02Who controls this data

This site is operated by Xodaqu, trading as Xoda, an onsite equipment maintenance company at 114 River Road, Austin, Texas 57664, United States. Xodaqu is the controller for every category of data listed below — we decide what is collected and why, and we are the party you write to if you want it changed or removed. We are not a marketing agency running this on someone else's behalf; the technicians who answer the phone are the same business that reads this form.

03What we actually collect

The site visit request form on contact.html takes your name, phone number, email, the site address, what kind of enquiry it is, your notes, and any specification you attach, plus the consent tick. Submitting that form also writes your IP address, your browser's user-agent string, the page that referred you, and the two timestamps either side of the submission — when the form loaded and when you sent it.

The dispatch chat widget keeps whatever you type into it, a name, phone or email if you give one, and a return token stored in your browser so the conversation survives a page reload. Beyond the form and the chat, we hold cookie and local-storage identifiers described in the cookie policy, and — because paid clicks land on this site — the advertising click identifiers gclid, msclkid and fbclid attached to a link when a visitor arrives from Google Ads, Microsoft Advertising or Meta Ads.

03aWhat each category is for

Enquiry fields exist so a technician can call you back, find the site and quote the right work — an address error or a missing phone number means a wasted trip. Log data (IP, user-agent, referrer, timestamps) exists to keep the form working and to catch abuse of it. Chat transcripts exist so dispatch can pick a conversation back up without you repeating yourself. Cookie and click identifiers exist to measure whether a Google Ads, Microsoft Advertising or Meta Ads click turned into an actual enquiry — nothing more granular than that.

04Legal basis for each purpose

05The advertising platforms sending traffic here

Google Ads and Microsoft Advertising run paid traffic to this site today, and Meta Ads may. Google Ads attaches a gclid parameter to a clicked ad link; Microsoft Advertising attaches msclkid; Meta Ads attaches fbclid where a campaign is live. Each identifier lets that platform tell whether the click that landed on xodaqu.com went on to become an enquiry. We do not control what Google, Microsoft or Meta do with that identifier once it leaves this site — their own policies govern that, not this one.

06Consent Mode v2

We run Google's Consent Mode v2 on every page. Four signals — ad_storage, ad_user_data, ad_personalization and analytics_storage — are held denied by default the moment a page loads, before you have made any choice. Storage is only switched to granted for the signals you actually allow through the cookie banner, and the moment you decline or later withdraw that choice, all four signals are set back to denied. Nothing measured under those signals is collected while they read denied.

07Who else receives this data

• Google Ireland Ltd / Google LLC — runs Google Ads and receives the gclid identifier along with the Consent Mode v2 signals.
• Microsoft Ireland Operations Ltd — runs Microsoft Advertising and receives the msclkid identifier; its own handling of that data is covered by the Microsoft privacy statement at privacy.microsoft.com.
• Meta Platforms Ireland Ltd — receives the fbclid identifier on any click landing here from a live Meta Ads campaign.
• The hosting provider that serves this site and stores the enquiry database, and the mail provider that carries the form notification to our inbox at office@xodaqu.com.

08Transfers outside the country of collection

Google, Microsoft and Meta process data on infrastructure that sits outside the United States as well as inside it. Where that happens, each of those companies relies on its own standard contractual clauses or an equivalent transfer mechanism recognised under the GDPR to keep the transfer lawful — that mechanism belongs to them, and we do not add a separate one on top of it. Data collected through our own form and chat is stored with a hosting provider serving the United States.

09How long we keep it

10How it is protected

The enquiry form and chat run over an encrypted connection. The submission endpoint checks two hidden honeypot fields before it accepts a post, which stops the bulk of the automated spam that would otherwise sit in the same database as a real enquiry. Access to the enquiry database and chat log is limited to the people who dispatch technicians — it is not open to the wider crew, and it is not exported anywhere beyond the processors named above.

11Rights for visitors covered by the GDPR

If you reach this site from Europe, the GDPR gives you the right to access the data we hold on you, to have inaccurate data corrected, to have it erased, to restrict or object to our processing of it, to receive it in a portable format, and to withdraw any consent you gave at any point, with no effect on processing done before you withdrew it. Write to office@xodaqu.com to use any of these; see clause 17 for what happens next.

12Rights for US state residents

California residents have rights under the CCPA, as amended by the CPRA, including the right to know what personal information we hold, to delete it, to correct it, and to opt out of its sale or sharing — including sale or sharing for cross-context behavioural advertising through Google Ads, Microsoft Advertising or Meta Ads. Residents of other US states with a comparable privacy law have the equivalent rights under that state's statute. We do not sell enquiry or chat data for money; the "sharing" that these rights reach is the advertising cookie and click-identifier activity described above, and you can opt out of it through the cookie banner at any time.

13Global Privacy Control

If your browser sends the Sec-GPC header, we treat it as a Global Privacy Control opt-out signal and hold advertising storage denied for that visit without asking again through the banner. You can still open the cookie choices link in the footer if you want to review or change anything separately.

14Children

This site is built for property owners, facility managers and building operators arranging equipment work. It is not directed at children, and we do not knowingly collect data from anyone under 16. If we learn a submission came from a child, we delete it.

15Complaints

If you think we have mishandled your data, tell us first at office@xodaqu.com so we can look at the actual record. You are also free to complain to your state Attorney General, to the California Privacy Protection Agency if you are a California resident, or, if the GDPR applies to you, to your home country's data protection authority.

16How to request, correct or delete your data

Email office@xodaqu.com with the address or phone number you used on the form or in the chat, and say plainly what you want — a copy of what we hold, a correction, or deletion. You can also write to us at 114 River Road, Austin, Texas 57664. We answer within 10 days. We may ask one follow-up question to confirm you are the person the record belongs to before we act on it, purely so we do not hand your data to someone else.

17Accessibility statement

This site is built with a visible skip link, keyboard-operable navigation and forms, labelled fields, and colour contrast checked against the acid-green accent and the plum ground. Tap targets across the site are sized to at least 44 pixels so the site works on a phone, not only a mouse. If a page, a form or the chat widget does not work with the assistive technology you use, tell us at office@xodaqu.com or call +1 (596) 555-8253 and describe what failed — we will fix the specific defect rather than issue a general apology.

18Changes to this policy

When we change what this site collects or why, we update this page and move the effective date at the top of this document. We do not silently widen what we collect under an old version of this policy — a material change gets a new effective date and, where it affects an ad platform's consent signals, a re-prompt of the cookie banner.

19Contact

Email office@xodaqu.com or call +1 (596) 555-8253 during scheduled hours. Postal correspondence goes to Xodaqu, 114 River Road, Austin, Texas 57664. A person reads and answers these, not a ticket queue.