Who We Are and What This Policy Covers
MIBearings LLC operates mibearings.com and is responsible for the personal information it collects for its business. This policy covers our website, quotes, orders, invoices, customer support, and information retained from the former Zen Cart storefront. It also explains disclosures to providers that help deliver these services.
Third-party checkout pages and services have their own privacy notices. Some providers process information for us; others also act independently for payment, security, advertising, or legal purposes. This policy is a notice of our practices, not blanket consent to optional processing. See the related Terms and Conditions, Disclaimer, and Cookie Policy.
Information You Provide and Information from Transactions
We collect information you submit through searches, carts, quote and contact forms, checkout, email, and telephone communications. This may include your name, business, email, phone number, billing and shipping addresses, part numbers, quantities, application details, messages, and attachments.
We retain quote, cart, order, invoice, payment-status, delivery, refund, and support records. Payment and billing services can return transaction identifiers, authorization or settlement status, payer details, limited payment-method details, and fraud or dispute information. Existing customer and order records may include transactions from our legacy storefront.
Please provide only information needed for your request. Do not enter payment credentials, government identification numbers, health information, or other sensitive personal information in search boxes, quote messages, or attachments.
Browsing, Device, Location, and Call Information
Our systems and service providers can receive IP addresses, approximate location derived from IP or request headers, browser and device characteristics, pages and products viewed, searches, referring pages, timestamps, session or cart identifiers, and ad-click identifiers such as gclid and msclkid when present. We use this information for site operation, diagnostics, security, fraud review, search improvement, and the advertising purposes described below.
Our telephone system provides caller number, available caller name, called number, call timestamps, status, and related call-routing metadata. We may associate a call with customer or order history to provide support and maintain business records. Contact us to correct your information.
Why We Use Personal Information
We use information to answer inquiries, identify and source parts, prepare quotes, preserve carts and checkout details, process payments and invoices, fulfill and track orders, provide support, manage returns or disputes, and maintain business and tax records.
We also use information to operate and secure the site, detect misuse and fraud, troubleshoot problems, improve catalog and search tools, measure advertising outcomes, and reach eligible customers with relevant advertising. Where applicable law requires a legal basis, these purposes rely on steps requested before a contract or performance of a contract, legal obligations, legitimate interests in running and protecting the business, or consent for processing that requires it. You may withdraw consent without affecting earlier lawful processing.
Cookies and Browser Storage
We use essential session, cart, profile, and security cookies and browser storage to keep forms and checkout working, restore saved details, remember advertising choices, and cache site resources. The mb_cart and mb_profile cookies may remain for up to 400 days unless cleared sooner. Advertising cookies and identifiers are used only when the Google or Microsoft tags are active under the rules below. Payment providers may use their own cookies when you open their payment flows.
Read the Cookie Policy for details. You can clear cookies, saved site data, and cached pages through your browser. Blocking essential storage may affect cart, quote, checkout, or payment functions. Advertising controls apply to this browser and site; they do not control a payment provider’s independent security cookies.
Google Ads, Microsoft Advertising, and Enhanced Conversions
We use Google Ads, the Google tag, and Microsoft Advertising Universal Event Tracking (UET) for conversion measurement, campaign reporting, remarketing, and relevant advertising. When tags are active, Google and Microsoft collect or receive personal information from your browser and from us, including IP address, device and browser details, page URLs, ad-click identifiers, cookie or similar identifiers, and events such as quote requests, checkout steps, and purchases, with transaction identifiers, currency, or value where applicable.
For enhanced conversion measurement, we may share a normalized, one-way SHA-256 hash of an email address you supply with Google and Microsoft so they can match the event to information already held by their services. Hashing reduces direct exposure but does not make an identifier anonymous. We do not send full payment-card details or private quote messages as enhanced-conversion matching fields.
Microsoft uses the hashed email sent through our UET enhanced-conversion events for conversion attribution and estimated conversion modeling. These enhanced-conversion identifiers are not used by Microsoft for ad personalization. Customer Match audience sharing is a separate activity described in the Customer Match and Other Customer-List Sharing section. Microsoft currently states that it retains advertiser-provided hashed personal identifiers for enhanced conversions for 30 days.
Google and Microsoft use information under their own privacy notices, including to provide advertising, reporting, matching, fraud prevention, and service improvement as applicable. Their use may involve data from other sites or services. Review how Google uses information from partner sites, the Microsoft Privacy Statement, and their advertising preference controls.
Advertising Data Safeguards
Our advertising custom-event fields describe conversion categories, product identifiers, transaction references, currency, and value. We do not include full names, raw email addresses, telephone numbers, street addresses, payment credentials, or private messages in those general event fields. Enhanced matching uses the separate hashed-email field supported by the provider. Customer Match uses the fields described in the Customer Match section and is subject to its own eligibility, consent, and opt-out requirements.
Our advertising policy prohibits using sensitive personal information, including health information, protected characteristics, or precise device location, to build or enrich advertising profiles or audiences. We do not request device GPS location for advertising. Advertising must not target or exclude people in ways that violate applicable anti-discrimination law. Do not submit sensitive personal information in searches, product questions, or attachments.
Customer Match and Other Customer-List Sharing
Separately from browser tags, we prepare eligible first-party contact information from current and historical orders, legacy orders, quote requests, checkout interactions, and completed inbound calls for Google Ads and Microsoft Advertising customer lists. We share customer data with these providers to perform audience matching, advertising, and measurement services on our behalf, including reaching or excluding customers and measuring campaign effectiveness.
Google matching files may contain SHA-256 hashed email addresses, phone numbers (including inbound caller numbers), first and last names, and un-hashed country and postal code. Microsoft Customer Match files contain hashed email addresses. Where supported and eligible, Google matching may also use an observed, un-hashed IP address and observation time; Microsoft Customer Match does not receive that IP information from our exports. We may use call metadata for advertising attribution where a supported matching method is available.
Customer-list sharing is separate from permission to load browser tags. Submitting a quote, calling us, buying a product, or reading this policy does not by itself provide consent where consent is required. List eligibility, applicable regional restrictions, and any required consent must be established separately. We exclude recorded advertising opt-outs from future exports.
When a saved profile or later quote or checkout identifies your contact details, an advertising decline or Global Privacy Control signal can also record hashed contact identifiers for customer-list suppression. A browser choice cannot identify every historical contact record. Email or call us to request suppression of all known email addresses and phone numbers associated with you, or removal from advertising lists already shared. This does not require cancelling an order or foregoing customer support.
Advertising Choices and Consent
For a visitor whose location is verified as a U.S. state other than California, Google and Microsoft advertising tags may load by default unless the visitor declines or sends Global Privacy Control. For California, locations outside the United States (including the EEA, UK, and Switzerland), and unknown locations, the tags stay off until you choose Allow optional ads. A failed region check leaves the tags off.
Use Your Privacy Choices to allow or decline optional ads at any time. The site reloads to apply your choice. Declining prevents future tag loading in this browser but does not erase data previously sent or provider cookies already stored. Clear existing cookies through your browser and use provider privacy controls for information they hold independently. Optional advertising is not required to browse, request a quote, or order.
Global Privacy Control
When a browser sends a valid Global Privacy Control (GPC) signal, MIBearings treats it as a request to opt out of sale or sharing for cross-context behavioral advertising to the extent provided by applicable law. Optional Google and Microsoft tags stay off even if this browser previously saved an Allow choice. We also record suppression for contact identifiers we can associate with that request as described above.
We do not sell customer information for money. Advertising disclosures may nevertheless count as a sale, sharing, or targeted advertising under some privacy laws. You can opt out using Your Privacy Choices, a supported GPC signal, or by contacting us. Essential site delivery, fraud prevention, payment, shipping, and order support continue.
Cloudflare, Hosting, and Site Security
Cloudflare provides DNS, content delivery, caching, network protection, and security checks for our site. Cloudflare and our hosting providers can process request content and metadata such as IP addresses, headers, browser characteristics, URLs, traffic timing, and security signals to deliver traffic, prevent attacks or automated abuse, and diagnose problems. Security challenges or cookies may be used when needed.
These operational services are separate from optional advertising tags. Cloudflare’s privacy notice explains its processing and available rights.
Stripe, PayPal, and Invoiced by Flywire
Stripe and PayPal process payments through their checkout or payment services. They may receive payer and contact details, billing or shipping addresses, purchase amount and currency, transaction references, payment-method information, device or IP information, and fraud-prevention signals. Payment credentials entered in hosted payment flows are handled by those providers; our integration receives information needed to create, reconcile, and support the transaction rather than full card numbers or card security codes.
Invoiced by Flywire handles customer billing records, invoices, payment requests, payment status, and related communications. We may provide your name or company, email, phone, billing or shipping address, purchased items, invoice amounts, and order references so it can provide those services.
Providers can process data for their own compliance, security, dispute resolution, and service purposes in addition to processing for us. In particular, PayPal acts as an independent data controller for its payment processing. Stripe can act as a processor or independent controller depending on the activity. Review each provider’s privacy notice and contact it for rights concerning data it controls independently. Invoiced’s privacy page directs users to the Flywire Privacy Policy.
Shipping, Communications, Search Tools, and Other Recipients
We share necessary contact, address, package, and order information with shipping and rate or label services, carriers such as UPS or USPS, suppliers involved in fulfillment, and customs intermediaries as needed to quote and deliver orders. Email and telephone providers process communications and related metadata for customer service.
Our search tools may send your search text and relevant catalog context to OpenRouter and its model providers to generate part summaries and cross-reference assistance. Catalog documents may also be processed by these services. Avoid including personal or confidential information in searches. Provider data handling depends on the service and model; the generated content may be inaccurate.
Authorized staff and technical vendors may access data as needed to operate the business. We may also disclose information to advisers, authorities, or other parties when needed to comply with law or valid legal process, resolve disputes, protect people or systems, or complete a business transfer subject to applicable protections.
Retention and Security
We retain records according to their purpose, legal obligations, and operational needs. Orders, invoices, refunds, and tax or accounting records may need longer retention than browsing or diagnostic records. Quote and support history may be retained for follow-up and sourcing; security records may be retained for fraud review. Backups can persist for their backup cycle. We may retain minimal hashed opt-out identifiers so a future export does not re-add you.
We use safeguards intended to protect information, but no system or transmission is completely secure. Restrict what you send in open communications. Deletion requests remain subject to required transaction records, dispute preservation, security needs, and other lawful exceptions. Third-party providers apply their own retention requirements.
For server-side records without one fixed expiry date, the retention period is determined by completion of the request or order, ongoing customer support needs, applicable tax and accounting requirements, dispute or claim periods, fraud investigations, and any legal preservation requirement. Contact us to request the retention period or criteria applicable to your records or to request deletion. Browser cart and profile cookies have the up-to-400-day period stated above; Microsoft enhanced-conversion identifier retention is currently 30 days under its published guidance.
International Processing and Regional Privacy Rights
MIBearings is based in the United States. Information may be stored or processed in the United States and other countries where our providers operate, whose laws may differ from those where you live. Where applicable law requires safeguards for a transfer, those safeguards must apply, such as approved contractual protections or another lawful transfer mechanism.
Depending on your location and applicable law, you may have rights to know or access your information, receive a portable copy, correct inaccuracies, delete information, restrict or object to processing, withdraw consent, or opt out of sale, sharing, or targeted advertising. California and other U.S. state rights apply where the relevant law covers our processing. We do not use sensitive personal information to infer personal characteristics.
If you are in the EEA or UK, you may also complain to your local data-protection authority. Where an applicable law provides an appeal, contact us to appeal a privacy-request decision. Exercising a privacy right will not result in unlawful discrimination.
How to Make a Privacy Request
Email mibearings@gmail.com or call 877-929-7280 to request access, correction, deletion, advertising-list suppression, or help with another applicable privacy right. Describe your request and the email addresses or phone numbers we may know you by. An authorized agent may submit a request where permitted, subject to verification of authority.
We may need reasonable information to verify identity and locate the correct records; do not send full payment credentials or sensitive identity documents unless a secure verification method is arranged. We will respond within the time required by applicable law and explain any lawful limits. Contact independent payment or advertising providers directly for data they control. For marketing messages, use any supplied unsubscribe method or contact us; essential order and invoice messages may continue.
Children’s Information
Our site is intended for purchasers and business users who are at least 18. Our advertising policy prohibits creating audiences or remarketing lists that include, target, or profile individuals under 18, including through Microsoft Advertising. This restriction also applies to customer-list advertising and personalization.
The site is not directed to children under 13, and we do not knowingly collect their personal information. If you believe someone under 18 supplied information that is being used for advertising, contact us so we can investigate, remove the information from advertising use, and record the appropriate suppression. Where a higher minimum age applies to a particular activity, that requirement also applies.
Policy Updates and Contact
We may update this policy as services or requirements change. The effective and last-updated date appears above. When required, we will provide additional notice or obtain consent before materially different processing. Posting an updated policy does not retroactively obtain consent for earlier data collection or advertising uploads.
MIBearings LLC, 1056 Smith Rd, Traverse City, MI 49696, USA. Email: mibearings@gmail.com. Toll-free U.S.: 877-929-7280. International: +1 231-929-7280.
