What we do with what you send us

Who this notice comes from

This site is operated by the company below. This page describes what the site actually does today — it is not a generic template.

That is the company address, not a warehouse. If you are coming to inspect stock, see the Warehouses page — where the goods are and how to book a visit are covered there.

What the enquiry form collects

When you submit the enquiry form, what reaches us is exactly the fields you filled in:

• Contact details — email, WhatsApp or WeChat ID. Required.
• Company name — required, because we sell by the lot to businesses only.
• Company website — optional.
• Ship-to country or region — optional.
• The quantity you are looking at — optional, and only shown when you enquire from a lot page.
• Your message — what you want to know.
• Which lots you are asking about — lot IDs, up to twelve at a time.
• Whether you ticked the import-help box for mainland China.

This goes into our database and is used for one thing: replying to your enquiry and the correspondence that follows from it. When our mail service is configured, a notification of the same enquiry also goes to our own inbox.

If you leave an email address that already matches a buyer record of ours, the enquiry is attached to that record so we can see the history when we reply. Disposable email addresses are rejected outright — we cannot reply to them.

What the stock-alert subscription collects

If you subscribe to stock alerts, we receive your contact details plus the preferences you choose:

• Contact details — email, phone number or WeChat ID. Required.
• The categories you tick — required; this is what alerts are matched against.
• Part numbers or brands you track — optional keywords.
• Buyer type and typical purchase size — optional.
• Company name — optional.
• The site language you were using — it decides which language the confirmation email is written in.

If you leave an email address and our mail channel is configured, we use double opt-in: we send a confirmation email first, and you only join the list once you click the link in it. If you leave a WeChat ID or phone number — which we cannot email — the subscription is recorded as single opt-in and marked as such in our records.

Every confirmation email carries both the confirm link and an unsubscribe link. Unsubscribing takes effect immediately, and anyone who has unsubscribed has to confirm again before rejoining.

Where the enquiry came from

The form also carries the page you submitted from and the standard UTM parameters in the address bar (utm_source, utm_medium, utm_campaign, utm_term, utm_content, utm_id). This is how we know where an enquiry came from.

Only those six keys. Any other query parameter in the URL — your search term, for instance — is not stored with the enquiry. That is a hard-coded allowlist, not something anyone has to remember to strip.

Anti-spam and the security check

The public forms have three anti-spam layers: a hidden field a human never sees but a bot fills in; a check on how long you took between the page loading and submitting (under three seconds is treated as a machine); and a per-IP submission rate limit of five in fifteen minutes. The enquiry form additionally uses Cloudflare Turnstile.

That means we process your IP address briefly: the rate-limit counter lives only in the server process memory, expires on a rolling fifteen-minute window, is lost when the process restarts, and is never written into the enquiry record. For the security check, your IP is sent to Cloudflare with the verification request.

Where it is stored and who handles it

The site runs on Fly.io with Singapore as its primary region. Form submissions are stored in our PostgreSQL database — in production a managed Postgres such as Fly Postgres or Neon.

Email is sent with Nodemailer through the SMTP server we have configured. Where that mail goes out through Brevo, Brevo reports delivery status back to us — and we record only delivery-level events (delivered, soft bounce, hard bounce, blocked, spam complaint, invalid address, deferred, error). We do not record opens or clicks.

Lot photography and files are kept in Cloudflare R2 when it is configured, and on the server itself otherwise. The security check is provided by Cloudflare. Beyond these there are no other processors — no analytics, advertising or CRM service is wired into the public site.

Cookies and browser storage

There are no advertising or analytics cookies on the public site. The only cookie here is the admin sign-in session, issued to our own staff when they log in — browsing the site as a visitor never sets it.

The enquiry basket lives in your own browser localStorage and holds nothing but lot IDs. It is never uploaded on its own — those IDs reach us only when you actually submit the enquiry form. Clear your browser data and the basket is gone.

How long we keep it

Enquiries and buyer records are kept for as long as they are needed for the business relationship — an enquiry is often the start of months or years of correspondence. There is no automatic deletion clock, and we are not going to state a retention period here that nothing enforces.

You can ask us to delete your record at any time — see below.

Your choices and how to reach us

To see, correct or delete what you have given us — or to come off the mailing list — one email is enough: stock@sorintsurplus.com

Please say which contact detail you originally left, otherwise we cannot find the record. Subscription emails all carry an unsubscribe link, which works on its own — no email needed.

Security

The whole site is served over HTTPS only. The admin area sits behind a password login and supports two-factor authentication. No public endpoint will read out enquiries or the buyer list — that data is visible only inside the admin area.

International processing

We operate from Shenzhen, China; the servers are in Singapore; the security check and mail delivery are run by providers elsewhere. So the details you send us may be processed outside your own country or region, subject to the law that applies.