Privacy policy

Last Updated: October 22, 2026

This Privacy Policy explains how Xaalice ("we," "us," or "our") collects, uses, stores, and discloses personal information when you visit https://www.xaalice.com/ (the "Site"), place an order, contact us, or otherwise interact with our services.

We process personal information to operate our online store, fulfill orders, provide customer support, maintain security, and meet our legal obligations. The specific information processed depends on your interactions with the Site and the services and technologies configured for our store.

Visiting or using the Site does not, by itself, constitute consent to every type of personal information processing described in this Policy. We obtain consent when applicable law requires it.

1. Personal Information We Collect

Information You Provide

When you place an order, contact us, or submit a return, refund, or support request, we collect the information you provide, including:

• Your name, email address, telephone number, and billing or shipping address.
• Products purchased, order details, purchase history, order status, and delivery information.
• Payment status, transaction references, and payment confirmation information.
• Messages and information you provide when contacting customer support.
• Information you provide in return, refund, delivery, or other service requests.
• Marketing preferences and account information when you use the relevant features.

Payment Information

Payment providers process the payment details required to authorize and complete transactions. The information processed depends on the payment method selected at checkout. We do not intend to store or directly access complete payment card numbers or card security codes when those details are handled by payment providers.

Do not send complete payment card numbers, card security codes, or passwords through ordinary email or customer support messages.

Information Processed Through the Site

Our e-commerce platform processes information needed to provide storefront functionality, shopping cart and checkout services, order management, and related store functions.

The Site and its configured technologies process technical and usage information to the extent those technologies collect it. This information can include IP address, browser and device characteristics, operating system, language settings, time zone, referring page, pages or products viewed, and interactions with the Site.

This Policy does not claim that every listed technical data category is collected during every visit. It also does not claim that any particular third-party analytics or advertising tool is enabled.

Information From Service Providers

We receive information from service providers when it is needed to complete transactions or provide services. This information can include payment confirmations, order fulfillment details, delivery updates, fraud-prevention information, and customer support records.

2. How We Use Personal Information

We use personal information for the following purposes:

• Processing payments and fulfilling orders.
• Arranging shipping and providing order and delivery updates.
• Processing returns, refunds, and customer support requests.
• Operating, maintaining, troubleshooting, and securing the Site.
• Verifying transactions and detecting or preventing fraud, abuse, and unauthorized activity.
• Maintaining business, transaction, accounting, and tax records.
• Improving the operation and usability of our store and services.
• Measuring website or marketing performance through analytics or advertising services that are configured and in use.
• Sending promotional communications in accordance with applicable consent requirements and your marketing preferences.
• Complying with legal obligations and responding to lawful requests.
• Enforcing our policies and establishing, exercising, or defending legal claims.

We do not use personal information for purposes that applicable law prohibits. When a particular activity requires consent or another legal basis, we meet that requirement before carrying out the activity.

3. Service Providers and Disclosure of Personal Information

We disclose personal information to service providers and other recipients to operate our store, complete transactions, provide requested services, protect security, and meet legal obligations.

Recipients include the following categories when they provide services for our store or when disclosure is otherwise necessary:

• E-commerce platform and hosting providers: to operate the Site, shopping cart, checkout, and order management.
• Payment providers: to authorize payments and process transactions.
• Shipping and fulfillment providers: to prepare, dispatch, and deliver orders.
• Customer support and communications providers: to manage inquiries and service communications.
• Security and fraud-prevention providers: to protect transactions, accounts, and the Site.
• Analytics and advertising providers: when these services are configured and used.
• Professional advisers: such as legal and accounting advisers, when their services require access to relevant information.

We limit the information disclosed to what is reasonably needed for the relevant service or purpose. Service providers acting independently are also subject to their own privacy policies and legal obligations.

We disclose personal information to government authorities, regulators, courts, or law enforcement agencies when required by law or valid legal process. We also disclose information when necessary to protect rights, safety, property, or the integrity of our business.

Personal information may be disclosed as part of a proposed or completed merger, restructuring, business transfer, or sale of relevant assets, subject to applicable law.

4. Cookies, Analytics, and Advertising

Cookies and similar technologies support website functions such as shopping cart operations, checkout, security, and preference settings. The Site's actual configuration determines which cookies and similar technologies operate and what information they collect.

Analytics and advertising technologies measure website activity, evaluate marketing campaigns, or support advertising functions. This Policy does not state that any particular analytics service, advertising network, pixel, remarketing tool, or conversion-tracking feature is enabled. Such activities must be described according to the services actually configured and used on the Site.

Where a cookie banner or consent-management tool is configured, its available controls allow visitors to manage the choices supported by that tool. Browser settings also allow visitors to block or delete certain cookies, although some Site functions may then stop working properly.

We provide consent choices and other cookie controls when required by applicable law. A cookie banner or consent tool must be configured to work with the technologies it governs; the existence of this Policy does not activate any technical feature.

5. Sale, Sharing, and Targeted Advertising

We do not sell personal information for monetary consideration.

Some privacy laws define "sale," "sharing," and targeted advertising more broadly than an exchange of personal information for money. A disclosure to an advertising or analytics provider can fall within one of these definitions depending on the data flow, the provider's role, and the purpose of processing.

Whether our actual data disclosures constitute a sale, sharing, or targeted advertising must be determined from the services and integrations in use. When applicable law grants a right to opt out of such activity, we provide and honor the required opt-out method.

6. Global Privacy Control and Other Opt-Out Signals

Global Privacy Control (GPC) is a browser-based privacy signal that communicates a user's preference to opt out of certain data sales or sharing.

This Policy does not represent that the Site currently detects or honors GPC signals. When applicable law requires us to honor a qualifying signal, the relevant platform settings, privacy tools, and integrations must recognize the signal and carry out the required opt-out.

A written statement in this Policy does not activate GPC detection or processing. The required functionality must be configured and tested.

7. Your Privacy Rights and How to Submit a Request

Privacy rights depend on the law that applies to you and our processing of your personal information. The rights provided by applicable law can include:

• Access: requesting access to personal information we hold about you and information about how we process it.
• Correction: requesting correction of inaccurate personal information.
• Deletion: requesting deletion of personal information, subject to legal exceptions.
• Data portability: requesting a copy of certain personal information in a portable format.
• Opt-out: opting out of certain sales, sharing, or targeted advertising activities.
• Limit certain processing: limiting certain uses or disclosures of sensitive personal information when the law grants that right.
• Withdraw consent: withdrawing consent for processing based on consent, without affecting the lawfulness of processing carried out before withdrawal.
• Appeal or complain: appealing a privacy decision or lodging a complaint with a relevant authority when the law provides that right.
• Non-discrimination: exercising privacy rights without unlawful discrimination or retaliation.

How to Submit a Request

Email hello@xaalice.com with the subject line "Privacy Request." State whether you are requesting access, correction, deletion, an applicable opt-out, or another privacy right. Provide enough information for us to understand and locate the relevant records.

Do not include passwords, complete payment card numbers, or unnecessary sensitive information in your request.

Identity and Authorization Verification

We verify a requester's identity when verification is required or permitted by law. The verification steps depend on the nature of the request, the sensitivity of the information, and the risk of unauthorized access, disclosure, or deletion.

When an authorized agent submits a request, we verify the agent's authority and request identity verification when permitted or required by law. We limit verification information to what is reasonably necessary and do not impose verification requirements on opt-out requests where the law prohibits them.

These deadlines apply to requests governed by the CCPA. Other laws establish their own deadlines and procedures.

Exceptions and Appeals

We retain or continue processing information when the law permits or requires it, including to complete transactions, comply with legal obligations, maintain required accounting or tax records, prevent fraud, protect security, resolve disputes, or establish, exercise, or defend legal claims.

We deny or limit a request only when permitted or required by applicable law. When required, we explain the reason and provide information about available appeal or complaint procedures.

Where applicable law requires a dedicated online form, a particular opt-out link, or another request method, we provide that method in addition to the contact details listed in this Policy. Email alone does not replace a legally required mechanism.

8. California Privacy Disclosures

When the CCPA applies to our business and the relevant processing, California residents have the rights provided by that law, subject to its requirements and exceptions. These rights include rights to know, access, correct, or request deletion of personal information; to opt out of the sale or sharing of personal information; to limit certain uses and disclosures of sensitive personal information; and to be free from unlawful discrimination for exercising privacy rights.

California residents can submit requests using the contact details in Section 8. Businesses subject to the CCPA must provide the request methods required by law. The required methods depend on the business and the type of request.

We do not sell personal information for monetary consideration. Whether a disclosure constitutes a sale or sharing under the CCPA depends on the actual processing arrangements and the law's definitions. Any required opt-out link, request channel, or signal-processing mechanism must be operational.

9. Marketing Communications

We send promotional emails in accordance with applicable law and the marketing preferences recorded for the recipient. You can unsubscribe by using the unsubscribe link in a promotional email. You can also contact hello@xaalice.com to update your marketing preferences.

Unsubscribing from promotional emails does not stop necessary service communications, including order confirmations, shipping notifications, and responses to customer support requests.

Unsubscribing from emails is separate from opting out of the sale, sharing, or targeted advertising of personal information. We process those requests through the privacy mechanisms required by law.

10. Data Retention and Security

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, process orders, provide support, maintain transaction records, prevent fraud, resolve disputes, and meet legal or regulatory obligations.

Retention periods depend on the type of information, the purpose of processing, operational requirements, and legal obligations. When information is no longer required and no legal retention requirement or other permitted purpose applies, we delete it, de-identify it, or otherwise handle it in accordance with applicable law.

We use reasonable safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. No method of electronic transmission or storage guarantees complete security.

11. International Visitors and Children's Privacy

Xaalice is based in the United States. Personal information processed through the Site may be stored or processed in the United States and other countries where our service providers operate. We follow applicable legal requirements governing international transfers of personal information.

The Site is not directed to children under 13. We do not knowingly collect personal information online from children under 13 in violation of applicable law. If you believe a child has provided personal information to us, contact hello@xaalice.com. We will review the report and take action required by law.

12. Third-Party Websites

The Site may link to third-party websites or services. Those websites and services operate under their own privacy policies. We do not control their independent privacy practices. Review their privacy notices before providing personal information directly to them.

13. Changes to This Privacy Policy

We update this Policy when our business practices, platform settings, third-party services, or legal obligations change. We publish the revised Policy on this page and update the "Last Updated" date. We provide additional notice or obtain consent when required by law.

14. Contact Information

Store Name: Xaalice
Website: https://www.xaalice.com/
Email: hello@xaalice.com
Phone: +1 800-823-3638
Business Address: 9032 Wyatt Ct SE, Olympia, WA 98501, United States

Customer Support Hours
Monday–Friday: 9:00 AM–6:00 PM Central Time (CT)
Saturday–Sunday: Closed

Customer support hours apply to general inquiries. They do not change or extend statutory deadlines for privacy requests.