Privacy policy

Effective Date: September 18, 2026

1. Changes to Our Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices, our services, or applicable law. Any changes will be posted on this page, and we will update the effective date above. We review and update this policy at least once every twelve (12) months. Where a change is material, we will notify you by email (if we hold your address) and/or by a prominent notice on our website at least thirty (30) days before the change takes effect. Your continued use of our services after a change takes effect constitutes your acceptance of the revised policy.

2. Information We Collect

Personal data (or personal information) means any information that identifies, relates to, or could reasonably be linked with a particular individual or household. It does not include information that has been de-identified or aggregated so that it can no longer be used to identify you. We collect, use, store, and transfer the following categories of personal data about you:

  • Identity Data: first name, last name, username or similar identifier, title, date of birth, and gender.
  • Contact Data: billing address, delivery address, email address, and telephone numbers.
  • Financial Data: bank account and payment card details.
  • Transaction Data: details of payments to and from you and of products or services you have purchased from us.
  • Technical Data: IP address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.
  • Profile Data: your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
  • Usage Data: information about how you use our website, products, and services.
  • Marketing and Communications Data: your preferences in receiving marketing from us and third parties, and your communication preferences.
  • Sensitive Personal Information (SPI): precise geolocation data, financial account access credentials (e.g., card or bank account numbers together with security credentials), and the contents of communications you send us (unless we are the intended recipient). We do not intentionally collect data revealing racial or ethnic origin, religious or philosophical beliefs, health conditions, sexual orientation, biometric data, or similar special categories of data. Where a customer voluntarily provides this type of information to us (for example, in a support message), we treat it as Sensitive Personal Information and use it only as reasonably necessary to respond to you. We use SPI only for the purposes described in this policy and do not use it to infer characteristics about you without your consent. You have the right to limit our use of SPI — see Section 11.

We also collect, use, and share Aggregated Data, such as statistical or demographic data, for any purpose. Aggregated Data is derived from personal data but is de-identified so it cannot reasonably be used to identify you, and we will not attempt to re-identify it.

Where we need to collect personal data by law or under the terms of a contract with you, and you fail to provide that data when requested, we may not be able to perform the contract, including providing a product or service you have with us. We will notify you if this is the case.

Notice at Collection. At or before the point we collect your personal information, we will provide a Notice at Collection identifying the categories of personal information collected and the purposes for which each category is used. This notice is available at Section 19 of this policy.

3. How We Collect Your Data

We use the following methods to collect data from and about you:

  • Direct interactions. You may give us your Identity, Contact, and Financial Data by filling in forms or corresponding with us by post, phone, email, or otherwise — including when you apply for our products or services, create an account, subscribe to our service or publications, request marketing, enter a competition, promotion, or survey, or give us feedback.
  • Automated technologies. As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions, and patterns using cookies, server logs, and similar technologies. See Section 6 (Cookies) for details.
  • Third parties or publicly available sources. We may receive personal data about you from analytics providers (such as Google), advertising networks, payment and delivery service providers, data brokers, and publicly available sources.

Global Privacy Control (GPC). We recognize the Global Privacy Control opt-out preference signal. If your browser or device transmits a GPC signal when you visit our website, we treat it as a valid request to opt out of the sale and sharing of your personal data for targeted advertising, to the extent required by applicable law. The signal applies only to the specific browser or device from which it is sent.

4. How We Use Your Data

We use your personal data only where we have a lawful basis to do so, including to:

  • Register you as a new customer and perform our contract with you.
  • Process and deliver your orders, manage payments, and recover amounts owed.
  • Manage our relationship with you, including notifying you of changes to our terms or this policy.
  • Administer and protect our business and website (troubleshooting, data analysis, testing, system maintenance, security, and hosting).
  • Deliver relevant website content and advertising, and measure advertising effectiveness.
  • Use data analytics to improve our website, products, services, marketing, and customer experience.
  • Engage in targeted advertising. You have the right to opt out of this use — see Section 11.

Data Minimization. We collect, use, retain, and disclose personal data only to the extent reasonably necessary and proportionate to the purposes described above, and we do not process your personal data for purposes incompatible with those purposes without your consent. Specific retention periods are set out in Section 9.

We will only use Sensitive Personal Information for purposes described in this policy or with your explicit consent if required by law.

5. Who We Share Your Data With

We may share your personal information with members of our corporate group (affiliates and subsidiaries) and with selected third parties, including:

  • Payment processors and, where we offer financing, financing partners and credit reference agencies.
  • Shipping and fulfillment partners (where applicable to our products or services).
  • Customer service and support platforms.
  • Web analytics providers (e.g., Google Analytics) and advertising networks.
  • Cloud storage and IT infrastructure providers.
  • Fraud-prevention services.
  • Professional advisors (lawyers, accountants, auditors), as required.
  • Business acquirers, in the event of a merger, acquisition, or asset sale.

We may also disclose your personal information if we sell or buy a business or assets, if substantially all of our assets are acquired by a third party, or if we are under a duty to disclose or share your data to comply with a legal obligation or to protect the rights, property, or safety of our customers or others.

We require all third parties to protect your personal data through data processing agreements. These agreements require processors to: (a) process personal data only for specified, disclosed purposes and in accordance with our documented instructions; (b) maintain appropriate security measures; (c) delete or return data upon termination; and (d) cooperate with consumer rights requests. We do not permit service providers to use your personal data for their own purposes.

We do not sell your personal information for monetary consideration. We do share data with advertising networks in exchange for services (including cross-context behavioral advertising), which may constitute a “sale” or “sharing” under California and other state privacy laws. You may opt out as described in Section 11. The categories of personal information we share and the purposes for sharing are set out in Section 19 below.

  • How to opt out: You may opt out of sale or sharing and limit our use of Sensitive Personal Information by: using the “Do Not Sell or Share My Personal Information” link in our website footer; using the “Limit the Use of My Sensitive Personal Information” link in our footer; enabling a Global Privacy Control (GPC) signal in your browser; or contacting us at the privacy contact methods in Section 13. We honor GPC signals and the footer opt‑out links and will apply reasonable technical controls to implement opt‑outs.

6. Cookies and Tracking Technologies

We and our partners use cookies and similar technologies (pixels, local storage, device identifiers) to make our sites work, remember preferences, measure performance, and show relevant advertising if you consent. Non‑essential tracking (analytics, advertising, targeting, session replay) requires your consent where required by law.

A cookie is a small text file placed on your computer or device when you access our website. We use cookies to improve your experience and for analytics, advertising, and security purposes. We use a cookie consent tool that lets you accept, reject, or customize non-essential cookies before they are placed, and to change your preferences at any time via the “Cookie Settings” link in our website footer.

We use three categories of cookies:

  • Strictly Necessary: required for the website to function. No consent is needed for these.
  • Analytics (e.g., Google Analytics): track usage patterns to help us improve our service. You may opt out.
  • Advertising/Targeting: used to serve relevant ads and measure ad effectiveness, including tracking pixels from advertising and social media platforms (collectively, “Advertising Pixels”) such as the Meta (Facebook/Instagram) Pixel and Conversions API, Google Ads remarketing tags, and, where used, the X (Twitter) Pixel and TikTok Pixel. A current list of the specific advertising and analytics partners we use is available on request at privacy@xidax.com. Opting out of these cookies constitutes an opt-out of the sale or sharing of your personal information for targeted advertising. See Section 11.

No Tracking Before Consent. Advertising Pixels do not load, and no data is transmitted to Meta, Google, or any other advertising platform, until you affirmatively consent through our cookie consent tool. If you decline advertising cookies, or have not yet made a choice, Advertising Pixels remain disabled for your visit.

Control and consent mechanisms

  • Banner options: Accept All | Reject Non‑Essential | Manage Settings.
  • Consent storage: Consent choices must be persisted server‑side and auditable (receipt with timestamp and source: banner, GPC, account setting).
  • Script blocking: Third‑party scripts that perform non‑essential functions must be blocked until user consent is obtained.
  • Global Privacy Control: We treat a valid GPC signal as an opt‑out of sale/sharing for applicable cookies and processing.

Advanced Matching and Hashed Data. Where enabled and only after consent, some Advertising Pixels use features such as Meta's “Advanced Matching” that share a cryptographically hashed (one-way encrypted) version of identifiers you provide us, such as your email address or phone number, with the advertising platform for ad measurement and audience matching. You may disable Advanced Matching by declining advertising cookies or by opting out of targeted advertising in Section 11.

Sensitive Pages Excluded. We do not fire Advertising Pixels or session-recording/analytics scripts on checkout or payment-entry fields, account login pages, or live chat/customer support conversations, beyond what is strictly necessary to process your transaction or request.

Consent Records. We retain a timestamped record of your cookie and tracking consent choices for at least two years to demonstrate compliance.

To disable cookies entirely, change your browser settings; note that this may affect website functionality. For more information, visit www.allaboutcookies.org.

Meta / Facebook and other social tracking. We may use Meta (Facebook) tracking tools (pixels, SDKs) or similar social media trackers that transmit event data to Meta and its partners for purposes such as advertising measurement and targeted advertising. If we use Meta trackers, we will:

  • disclose the existence and purposes of Meta tracking on the cookie page and in this policy; and
  • honor opt‑outs via footer Do Not Sell/Share link, CMP settings, and GPC signals.

If you have received a demand or inquiry regarding Meta tracking, please contact our privacy team at the address in Section 13 for records of consent and the tag inventory.

7. International Transfers

Xidax LLC is headquartered in Midvale, Utah, USA, and your information is stored and processed in the United States. If you access our services from outside the United States, your information will be transferred to, stored, and processed in the U.S., where privacy laws may differ from those in your country. We take appropriate safeguards to ensure your personal data is treated securely and in accordance with this policy regardless of where it is processed.

8. Security

We maintain a Written Information Security Program (WISP) that includes administrative, technical, and physical safeguards appropriate to the size and nature of our business and the sensitivity of the personal information we maintain. We have procedures to detect, investigate, and respond to a suspected personal data breach, and will notify affected individuals and any applicable regulator where legally required to do so, consistent with our incident response plan. No transmission of information over the internet is completely secure, and we cannot guarantee absolute security.

9. Data Retention

We retain personal information and data as long as necessary to provide services, comply with legal obligations, resolve disputes, enforce agreements, and for legitimate business purposes described in this policy. Our current retention schedule is:

  • Customer account, contact, financial, and transaction data: Up to 7 years after account closure, for tax, legal, and warranty compliance.
  • Technical and usage data (IP addresses, logs): 12-24 months, then deleted or anonymized.
  • Marketing preferences: until you opt out or request deletion.
  • Customer support records: 2-7 years from resolution depending on content.
  • Call recordings (where applicable): 2 years from the date of the call (if we record calls).
  • Opt-out and consent records (Do Not Sell/Share, cookie choices): retained indefinitely to honor your preference.

In some circumstances we may anonymize your personal data for research or statistical purposes, in which case we may use it indefinitely without further notice. See Section 11 for your right to request earlier deletion. When data is no longer needed, we delete, anonymize, or aggregate it.

10. Third-Party Links

Our website may contain links to third-party websites. Those websites have their own privacy policies, and we do not accept responsibility or liability for them. Please review those policies before submitting personal data to those sites.

11. Your Privacy Rights

Depending on where you live, you may have the following rights regarding your personal data. We will not discriminate against you for exercising any of these rights.

  • Right to Know / Access: confirm whether we process your personal data, and receive a copy, including categories collected, purposes of use, and specific pieces of data.
  • Right to Delete: request deletion of your personal data, subject to certain legal exceptions (e.g., completing a transaction, legal obligations).
  • Right to Correct: request correction of inaccurate personal data we hold about you.
  • Right to Data Portability: receive your personal data in a portable, machine-readable format.
  • Right to Opt Out of Sale or Sharing: direct us to stop selling or sharing your personal data with third parties, including for cross-context behavioral advertising. Your Privacy Choices
  • Right to Opt Out of Targeted Advertising: direct us to stop using your personal data for cross-context behavioral (targeted) advertising. Your Privacy Choices
  • Right to Limit Use of Sensitive Personal Information (California): direct us to limit the use and disclosure of your SPI to what is necessary to perform the services you requested. Your Privacy Choices
  • Right to Non-Discrimination: we will not deny you goods or services, charge different prices, or provide a different level of service because you exercised your privacy rights.
  • Right to Appeal: if we deny your request, you may appeal by contacting us in writing within 30 days of receiving our denial. See Section 13.

Response Timeline. We will confirm receipt of a verifiable request within 10 business days and respond within 45 calendar days, extendable by an additional 45 days where reasonably necessary, with notice to you.

Verification. We will verify your identity before fulfilling a request. We will not require you to create an account solely to submit a request.

Authorized Agents. You may designate an authorized agent to make a request on your behalf. We may require written authorization from you and may still verify your identity directly.

We honor Global Privacy Control (GPC) browser signals as a valid opt-out of the sale and sharing of personal data. To exercise any of these rights, contact us using the methods in Section 13.

12. Glossary

  • Sensitive Personal Information means personal information that reveals financial account details with access credentials, precise geolocation, contents of communications (unless we are the intended recipient), genetic or biometric data used to identify a consumer, and similar data as defined under Cal. Civ. Code § 1798.140(ae) and comparable state laws.
  • Sale means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information to a third party for monetary or other valuable consideration.
  • Sharing (California) means disclosing or making available a consumer's personal information to a third party for cross-context behavioral advertising.
  • Targeted Advertising means displaying advertisements selected based on personal data obtained from a consumer's activities over time and across non-affiliated websites or applications.
  • Legitimate Interest means the interest of our business in conducting and managing our operations to give you the best service and most secure experience, balanced against any potential impact on you.
  • Performance of Contract means processing your data where necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into one.
  • Legal Obligation means processing your data where necessary to comply with a law or regulation we are subject to.

13. Contact and Verification Requests

Questions, comments, and requests regarding this privacy policy are welcomed. Please contact us by:

  • Email: privacy@xidax.com
  • Phone: 877-943-2972
  • Online: privacy@xidax.com
  • Mail: Xidax LLC, Attn: Privacy, 145 West 7200 South Suite A, Midvale, UT 84047

California residents may submit a verifiable consumer request using any of the methods above; we offer at least two methods for submitting consumer rights requests. To appeal a denied consumer rights request, contact us in writing at the address above within 30 days of receiving our denial.

We verify requests to exercise privacy rights to protect the security of personal information. Verification may include:

  • account authentication (for account holders);
  • sending a confirmation code to the email or phone number associated with the account;
  • requesting two pieces of account information; or
  • requiring government‑issued ID for certain high‑risk requests.

Authorized agents: An authorized agent may submit requests on a consumer’s behalf with a signed authorization from the consumer and verification of the agent as required by law. We may deny requests if we cannot verify identity or authorization.

14. California Residents — California Privacy Rights Act (CPRA)

This section supplements the rest of this policy and applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code §§ 1798.100 et seq.), operative January 1, 2023. It grants California residents the following rights:

  • Right to Know (§§ 1798.100, 1798.110, 1798.115): know what personal information we collect, use, share, or sell.
  • Right to Delete (§ 1798.105): request deletion of personal information we hold about you.
  • Right to Correct (§ 1798.106): request correction of inaccurate personal information.
  • Right to Opt Out of Sale or Sharing (§§ 1798.120, 1798.135): direct us to stop selling or sharing your personal information, including for cross-context behavioral advertising.
  • Right to Limit Use of Sensitive Personal Information (§ 1798.121): restrict our use of SPI to providing the services you requested.
  • Right to Non-Discrimination (§ 1798.125): we will not discriminate against you for exercising your rights.
  • Shine the Light (§ 1798.83): request a list of third parties to whom we disclosed personal information for direct marketing purposes in the prior calendar year, by contacting us at privacy@xidax.com.

Categories of personal information we collect include: identifiers (name, address, email, IP address, account name); personal information under Cal. Civ. Code § 1798.80 (payment card details); internet or network activity (browsing history, interaction with our website); geolocation data (approximate location from IP address); audio information (call recordings, where applicable, with notice given at the start of the call); and inferences drawn from the above. See Sections 2, 4, and 5 for the purposes of collection and categories of third parties to whom it is disclosed.

Children under 13 require verifiable parental consent before their personal information may be sold or shared. Children ages 13–15 must provide affirmative opt-in consent. We do not sell or share the personal information of consumers we know to be under 16 without the required consent.

We do not offer financial incentive programs in exchange for the retention or sale of personal information at this time.

Annual CPRA metrics, if required, are published at privacy@xidax.com on request in compliance with Cal. Civ. Code § 1798.130(a)(7).

To opt out of the sale or sharing of your personal information, or to limit our use of your Sensitive Personal Information:

  • Click “Do Not Sell or Share My Personal Information” in our website footer;
  • Click “Limit the Use of My Sensitive Personal Information” in our website footer;
  • Email privacy@xidax.com with subject line “California Privacy Request”;
  • Enable the Global Privacy Control (GPC) signal in your browser; or
  • Mail: Xidax LLC, Attn: Opt-Out, 145 West 7200 South Suite A, Midvale, UT 84047.

15. Utah Residents — Utah Consumer Privacy Act (UCPA)

Xidax LLC is headquartered in Midvale, Utah. As a Utah company, we are directly subject to the Utah Consumer Privacy Act (Utah Code §§ 13-61-101 et seq.), effective December 31, 2023, and we treat Utah's requirements as a baseline standard for this policy, extending the same core rights to residents of other states in Sections 14 and 16–18 below.

The UCPA grants Utah residents the right to:

  • Right to Know / Access — confirm whether we process your personal data and access it.
  • Right to Delete — delete personal data you have provided to us.
  • Right to Correct — request correction of inaccurate personal data we hold about you (effective July 1, 2026 under 2025 amendment H.B. 418).
  • Right to Data Portability — obtain a copy of your personal data in a portable format.
  • Right to Opt Out of Sale — stop the sale of your personal data.
  • Right to Opt Out of Targeted Advertising — stop the use of your data for targeted advertising.

As a Utah-headquartered business, we apply this same set of rights — including the Right to Correct — to all consumers who contact us, regardless of state of residence, as a matter of company policy.

We obtain your consent before processing Sensitive Personal Information for purposes beyond those described in this policy. To submit a request, use the contact methods in Section 13; we will respond within 45 days, extendable by an additional 45 days with notice. Utah residents may submit a complaint to the Utah Division of Consumer Protection at consumerprotection.utah.gov.

16. Colorado, Connecticut & Virginia Residents

Residents of Colorado (Colorado Privacy Act, C.R.S. §§ 6-1-1301 et seq., eff. July 1, 2023), Connecticut (CTDPA, Conn. Gen. Stat. §§ 42-515 et seq., eff. July 1, 2023), and Virginia (VCDPA, Va. Code Ann. §§ 59.1-575 et seq., eff. January 1, 2023) have the right to:

  • Access, correct, delete, and obtain a portable copy of your personal data.
  • Opt out of: (a) the sale of personal data, (b) targeted advertising, and (c) profiling that produces legal or similarly significant effects on you.
  • Appeal a denied request (Colorado and Connecticut residents) — see Section 13 for the appeal process, and Virginia residents may also submit complaints to the Virginia Attorney General.

Consent is required before we process your sensitive personal data for purposes beyond those described in this policy.

Colorado — Universal Opt-Out. Per C.R.S. § 6-1-1306(1)(a)(IV), we honor the Global Privacy Control browser signal as a valid opt-out for Colorado residents. Connecticut residents' GPC signals are honored on the same basis.

To submit a request, use the contact methods in Section 13 or our privacy rights portal at privacy@xidax.com. We will respond within 45 days, extendable by an additional 45 days with notice.

17. Texas, Oregon & Montana Residents

The Texas Data Privacy and Security Act (TDPSA, eff. July 1, 2024), Oregon Consumer Privacy Act (OCPA, eff. July 1, 2024), and Montana Consumer Data Privacy Act (MCDPA, eff. October 1, 2024) grant residents of those states the rights described in Section 11: access, delete, correct, port, and opt out of sale of personal data, targeted advertising, and certain profiling. To submit a request or appeal a denied request, use the contact methods in Section 13 with your state and “Privacy Appeal” in the subject line.

18. Other U.S. State Residents

If you reside in a state with a comprehensive consumer privacy law not separately addressed above — currently including Indiana, Kentucky, Rhode Island, Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Tennessee, and Washington — you have the rights described in Section 11 to the extent granted by your state's law, generally including the right to access, delete, correct, and port your personal data, and to opt out of the sale of personal data, targeted advertising, and certain automated profiling. As a matter of company policy, we honor the Global Privacy Control (GPC) signal as a valid opt-out request for all site visitors, regardless of state of residence, even where not required by your state's law. To submit a request or appeal, use the contact methods in Section 13. As additional states enact comprehensive privacy laws, we intend to extend these same rights to residents of those states, and we review and update this policy at least once every twelve (12) months to reflect newly effective state privacy laws.

19. Categories of Personal Information We Collect and Why

We collect the following categories of personal information for the purposes described below. For each category we indicate typical sources, primary purposes of use, and examples of recipients.

  • Identifiers: name, mailing address, email address, telephone number, account user name, device identifiers. Source: you (directly), service providers. Purposes: account creation, purchase fulfillment, customer support, fraud prevention. Recipients: payment processors, shipping providers, service providers.
  • Account & Transactional Data: order history, billing name, payment token (we do not store raw card numbers), subscription status. Source: you and payment processors. Purposes: order processing, refunds, tax/accounting, dispute resolution. Recipients: payment processors, tax authorities (if required).
  • Device & Online Identifiers: IP address, device type, browser, cookies, mobile identifiers, tag manager data. Source: collected automatically from devices. Purposes: site operation, analytics, security, advertising where permitted. Recipients: analytics and advertising vendors, CDN providers.
  • Internet or Network Activity: browsing history on our sites, search terms, session logs, crash reports. Purposes: analytics, product improvement, troubleshooting.
  • Sensitive Personal Information (as submitted by you): account credentials, authentication tokens, health or biometric data if provided in content. We treat sensitive categories with additional protections and obtain opt‑in consent for uses that require such consent under applicable law.

20. Mobile Terms of Service

The Xidax LLC mobile message service (the “Service”) is operated by Xidax LLC.

By consenting to our SMS/text messaging service, you agree to receive recurring SMS/text messages from us through your wireless provider to the mobile number you provided, even if your number is on a Do Not Call list. Messages may be sent using an automatic telephone dialing system. Service-related messages may include order updates and account alerts. You do not need to sign up for this service to make a purchase, and consent is not a condition of purchase.

You are responsible for all carrier charges associated with text messaging. Message frequency varies; message and data rates may apply.

To opt out, text STOP to +1 888-812-1784 or click the unsubscribe link in any text message. For support, text HELP to +1 888-812-1784 or email privacy@xidax.com.

21. Recordkeeping

We maintain records of consumer requests, our verification steps, and our responses for a reasonable period to demonstrate compliance with applicable law.

22. Children and Minors

We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete that information. If you believe a child under 13 has provided us personal information, please contact us at the privacy contact methods listed in Section 13.

23. Automated Decision‑Making and Profiling

We generally do not use automated decision‑making that produces legal or similarly significant effects on consumers. If we use automated profiling that has a significant effect on you (for example, automated eligibility determinations), we will disclose the logic and meaningful information about the decision, and provide a way to request human review.