Privacy Policy

XURPRISES — xurprises.com Last Updated: December 18, 2025

This Privacy Policy explains how XURPRISES (“XURPRISES”, “we”, “us”, “our”) collects, uses, shares, and protects information when you visit or use xurprises.com (the “Site”), create an account, purchase subscriptions/digital products, or purchase physical products (collectively, the “Services”).

By using the Site, you agree to this Privacy Policy. If you do not agree, do not use the Site.

1) Controller and Contact

Controller: XURPRISES (operating through xurprises.com)
Privacy and requests email: contact@xurprises.com

Note: We do not publish a physical address. Requests are handled by email.

2) Scope and Audience

• The Site may be used by users worldwide.
• Physical products, when available, are shipped only to addresses within the United States.
• The Site is not intentionally directed to children/minors. If you are a parent/guardian and believe a minor has provided personal information, please contact us at contact@xurprises.com.

3) Information We Collect

Depending on how you use the Site, we may collect:

3.1 Information you provide

• Account information: email address (including verification) and other basic details you choose to submit.
• Order/billing information: name, email, phone number, and information related to your order.
• Shipping information (physical only): full U.S. address, phone number, and typical delivery details required to fulfill shipments.
• Communications: if you email us, we receive the information you include in your message.

3.2 Information collected automatically

• Technical and usage data: IP address, browser type, operating system, pages viewed, events, timestamps, device identifiers, and similar data.
• Cookies and similar technologies: to remember preferences, measure performance, improve user experience, and support marketing (see Section 7).

4) Payments: Stripe and Card Data

We process payments through Stripe.

• XURPRISES does not directly store your full card details (e.g., full card number, CVV).
• Stripe may process and store payment information under its own policies and security standards.

5) How We Use Information (Purposes)

We use personal information to:

• Create and manage your account (registration, access, verification).
• Deliver digital content and enable access to subscriptions/benefits.
• Process purchases and prevent fraud (including technical and payment validation).
• Send transactional communications (confirmations, access emails, simple receipts, operational notices).
• Marketing (promotions, launches) when applicable.
• Analytics and product improvement (understanding Site usage and improving performance).
• Legal/accounting compliance and dispute management, when applicable.

6) Legal Bases (Global Approach)

Because we operate globally, processing may rely on:

• Contract performance (to provide access/delivery after purchase).
• Legitimate interests (security, fraud prevention, Site improvement, analytics).
• Consent (e.g., certain cookies or marketing, where required by law).
• Legal obligations (accounting, compliance, dispute resolution).

7) Cookies, Analytics, and Advertising (Pixels)

7.1 Tools we may use

The Site may use tools such as:

• Google Analytics
• Meta Pixel
• TikTok Pixel
• Microsoft Clarity
• Hotjar

These tools may collect information about your Site usage (e.g., pages visited, events, interactions) and help measure campaigns and run remarketing.

7.2 Cookie controls

• You can control cookies through your browser settings (block, delete, limit).
• We may not always have a cookie-consent banner in place. If your applicable law requires prior consent for certain cookies, we will implement reasonable consent mechanisms where appropriate.

8) How We Share Information

We do not sell personal information.

We may share information only as necessary with service providers to operate the Services, for example:

• Supabase (database and/or authentication).
• Vercel (hosting and infrastructure).
• Resend (delivery of transactional emails and/or communications).
• Vimeo (video hosting/player for courses).
• ShipStation (logistics management and label generation; may connect to carriers).
• Stripe (payment processing).
• Analytics/advertising providers listed in Section 7.

We may also disclose information:

• To comply with law, court orders, or valid governmental requests.
• To protect rights, safety, and prevent fraud.
• In connection with a reorganization, sale, or transfer of the business (with reasonable safeguards).

9) International Data Transfers

Because we use global providers (e.g., Vercel, Supabase, Stripe, Resend, Vimeo, and analytics tools), your information may be processed or stored in countries different from your country of residence. We take reasonable measures and rely on our providers’ contractual and security commitments.

10) Data Retention

We retain information:

• While your account exists or as needed to provide the Services.
• For a reasonably necessary period for legal compliance, security, fraud prevention, and dispute resolution.
• We may delete or anonymize information when it is no longer needed or when you request deletion, subject to legal/operational limitations.

Note: Certain retention may depend on provider configurations and practices (e.g., Supabase). Even so, XURPRISES may manage deletions where reasonably possible.

11) Security

We implement reasonable technical and organizational safeguards, including:

• Email verification during account creation.
• Access controls and security best practices across our infrastructure and providers.

However, no system is 100% secure. We cannot guarantee absolute security against advanced attacks or third-party failures.

12) Your Rights and How to Exercise Them (30 Days)

Depending on your location, you may have rights to:

• Access your information.
• Correct information.
• Request deletion.
• Object to certain processing.
• Request portability (where applicable).

How to submit a request

Email contact@xurprises.com and include:

• The email associated with your account
• Your specific request (access, correction, deletion, etc.)

Response timeframe: we aim to respond within 30 days.

We may require identity verification to protect against fraudulent requests.

13) California (CCPA/CPRA) — General Notice

• XURPRISES does not sell personal information.
• You may request access/deletion as described in Section 12, subject to verification.

This is a general notice and not legal advice. If your operation grows and you need full CCPA/CPRA compliance (e.g., “Notice at Collection” and specific disclosures), consider a legal review.

14) EEA/UK (GDPR/UK GDPR) — General Notice

If you are located in the European Economic Area or the United Kingdom, you may have additional rights (e.g., lodging a complaint with a supervisory authority). We aim to use reasonable data-protection practices and providers with security commitments.

If you require full GDPR compliance (including DPAs, SCCs, and consent configuration), a legal and technical review is recommended.

15) Artificial Intelligence (AI)

XURPRISES plans to introduce AI-powered customer support and response automation on the Site. If implemented, we may process messages and related metadata necessary to provide support, using reasonable security and data-minimization practices.

16) Third-Party Links

The Site may contain links to third-party websites. We are not responsible for their privacy practices. We recommend reviewing the privacy policies of those third parties.

17) Changes to This Policy

We may update this Privacy Policy from time to time. We will post the current version on the Site with the “Last Updated” date. Continued use of the Site indicates acceptance of the updated policy.

18) Contact

For privacy-related questions or requests:
contact@xurprises.com