Privacy policy

Last Updated: October 17, 2026

1. About This Privacy Policy

Welcome to Xalavelle (“Xalavelle,” “we,” “us,” or “our”).

Xalavelle is an independent online retailer operating through the Shopify platform. We primarily serve customers in the United States and offer collectible figures, action figures, model products, and related collectibles.

Website: https://www.xalavelle.com/

We respect your privacy and are committed to handling your personal information in a transparent and responsible manner. This Privacy Policy explains how we may collect, use, disclose, retain, and protect your personal information when you visit our website, browse products, place an order, contact customer service, or otherwise use our services.

This policy also explains certain privacy rights you may have under applicable law, including rights to access, correct, or delete personal information and to opt out of certain data sharing or targeted advertising activities.

This policy should be read together with our actual services, website functionality, privacy settings, and applicable law. References to conditional or optional data processing activities do not mean that we necessarily conduct those activities if the relevant service or feature is not enabled.

2. Categories of Personal Information We Collect

Depending on how you interact with our website, we may collect the following categories of personal information.

2.1 Identity and Contact Information

This may include:

• Name;
• Email address;
• Telephone number;
• Billing address and shipping address; and
• Other contact information you voluntarily provide.

We primarily use this information to process orders, arrange deliveries, respond to inquiries, and provide customer support.

2.2 Order, Transaction, and Payment Information

This may include:

• Order numbers, purchased products, quantities, and order totals;
• Order creation, payment, shipping, return, and refund status;
• Billing and delivery information;
• Information necessary for transaction verification and fraud prevention; and
• Customer service records associated with an order.

Payment information is processed through the payment service provider and payment method you select. We may receive payment status, transaction identifiers, and other information necessary to complete an order. The payment credentials we receive or retain, depend on the payment method and the configuration of the relevant service.

2.3 Account and Customer Service Information

Where applicable features are available, we may collect account information, account settings, login-related records, and communications you provide through email or other customer service channels. This may include inquiries, complaints, return requests, refund requests, and related correspondence.

2.4 Device, Browsing, and Website Activity Information

When you visit our website, we and relevant service providers may automatically collect certain technical information, such as:

• IP address and approximate location inferred from technical information;
• Browser type, device type, and operating system;
• Visit date, time, and referral source;
• Products viewed, pages visited, and website interaction records;
• Information generated by cookies, pixels, and similar technologies; and
• Website performance, security, and diagnostic information.

We may use this information to operate and maintain our website, analyze website performance, prevent fraud, and, where permitted by applicable law, measure advertising effectiveness or conduct marketing activities.

2.5 Marketing Preferences

If you subscribe to marketing emails or choose to receive other promotional communications, we may retain your subscription status, unsubscribe status, and related preferences.

2.6 Information from Third Parties

Where permitted by law, we may receive information from Shopify, payment service providers, shipping providers, fraud prevention services, and analytics or advertising services that we actually use.

We do not collect information indiscriminately merely because it may be available from a third party.

3. How We Use Personal Information

We use personal information for the following purposes, to the extent reasonably necessary for our business and permitted by applicable law.

PurposeExamples of Relevant InformationProcessing and fulfilling ordersContact information, order information, payment status, and shipping informationDelivery and after-sales serviceDelivery information, order status, return and refund recordsCustomer supportContact details, inquiry content, and relevant transaction recordsWebsite operation and maintenanceDevice information, access logs, and website interaction informationSecurity and fraud preventionTransaction verification information, device information, and activity recordsBusiness administration and legal complianceTransaction records, accounting records, and information relating to disputes or legal mattersMarketing and advertising measurementMarketing preferences and relevant browsing or activity information.

We do not use personal information for purposes that are incompatible with the purposes for which it was collected unless otherwise permitted by applicable law.

Where applicable law requires consent for a particular processing activity, we will address consent and withdrawal requests as required by law.

4. Cookies, Pixels, and Similar Technologies

Our website may use cookies, pixels, scripts, and similar technologies to support shopping cart and checkout functionality, security, website preferences, traffic analysis, and advertising measurement.

These technologies may fall into the following categories:

• Essential technologies: Support shopping cart functionality, checkout, website security, and core services.
• Preference technologies: Remember your settings or preferences where those features are enabled.
• Analytics technologies: Help us understand website traffic and performance when relevant tools are enabled.
• Advertising technologies: Support advertising measurement, marketing attribution, or personalized advertising when relevant tools are enabled and permitted by applicable law.

The specific cookies, pixels, and similar technologies used depend on our Shopify settings, installed applications, and the third-party services we actually enable.

You may manage certain cookies through our website's cookie preference settings, or through your browser settings. Deleting or disabling certain cookies may affect your shopping cart, checkout, or other website functionality.

Where applicable law requires prior consent, we will handle the use of non-essential tracking technologies and related choices in accordance with those requirements.

Opting out of targeted advertising or certain data sharing activities does not necessarily mean that all advertisements will stop appearing.

5. How We Disclose or Share Personal Information

We do not disclose personal information to third parties without limitation. We may share information with the following categories of recipients when reasonably necessary to fulfill orders, operate our website, provide services, maintain security, or comply with law.

5.1 Shopify

We use Shopify to provide our online store, ecommerce infrastructure, and related functionality. Shopify may process relevant information in accordance with its terms of service, privacy policy, data processing arrangements, and the features actually enabled.

For information about Shopify's own privacy practices and available privacy controls, please review Shopify's applicable privacy documentation.

5.2 Payment Service Providers

We may share information necessary to process payments, verify transactions, issue refunds, and prevent fraud with the payment service provider you select.

5.3 Shipping and Fulfillment Providers

To fulfill and deliver orders, we may provide relevant shipping carriers or fulfillment providers with the recipient's name, delivery address, telephone number, order information, and other information necessary for delivery.

5.4 Website Analytics and Advertising Service Providers

If we actually enable relevant services, we may share certain device, browsing, event, or advertising interaction information with analytics, advertising measurement, or marketing service providers.

These activities may be subject to applicable privacy laws governing the sale, sharing, or targeted advertising use of personal information. We will provide applicable disclosures and opt-out mechanisms based on the services actually used and the requirements of applicable law.

5.5 Legal, Security, and Business Transactions

We may disclose necessary personal information in the following circumstances:

• To comply with applicable law, a court order, or other lawful process;
• To investigate or prevent fraud, security incidents, or unlawful activity;
• To protect the rights and legitimate interests of consumers, our business, service providers, or others;
• To handle legal disputes, audits, or compliance matters; or
• In connection with a merger, reorganization, asset transfer, or other business transaction, as permitted by applicable law.

We do not provide personal information to third parties for purposes inconsistent with this policy unless otherwise permitted by applicable law.

6. Sale, Sharing, and Targeted Advertising

Xalavelle does not make the direct sale of personal information in exchange for money a regular part of its business model.

However, certain U.S. state privacy laws define “sale,” “sharing,” or “targeted advertising” more broadly than the exchange of personal information for money. For example, in certain circumstances, providing personal information to third parties for cross-context behavioral advertising may constitute a sale or sharing under applicable law.

Whether our activities fall within these definitions depends on our actual website configuration, enabled third-party tools, and related data processing arrangements. We do not assume that an activity falls outside a legal definition of sale or sharing solely because no money is exchanged.

Where required by applicable law, you may use the data-sharing opt-out page or another valid mechanism provided on our website to opt out of the sale or sharing of personal information or its use for targeted advertising.

Where legally required, we will process valid Global Privacy Control (GPC) signals or other recognized opt-out preference signals in accordance with applicable requirements.

You may also contact us at hello@xalavelle.com with questions about your privacy choices or to submit a request.

If your request concerns information independently processed by Shopify, you may also need to exercise the relevant rights directly through Shopify's available privacy channels.

7. Your Privacy Rights

Depending on your place of residence, applicable law, and the relevant legal requirements, you may have some or all of the following rights:

• Right to know and access: Request information about the personal information we collect, use, disclose, or process and, where permitted by law, request access to relevant information.
• Right to deletion: Request deletion of personal information we maintain, subject to applicable legal exceptions.
• Right to correction: Request correction of inaccurate personal information.
• Right to data portability: Obtain a portable copy of relevant personal information where required by applicable law.
• Right to opt out: Opt out of the sale or sharing of personal information or its use for targeted advertising where applicable law provides this right.
• Rights concerning sensitive personal information: Limit certain uses or disclosures of sensitive personal information where required by applicable law.
• Right to withdraw consent: Withdraw consent for processing activities based on consent, to the extent permitted by applicable law.
• Right to appeal: Appeal a decision denying a privacy request where applicable law provides an appeal process.
• Right to non-discrimination: We will not unlawfully discriminate against you for exercising privacy rights protected by applicable law.

These rights do not apply in every state or every circumstance and may be subject to identity verification, statutory exceptions, and other legal conditions.

How to Submit a Privacy Request

Please email us at:

hello@xalavelle.com

We recommend using the subject line “Privacy Request.”

To protect personal information, we may reasonably need to verify your identity and the authenticity of your request. We will not ask you to send unnecessary sensitive information through an insecure channel.

Where applicable law permits an authorized agent to submit a request on your behalf, we may require proof of authorization and, where legally permitted, may ask you to verify your identity or confirm the authorization.

We will process requests according to the timelines and procedures required by applicable law. If we cannot fulfill a request, we will explain the reason where required and inform you of any applicable appeal or other available remedy.

8. Privacy Rights of California Residents

If you are a California resident and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies to the relevant data processing activities, you may have additional privacy rights.

These rights may include:

• The right to know the categories of personal information we collect, the sources from which it is collected, the purposes for collection or use, and relevant disclosure practices;
• The right to request access to specific pieces of personal information;
• The right to request deletion of personal information, subject to applicable legal exceptions;
• The right to request correction of inaccurate personal information;
• The right to opt out of the sale or sharing of personal information, including certain cross-context behavioral advertising activities, where applicable;
• The right to limit certain uses or disclosures of sensitive personal information where the law provides that right; and
• The right not to be unlawfully discriminated against for exercising applicable privacy rights.

California Privacy Disclosures and Requests

If the relevant law applies to our business, we will provide the required privacy disclosures based on our actual data processing activities. These may include categories of personal information, purposes of use, relevant recipients, retention periods or criteria used to determine retention periods, and applicable sale or sharing practices.

You may submit a request to hello@xalavelle.com. We will verify the request, determine the applicable statutory deadline, and provide the result and any available further remedy where required by law.

The scope and specific obligations of California privacy law depend on applicable statutory requirements. This section should not be interpreted as a representation that every California privacy law obligation necessarily applies to Xalavelle.

9. Privacy Rights of Residents of Other U.S. States

Privacy laws in certain other U.S. states may provide residents with rights to access, correct, delete, or obtain a copy of personal information. They may also permit residents to opt out of the sale of personal information, targeted advertising, or certain other data processing activities.

The specific rights, applicability thresholds, response deadlines, and exceptions vary by state and depend on whether the relevant law applies to our business.

If you believe you have applicable rights, you may contact us at hello@xalavelle.com. We will handle your request in accordance with applicable law and provide an appeal or other applicable procedure where legally required.

10. Retention of Personal Information

We do not promise to retain all personal information for one fixed period. Actual retention periods depend on the type of information, the purpose of processing, legal requirements, and business needs.

We generally determine retention periods based on the following criteria:

• Order and transaction information: The period reasonably necessary to complete transactions, provide after-sales service, handle refunds or disputes, and meet applicable accounting, tax, and recordkeeping requirements.
• Customer service records: The period reasonably necessary to respond to inquiries, resolve issues, handle returns and exchanges, and document relevant outcomes.
• Account information: The period during which the relevant account or feature is used, plus any additional period necessary to handle account closure-related matters.
• Security and technical records: The period reasonably necessary to maintain website security, investigate suspicious activity, troubleshoot technical issues, and prevent fraud.
• Marketing preferences and unsubscribe records: The period reasonably necessary to manage subscription status, honor opt-out requests, and document relevant preferences.
• Legal and compliance records: The period reasonably necessary to meet applicable legal obligations, resolve disputes, or protect legitimate interests.

When personal information is no longer necessary for the relevant purposes, we will delete, destroy, or otherwise appropriately handle it in accordance with applicable law and reasonable data management procedures, unless continued retention is permitted or required by law.

11. Personal Information Security

We implement reasonable technical, administrative, and organizational measures designed to reduce the risk of unauthorized access to, use of, disclosure of, alteration of, or loss of personal information.

However, internet transmission and electronic storage cannot be guaranteed to be completely secure. We cannot guarantee that any system, platform, or method of data transmission is entirely free from security risks.

If a personal information security incident occurs and applicable law requires notification, we will provide notices or take other actions as required by law.

12. Children's Privacy

Our website is not specifically directed to children under 13. Except where expressly permitted by applicable law and subject to the relevant requirements, we do not knowingly collect personal information from children under 13.

If you believe that a child under 13 has provided personal information to us without appropriate authorization, please contact us at hello@xalavelle.com. After reviewing the circumstances, we will take appropriate action in accordance with applicable law.

13. Third-Party Websites and Services

Our website may contain links to third-party websites, payment services, social media platforms, or other external services.

When you visit these third-party websites or use their services, your information may be processed under their own privacy policies and terms of service. We do not control the independent privacy practices of third parties and encourage you to review their policies before submitting personal information.

14. Marketing Communications and Unsubscribe Options

If you subscribe to our marketing emails or choose to receive other promotional communications, we may send you product announcements, promotions, and related marketing information to the extent permitted by applicable law.

You may unsubscribe by using the “Unsubscribe” link included in marketing emails or by sending a request to hello@xalavelle.com.

Even if you opt out of marketing communications, we may still send you necessary transactional or service-related messages, such as order confirmations, shipping notifications, refund updates, security notices, or other communications necessary to provide our services.

15. International Data Processing

Although Xalavelle primarily serves the U.S. market, some of our service providers may process or store information outside the United States.

If personal information is transferred to another country or region, we will handle the transfer in accordance with applicable legal requirements and implement appropriate data protection measures where required.

If data protection laws in a particular jurisdiction apply to the relevant processing activity, we will provide the applicable notices, rights, and safeguards required by those laws.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business operations, website functionality, service providers, data processing activities, or applicable law.

The updated version will be published on this page with the revised “Last Updated” date.

If applicable law requires additional notice or consent for material changes, we will follow the relevant requirements.

We encourage you to review this page periodically to stay informed about how we handle personal information.

17. Contact Us

If you have questions about this Privacy Policy, our handling of personal information, or your privacy rights, please contact us using the details below.

Store Name: Xalavelle

Website: https://www.xalavelle.com/

Email: hello@xalavelle.com

Phone: +1 214-528-7328

Business Address:

4307 McKinney Ave Dallas, TX 75205United States

Customer Service Hours:

Monday–Saturday: 9:00 AM–6:00 PM Central Time (CT)

Sunday: Closed

We aim to respond to privacy-related inquiries within 24–48 business hours.