📦 FREE SHIPPING ON U.S. ORDERS OVER $150

Privacy policy

Protecting your private information is our priority. This Privacy Policy applies to xyrena.com, our Members area and Fan Demand pages, our wholesale and retail-partner portals, and the emails we send. It explains what we collect, why, who else handles it, how long we keep it, and the choices you have. "Xyrena", "we" and "us" mean Xyrena, 9901 Brodie Lane Ste 160-836, Austin, TX 78748, USA. We are the data controller for the information described here.

What we collect

Account and orders. When you shop or create an account we collect your name, email address, phone number, shipping and billing addresses, order history, and your marketing choices. Payments are handled by our payment processors; Xyrena never sees your full card number.

Xyrena Video Club (Members area). Every account is a Video Club membership. We assign you a random 12-digit member number, store it on your account, and show it on your membership card along with your name, join date and recent orders.

Fan Demand. When you vote for a title or suggest one, we record your vote with your name, email address, city and region (from your account), any comment you add, whether you chose to stay anonymous or to share your full name with the rights holder, your marketing choices, the consent wording you agreed to, a hashed form of your IP address, and the date. Share clicks are counted per campaign.

Shipping Protection claims. When you file a claim we collect the details of the claim, any photographs you upload, your name, email address and phone number, your IP address, and the typed name you provide as your electronic signature.

Wholesale and retail partners. If you apply for a wholesale account we collect your business and contact details, tax identifiers, and the results of business verification checks. Purchase orders, invoices, payments, ship-to locations and the agreement you accept when ordering are recorded with the name of the person who placed them.

Creator programs. If you take part in a perfumer or fragrance-submission program we collect the details you give us for that program.

Customer support. Messages you send us by email or through the contact form, with your name and email address.

Reviews. Reviews you leave on product pages are collected by our reviews provider and shown publicly with the name you choose.

Automatically collected. Your IP address, browser type, device information, pages visited, referring site and access times, used to run and secure the site and to understand how it is used. When you visit from outside the United States we check your country through Shopify's geolocation service to show the right shipping information; that result is kept only in your browser for the session.

How we use it

To take and deliver your orders, run your account and membership, answer your questions, handle claims and returns, send order and shipping updates, and keep the site secure. To run Fan Demand campaigns and show rights holders the interest behind them. To run our wholesale and partner programs. To send marketing when you have agreed to it. To prevent fraud and meet legal, tax and accounting obligations. Where European or UK law applies, we rely on performance of a contract (orders, accounts, claims), your consent (marketing, Fan Demand display), and our legitimate interests (security, fraud prevention, improving the site).

Fan Demand: what is public and what is shared

On a campaign page we show your first name, last initial and city, or "A supporter" if you chose to stay anonymous, plus any comment you added. We may share the number of supporters and that same anonymized list with the rights holder of the title to show interest. Your full name is shared with a rights holder only if you ticked the box to allow it. Your email address and contact details are never shown or shared. Votes are counted for good: if you remove your name from a campaign or delete your account, your vote stays in the campaign's total with nothing linking it to you. You must be 16 or older to vote.

Who else handles your data

We do not sell or rent your personal data, and we do not share it for anyone else's marketing. We share it with service providers who work for us under contract, with the advertising platforms described below, and only for the purposes above:

  • Shopify, which runs the store, checkout, customer accounts, payments, and email and SMS marketing (Shopify privacy policy).
  • Payment processors: Shopify Payments, Shop Pay, PayPal, Apple Pay and Google Pay, which receive what is needed to process your payment.
  • Postmark, which delivers our transactional email; Supabase and Vercel, which host our applications and database in the United States.
  • Judge.me for product reviews and Locksmith for member-only page access.
  • Shipping carriers such as UPS and USPS, which receive your name, address and phone number to deliver and track your order.
  • Fraud-prevention and payment-risk partners (including networks such as Kount), which analyse transaction and device signals to detect fraud. This can occasionally lead to extra verification steps or a declined order.
  • For wholesale accounts only: Wise and Melio for bank-transfer payments, and Hunter and Yelp for business verification when you apply.
  • Advertising platforms: Meta (Facebook and Instagram), TikTok and Google, through their pixels on our site. See "Cookies, pixels and advertising" below.
  • For Fan Demand only: rights holders, as described above.

We may also disclose personal data when the law requires it, to protect our rights or property, or to protect the safety of our customers or the public. If Xyrena or part of its business is sold or merged, customer data may transfer with it; we will tell you before it becomes subject to a different privacy policy.

International shipping and forwarders

We ship within the United States. If you use a package forwarder such as Shipito, you set up and manage that account yourself under the forwarder's own privacy policy; we do not share your data with them beyond the shipping label on your order. Xyrena may receive a commission if you open a forwarder account through a link on our site.

How long we keep it

  • Order records: 7 years after the order, as tax and accounting law requires. When you delete your account, your personal details are removed from them.
  • Shipping Protection claims: 7 years, to prevent repeat claims and fraud. On deletion we remove your phone number and IP address; the claim, your name, the delivery address and your signature stay as evidence of the claim.
  • Fan Demand votes: for the life of the campaign and the products that come from it, with your name, comment and contact details removed when you withdraw your name or delete your account.
  • Support messages: deleted when you delete your account, and otherwise cleared on the support desk's retention schedule.
  • Wholesale records: kept for the life of the business relationship and 7 years after, as commercial and tax law requires; the person's contact details are removed on request once nothing is outstanding.
  • Security logs and the log of privacy requests themselves: kept for accountability, with the minimum detail needed.

Your choices and your rights

Self-serve, any time. Members can download a complete copy of their data, or delete their account and data, from their membership card at xyrena.com/apps/xyrena/me. Anyone without an account can do the same from xyrena.com/apps/xyrena/privacy using a link we email to the address on file. Deletion has a 7-day grace period during which you can cancel. Shopify erases your store account on its own schedule: about 10 days after we ask, or 180 days after your last order if you bought in the past 6 months, because card networks require that window for disputes.

Marketing. Unsubscribe from any promotional email with the link at the bottom, reply STOP to any text, or change your preferences in your account. Order and shipping notices still go out while an order is open.

Advertising. To opt out of the pixel sharing described under "Cookies, pixels and advertising", use the controls listed there.

Fan Demand. Remove your name from any campaign you signed from that campaign's page or your Members area. The vote itself stays in the total.

Your rights. Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, to withdraw consent, and to not be discriminated against for exercising these rights. We honour these requests for everyone, wherever you live. We verify requests by your signed-in account or by a link sent to the email address on file, and we answer within 30 days. If we cannot act on part of a request (for example, records the law requires us to keep), we will tell you why. If you are in the European Economic Area or the United Kingdom you may also lodge a complaint with your local data protection authority. To appeal a decision, or for anything the self-serve tools do not cover, write to us at xyrena.com/pages/contact-us or the postal address below.

Cookies, pixels and advertising

We use cookies and similar technologies to keep you signed in, remember your cart and preferences, and understand how the site is used. You can decline cookies in your browser, though some features will stop working.

We also use advertising pixels from Meta (Facebook and Instagram), TikTok and Google. They tell those platforms which pages you viewed, what you added to your cart and what you bought, and may include a hashed (scrambled) version of your email address or phone number so the platform can match the visit to an account you hold there. The platforms use this to measure our ads, to show you Xyrena ads on their services, and to find people with similar interests. Each platform also uses the data under its own privacy policy: Meta, TikTok, Google.

Under some privacy laws this counts as "sharing" or "selling" personal data for targeted advertising, even though no money changes hands. You can limit it by declining non-essential cookies where our site offers that choice, by blocking third-party cookies in your browser, by sending a Global Privacy Control signal, or through the platforms' own controls: Meta ad preferences, TikTok ads and your data, Google ad settings. We do not respond to browser Do Not Track signals, which have no agreed meaning.

Security

All traffic to xyrena.com is encrypted (TLS). Access to your data inside Xyrena is limited to the people who need it, and payment details are handled only by our payment processors. No system is perfectly secure, and we cannot guarantee that information sent over the internet will never be intercepted, but we work to protect it.

Children

Xyrena does not knowingly collect personal data from children under 13, and you must be 16 or older to take part in Fan Demand. If you believe a child has given us personal data, contact us and we will delete it.

Where your data is processed

Xyrena is based in the United States and your data is stored and processed there. If you are outside the US, you understand that your data will be transferred to and processed in the US, where privacy laws may differ from those where you live.

Changes to this policy

We update this policy when our practices change and post the new version here with the date below. Significant changes are announced on the site or by email.

Contact

Xyrena
9901 Brodie Lane Ste 160-836
Austin, TX 78748
United States

https://xyrena.com/pages/contact-us

Effective as of June 1, 2015
Last updated October 11, 2026