Privacy Policy

Needs to cover: account details (name, email, phone) collected at signup; shipping addresses; order and payment history (payment card data itself is handled by Stripe, not stored by X-Spelled directly); and basic technical data collected automatically (IP address, browser/device info, pages visited).

Needs to cover: fulfilling and shipping orders; account authentication; customer support; fraud prevention and stock management; and any marketing communications, with an explicit statement on whether those are opt-in or opt-out.

Needs to cover: what cookies are set (session/auth cookies at minimum), and disclosure of any analytics or advertising tools if they're ever added. No analytics are in use as of this draft — if that changes, this section and a separate cookie notice need to be written before launch.

Needs to name every processor customer data actually passes through — at minimum: Stripe (payments), the hosting provider, and the database provider — with a short note on what each one sees.

Needs to cover: how long account and order records are kept, and what happens to data after account deletion, if account deletion is offered.

Needs to cover: how a customer can request access to, correction of, or deletion of their data, and which regional frameworks apply (e.g. GDPR, CCPA) based on where X-Spelled actually ships and does business.

Needs a statement on the minimum age to use the site and place orders.

Needs to cover: how customers are notified of material changes, and where the current version is always available.

Needs a real contact method (support email or mailing address) for privacy-related requests. [insert contact details]