📦 FREE SHIPPING ON U.S. ORDERS OVER $150
XYRENA

Privacy policy

Protecting your private information is our priority. This Privacy Policy applies to xyrena.com, our Members area and Fan Demand pages, our wholesale and retail-partner portals, and the emails we send. It explains what we collect, why, who else handles it, how long we keep it, and the choices you have. This policy is issued by New Faction Inc. d/b/a Xyrena ("Xyrena"), 9901 Brodie Lane Ste 160-836, Austin, TX 78748, USA. "We" and "us" refer to Xyrena. We are the data controller for our processing described here; some providers, including Shopify for the purposes explained below, also act as independent data controllers.

What we collect

Account and orders. When you shop or create an account we collect your name, email address, phone number, shipping and billing addresses, order history, and your marketing choices. Payments are handled by our payment processors; Xyrena never sees your full card number.

Xyrena Video Club (Members area). Every account is a Video Club membership. We assign you a random 12-digit member number, store it on your account, and show it on your membership card along with your name, join date and recent orders.

Fan Demand. When you vote for a title or suggest one, we record your vote with your name, email address, city and region (from your account), any comment you add, whether you chose to stay anonymous or to share your full name with the rights holder, your marketing choices, the consent wording you agreed to, a hashed form of your IP address, and the date. Share clicks are counted per campaign.

Shipping Protection claims. When you file a claim we collect the details of the claim, any photographs you upload, your name, email address and phone number, your IP address, and the typed name you provide as your electronic signature.

Adverse event reports. If you report a reaction to one of our cosmetic products, we collect your name, email address, phone number and address, the product and where you bought it, what happened and when, how serious it was, and any documentation you upload, which may include medical information. Report text and medical attachments are excluded from AI support drafting, and report text is not included in quoted replies. We do not send adverse-event report content or medical attachments to advertising or analytics tools. We keep these reports for product-safety recordkeeping, including to meet applicable requirements of federal cosmetics law (the Modernization of Cosmetics Regulation Act), and report serious adverse events to the U.S. Food and Drug Administration where required by law.

Certificate checks. When you verify a Certificate of Authenticity serial number, we record the serial, the date, your IP address and country, to spot counterfeits and repeated checks.

Wholesale and retail partners. If you apply for a wholesale account we collect your business and contact details, tax identifiers, and the results of business verification checks. Purchase orders, invoices, payments, ship-to locations and the agreement you accept when ordering are recorded with the name of the person who placed them. When you sign an agreement with us electronically we record your typed name, the date and time, and your IP address with the signed copy.

Creator programs. If you take part in a perfumer or fragrance-submission program, or apply to Cult Xyrena, we collect the details you give us for that program: your contact details, your city and country, the links and content you submit, and your IP address at the time you applied.

Customer support. Messages you send us by email, through the contact form or through the on-site messenger, with your name and email address. Our forms and the messenger use Cloudflare Turnstile for bot protection, which processes your IP address and browser signals. See the Cloudflare Turnstile Privacy Addendum. We may use an AI assistant to draft replies to support messages; the message is sent to the AI provider under contract, and a person reads and sends every reply. We do not use support messages to train AI models. The AI service does not use API inputs or outputs to train its models by default.

Reviews. Reviews you leave on product pages are collected by Judge.me, our provider of review and related email functionality, and shown publicly with the name you choose. Judge.me processes customer personal data on our behalf; see its privacy policy.

Automatically collected. Your IP address, browser type, device information, pages visited, referring site and access times, used to run and secure the site and to understand how it is used. When you visit from outside the United States we check your country from your IP address, through our hosting provider's lookup, to show the right shipping information; that result is kept only in your browser for the session.

Location. The Store Locator starts from an approximate, city-level location derived from your IP address in the same way. It uses your precise location only if you tap "Use my location" and allow it in your browser. This Store Locator feature is separate from the shipping and billing addresses and IP addresses we collect and retain for the purposes described elsewhere in this policy. When a form offers address suggestions, the text you type into the address field is sent to an address-suggestion service to find matches. That provider also processes request data, including the submitted text, IP address and technical headers, and may retain request logs for security, usage measurement and troubleshooting.

How we use it

To take and deliver your orders, run your account and membership, answer your questions, handle claims and returns, send order and shipping updates, and keep the site secure. To run Fan Demand campaigns and show rights holders the interest behind them. To run our wholesale and partner programs. To send marketing when you have agreed to it. To receive adverse event reports and, where the law requires, pass them to the FDA. To prevent fraud and meet legal, tax and accounting obligations. Where European or UK law applies, we rely on performance of a contract (orders, accounts, claims), your consent (marketing, Fan Demand display), our legal obligations (where the obligation arises under applicable European or UK law), and our legitimate interests (security, fraud prevention, improving the site).

Fan Demand: what is public and what is shared

On a campaign page we show your first name, last initial and city, or "A supporter" if you chose to stay anonymous, plus any comment you added. We may share the number of supporters and that same public list with the rights holder of the title to show interest. Your full name is shared with a rights holder only if you ticked the box to allow it. We do not display your email address or other contact details on campaign pages or share them with rights holders, unless you include them in your comment. Your public name, city and comment may identify you, even if you do not share your full name. Please do not include contact details or other sensitive information in a public comment. Votes are counted for good: if you remove your name from a campaign or delete your account, your vote stays in the campaign's total with nothing linking it to you. You must be 16 or older to vote.

Who else handles your data

We do not sell or rent your personal data for money. The advertising disclosures described under "Cookies, pixels and advertising" may nevertheless count as a sale or sharing of personal data under applicable privacy laws. We share it with service providers who work for us under contract, with the advertising platforms described below, and only for the purposes described in this policy:

  • Shopify, which hosts our store and runs checkout, customer accounts, payments, order, shipping and account emails, and email and SMS marketing. We use Shopify Network Intelligence. Shopify collects and processes personal data about your visits and purchases, and combines it with data from your interactions with other merchants and Shopify, to provide Enhanced Services such as analytics, personalization and advertising. Information you submit to our store is shared with Shopify and other third parties, which may be located in other countries, to provide these services. Shopify acts as an independent data controller for these Enhanced Services. See the Shopify Consumer Privacy Policy. Depending on where you live, you can withdraw consent, object or opt out of certain Shopify processing through Shopify's privacy portal. Our store's advertising choices are described below.
  • Payment processors: Shopify Payments, Shop Pay, PayPal, Apple Pay, Google Pay and Afterpay, which receive what is needed to process your payment. Afterpay also shows installment estimates on product pages through its own script.
  • Service providers that, under contract with us: deliver the email and text messages our own tools send (support desk replies, claim updates, wholesale notices, Fan Demand campaign mail, privacy-request links, creator-program notices and gift invitations, and any order or account texts we add later); host our applications and database; store the files you upload (claim photos, adverse event documentation, program submissions) and encrypted backups of our database; protect our forms and messenger from bots; run the AI assistant that drafts support replies; and suggest addresses as you type.
  • Apps that add features to the site, each under its own privacy policy and with its own cookies or browser storage: product reviews, member-only page access, wishlist and price-drop and back-in-stock alerts (if you turn on browser notifications, the alerts app registers your browser and sees your cart and the products you view), countdown timers and affiliate links, product options, and automatic discounts.
  • The U.S. Food and Drug Administration, for serious adverse event reports, as the law requires.
  • Shipping carriers, which receive your name, address and phone number to deliver and track your order.
  • Fulfillment partners, which print, pack and ship some products on our behalf and receive your name, address, phone number and the items in your order, and nothing else.
  • Fraud-prevention and payment-risk partners, which analyze transaction and device signals to detect fraud. This can occasionally lead to extra verification steps or a declined order.
  • For wholesale accounts and business partners only: bank-transfer payment providers, business-verification and lookup services when you apply, and a profile-picture service that shows a picture next to your contact card if one exists for your email address.
  • Advertising platforms: Meta (Facebook and Instagram), Google and Pinterest, through their integrations with our site. See "Cookies, pixels and advertising" below.
  • For Fan Demand only: rights holders, as described above.

We may also disclose personal data when the law requires it, to protect our rights or property, or to protect the safety of our customers or the public. If Xyrena or part of its business is sold or merged, customer data may transfer with it; we will tell you before it becomes subject to a different privacy policy.

International shipping and forwarders

We ship within the United States and directly to customers in the European Union and the United Kingdom. If you use a package forwarder, you set up and manage that account yourself under the forwarder's own privacy policy; we do not share your data with them beyond the shipping label on your order. Xyrena may receive a commission if you open a forwarder account through a link on our site.

Affiliate and referral links

Some pages, including After Dark, contain affiliate or referral links to other companies, such as the forwarder link above. If you click one, that company learns you came from Xyrena and may set its own cookies under its own privacy policy. We may earn a commission on what you buy or sign up for there. Clicking an affiliate or referral link may disclose information such as your IP address, browser information and the referring page to that company.

How long we keep it

The periods below do not mean that records are automatically deleted when those periods end. Some records remain beyond those periods. Retention remains subject to applicable legal limits and the deletion rights and exceptions described in this policy.

  • Order records: at least 7 years after the order, for tax and accounting purposes. When you delete your account, your personal details are removed from them, except where retention is required or permitted by applicable law.
  • Shipping Protection claims: at least 7 years, to prevent repeat claims and fraud. On deletion we remove your phone number and IP address; the claim, your name, the delivery address and your signature stay as evidence of the claim.
  • Fan Demand votes: for the life of the campaign and the products that come from it, with your name, comment and contact details removed when you withdraw your name or delete your account.
  • Support messages in our custom support tools: deleted when you delete your account. Copies in email delivery systems and provider logs may remain for different retention periods, subject to applicable law. Adverse event reports are the exception: we keep them for at least 6 years, including to meet applicable federal cosmetics recordkeeping requirements, so they stay, with your contact details, when you delete your account, subject to applicable law.
  • Certificate checks: kept with the certificate's record.
  • Creator/program applications and submissions that do not lead to an ongoing relationship: kept until you request deletion, subject to applicable legal requirements.
  • Wholesale records: kept for the life of the business relationship and at least 7 years after, for commercial and tax recordkeeping purposes; the person's contact details are removed on request once nothing is outstanding.
  • Security logs and the log of privacy requests themselves (date, type, outcome, and the IP address and browser used to make the request): kept for accountability, with the minimum detail needed.

Your choices and your rights

Self-serve, any time. Members can download a copy of their data, or delete their account and data, from their membership card at xyrena.com/apps/xyrena/me. Anyone without an account can do the same from xyrena.com/apps/xyrena/privacy using a link we email to the address on file. Deletion has a 7-day grace period during which you can cancel. Deletion is subject to the retention exceptions described in this policy and applicable law. For data not included in a self-serve export, use the contact details below. Shopify processes requests to erase personal data from our store 10 days after submission, regardless of when your most recent order was placed. For recipients of scheduled gift cards, processing is delayed until the gift card has been delivered. Erasure redacts personal information; the customer profile and order history can remain. This does not erase information Shopify holds through your separate relationship with Shop or Shop Pay; those requests can be made through the Shop app or Shopify's privacy controls.

Marketing. Unsubscribe from any promotional email with the link at the bottom, reply STOP to any text, or change your preferences in your account. Order and shipping notices still go out while an order is open.

Advertising. To opt out of the advertising-related sharing described under "Cookies, pixels and advertising", use the controls listed there.

Fan Demand. Remove your name from any campaign you signed from that campaign's page or your Members area. The vote itself stays in the total.

Your rights. Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, to withdraw consent, to opt out of sales or sharing of personal data and targeted advertising, and to not be discriminated against for exercising these rights. Our self-serve export and deletion tools are available wherever you live. Other privacy requests are handled in accordance with applicable law. Where verification is needed, we verify requests by your signed-in account or by a link sent to the email address on file. We respond within the time limits required by applicable law, including any permitted extensions. Where an extension is permitted and needed, we will notify you as required by law. Withdrawing consent does not affect the lawfulness of processing before withdrawal. If we cannot act on part of a request (for example, records the law requires us to keep), we will tell you why. If you are in the European Economic Area or the United Kingdom you may also lodge a complaint with your local data protection authority. To appeal a decision, or for anything the self-serve tools do not cover, write to us at xyrena.com/pages/contact-us or the postal address below.

Cookies, pixels and advertising

We use cookies and similar technologies to keep you signed in, remember your cart and preferences, and understand how the site is used. We also keep a few small flags in your browser's own storage: that you passed the age check, that you have already messaged the store clerk today, the country we detected for shipping information, and your wishlist. These stay in your browser. The apps listed under "Who else handles your data" set their own. You can decline cookies in your browser, though some features will stop working.

We also use advertising integrations from Meta (Facebook and Instagram), Google and Pinterest, including browser pixels and server-side event sharing. They tell those platforms which pages you viewed, what you added to your cart and what you bought, and may include a hashed version of your email address or phone number so the platform can match the visit to an account you hold there. Hashing does not make this information anonymous. The platforms use this to measure our ads, to show you Xyrena ads on their services, and to find people with similar interests. Each platform also uses the data under its own privacy policy: Meta, Google, Pinterest.

Under some privacy laws this counts as "sharing" or "selling" personal data for targeted advertising, even though no money changes hands. Shopify Network Intelligence, described above, also uses data across merchants for advertising and other Enhanced Services. To request an opt-out of sale, sharing or targeted advertising, visit Your Privacy Choices. That page explains browser, device and account choices and how Global Privacy Control requests are treated. You can also decline non-essential cookies where our site offers that choice, block third-party cookies in your browser, or use the platforms' own controls: Meta ad preferences, Google ad settings. Browser cookie settings and platform preferences may not stop all data disclosures described here. We do not respond to browser Do Not Track signals, which have no agreed meaning. Do Not Track is different from Global Privacy Control.

Security

All traffic to xyrena.com is encrypted (TLS). Access to your data inside Xyrena is limited to the people who need it, and payment details are handled only by our payment processors. No system is perfectly secure, and we cannot guarantee that information sent over the internet will never be intercepted, but we work to protect it.

Children

Xyrena does not knowingly collect personal data from children under 13, and you must be 16 or older to take part in Fan Demand. If you believe a child has given us personal data, contact us and we will delete it.

Where your data is processed

Xyrena is based in the United States, where we host our own application data. The service providers described in this policy may process or store data in the United States and other countries. If you are outside the US, your data will be transferred to and processed in the US and may also be processed in other countries where those providers operate. Privacy laws in those countries may differ from those where you live. Our standard agreements with certain service providers include the European Commission's Standard Contractual Clauses and the UK Addendum for covered international transfers. You can contact us using the details below for information about the safeguards applicable to your data. This notice does not itself constitute consent to a transfer or replace any safeguards required by applicable law.

Changes to this policy

We update this policy when our practices change and post the new version here with the date below. Significant changes are announced on the site or by email.

Contact

Xyrena
9901 Brodie Lane Ste 160-836
Austin, TX 78748
United States
https://xyrena.com/pages/contact-us

Effective as of June 1, 2015
Last updated October 28, 2026