Privacy Policy

We collect information you give us, information collected automatically when you use the Platform, and information from partners who help us run it.

Information you give us

Payment information. Card details are entered directly into Stripe's secure form. They go to Stripe and never reach or get stored on Hexxo's servers. We keep only what Stripe sends back, such as card brand, last four digits, and payment status.

Information collected automatically

• Usage and device data: pages viewed, links clicked, approximate location (from IP address), browser and device type, and referring site, collected through Google Analytics.
• Browser storage: your cart and some session details are saved in your browser (see Section 05).

Information from third parties

• Stripe: payment and payout status, and for sellers, whether payout onboarding is complete.
• Shipping carriers (via ShipStation): tracking and delivery updates for your orders.

We use your information to run the marketplace and keep it safe. Specifically, to:

• Create and manage your account and sign you in.
• Process purchases, offers, refunds, and seller payouts.
• Buy shipping labels, ship items, and track deliveries.
• Authenticate items and record the results.
• Show you relevant listings and match items to our product catalog (see Section 04).
• Send transactional emails and on-site notifications, such as order updates, shipping status, and authentication results.
• Send newsletters and promotions, only if you opt in.
• Credit partner shops when you use their promo or referral code.
• Respond to your messages and resolve disputes.
• Detect and prevent fraud, counterfeits, and violations of our Terms.
• Understand how the Platform is used so we can improve it.
• Meet legal, tax, and accounting obligations.

We do not use your information for automated decisions that have legal or similarly significant effects on you. Authentication decisions are made by our staff.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only in the cases below.

Service providers

These providers process data on our behalf, under contracts limiting how they can use it:

Other users. When you buy or sell, the other party sees what they need to complete the transaction, such as your username and listing details. Your public seller profile shows your username, profile photo, any website links you add, ratings, sales count, and a Verified Seller badge if your email and phone are verified. Your active listings are public too. Your email, phone number, and address are never shown publicly.

Partner shops. If you use a shop's promo or referral code, that shop may receive aggregated reports (for example, how many signups or sales came from its code) to calculate commissions. We do not give partner shops your contact details.

Legal and safety. We may disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of Hexxo, our users, or the public, including to investigate fraud or counterfeit goods.

Business transfers. If Hexxo is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that deal, subject to this policy.

With your consent. In any other case, we share only with your permission.

Authentication photos. When an item requires authentication, the seller uploads photos of it and our staff review them and record whether it passed or failed. These photos and results are linked to the order and kept as a record of the inspection. Buyers and sellers on that order can see the outcome.

Photos are meant to show the item, not people. Please don't include faces, addresses, or other personal details in listing photos.

AI-powered image matching. We use Google Vertex AI to turn listing photos into numeric "embeddings" so we can match items to our product catalog and show similar listings. This analyzes the item in the photo. We do not use it to identify people, and we do not use face recognition or any biometric processing.

We use a small number of cookies and browser storage. We don't use advertising cookies.

We also load fonts, icons, and scripts from content delivery networks (Font Awesome, jsDelivr, jQuery). Like any website, these providers receive your IP address when your browser fetches their files.

Your choices

• Block or delete cookies in your browser settings. Essential features like sign-in and checkout may stop working.
• Opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on.
• Global Privacy Control (GPC): we treat a GPC signal from your browser as a valid request to opt out of the sale or sharing of your personal information.
• We don't respond to "Do Not Track" signals, since there is no common standard for them; GPC is the signal we honor.

Seller payouts run through Stripe Connect. When you set up payouts, Stripe collects your identity and banking details directly (for example, legal name, date of birth, government ID or last four of your SSN, and bank account) to verify you and meet legal requirements. Hexxo does not receive or store your full bank account number, SSN, or ID documents.

We receive from Stripe your payout account ID, whether onboarding is complete, and the status of transfers. We keep records of your sales, fees, payouts, and any amounts owed (for example, after a refund or failed authentication).

Stripe may issue tax forms (such as Form 1099-K) when required. Stripe's handling of this data is covered by the Stripe Privacy Policy.

We keep information only as long as we need it for the purposes above or as the law requires.

After these periods, we delete the information or de-identify it so it can no longer be linked to you.

We use reasonable safeguards to protect your information. These include encrypted connections (HTTPS), password handling by Firebase Authentication, payment processing by PCI-compliant Stripe, and access controls that limit sensitive data to staff who need it.

Your information is stored and processed in the United States.

No system is perfectly secure. If you think your account has been compromised, contact us right away at privacy@hexxo.store. If a data breach affects you, we will notify you as required by law.

Choices everyone has

• Update your info: edit your profile and shipping details in Account Settings.
• Marketing emails: newsletters are opt-in only. Turn them off anytime with the Newsletter toggle in Account Settings, and every marketing email we send will include an unsubscribe link. You'll still get transactional emails about your orders.
• Close your account: email us (see below). Some records are kept as described in Section 07.

State privacy rights

Depending on where you live, including California, Texas, Virginia, Colorado, Connecticut, Utah, Oregon, and other states with privacy laws, you may have the right to:

• Know and access the personal information we have about you, and get a copy in a portable format.
• Correct inaccurate information.
• Delete your personal information, subject to legal exceptions (for example, records we must keep for tax purposes).
• Opt out of the sale of personal information, sharing for targeted advertising, and profiling. We don't do any of these, but you can still submit a request or use GPC (Section 05).
• Limit use of sensitive personal information. We use it only as needed to provide our services.
• Not be discriminated against for exercising these rights. We won't deny service or charge different prices because you made a request.

How to make a request

1. Email privacy@hexxo.store with the subject "Privacy Request" and say which right you're using.
2. We'll verify it's you by confirming the request from the email address on your account.
3. We'll respond within 45 days. If we need more time (up to 45 more days), we'll tell you why.

You can use an authorized agent; we may ask for proof that they're allowed to act for you.

Appeals. If we deny your request, you can appeal by replying to our decision with the subject "Privacy Appeal." We'll respond within 60 days. If you're unhappy with the outcome, you can contact your state attorney general. In Texas, that's the Office of the Texas Attorney General.

California residents

In the past 12 months, we collected these categories of personal information:

• Identifiers: name, email, username, IP address.
• Customer records: address, phone, payment status.
• Commercial information: purchases, listings, offers.
• Internet activity: usage data from Google Analytics.
• Photos: images of items.
• Sensitive personal information: limited to your account login (email and password), used only to provide and secure your account.

Sources and purposes are in Sections 01 and 02, and the service providers we disclose to for business purposes are in Section 03. We have not sold or shared personal information as California law defines those terms, and we have no actual knowledge of selling or sharing the information of anyone under 16.

Shine the Light: we do not share personal information with third parties for their own direct marketing purposes.

You must be 18 or older (or the age of majority where you live) to create an account, as stated in our Terms. Hexxo is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact privacy@hexxo.store and we will delete it.

We'll post any updates on this page and change the "Last updated" date. For material changes, we'll also notify you by email or an on-site notice before they take effect.

Questions or requests about your privacy: