Privacy Policy

1. Introduction

This Privacy Policy describes how XORMAKI, LLC collects, uses, retains, protects, and shares personal information when customers or visitors access, use, or make purchases through xormaki.com.

We respect the privacy of visitors and customers and seek to handle personal information transparently, securely, and for legitimate business purposes. By using our website, you acknowledge the practices explained in this Privacy Policy.

2. Website Platform and Store Infrastructure

This website is a self-hosted store built on WordPress and powered by WooCommerce. WordPress provides our content management environment, while WooCommerce supports functions including product listings, shopping carts, checkout, orders, customer accounts, shipping details, and other online-store features.

Because the website is self-hosted, website and order information is maintained within hosting infrastructure selected and managed for XORMAKI, LLC, subject to the security, access, and service arrangements described in this policy.

3. Information We Collect

Depending on your interaction with xormaki.com, we may collect information including your name, email address, telephone number, billing address, shipping address, account information, order history, products purchased, transaction status, shipping method, tracking information, return records, and communications with our customer service team.

We may also receive technical information such as IP address, browser type, device type, operating system, referring page, pages visited, approximate location derived from IP address, access time, cookie identifiers, and website activity.

4. Information You Provide Directly

We collect information that you choose to provide when creating an account, ordering headwear or scarves, completing checkout, submitting a form, contacting us, requesting a return, subscribing to communications, or otherwise interacting with XORMAKI, LLC.

Customers are responsible for providing accurate information where necessary for payment, order fulfillment, delivery, returns, and customer service. We use this information for the purposes described in this Privacy Policy and other purposes permitted by applicable law.

5. Order and Transaction Information

When an order is placed, WooCommerce may record information necessary to manage the purchase, including the order number, customer information, billing and delivery details, purchased products, order value, payment status, shipment status, refund status, and transaction reference information.

These records allow us to fulfill orders, verify transactions, provide customer assistance, handle returns and refunds, maintain accounting records, investigate delivery issues, reduce fraud, and respond to legitimate disputes or chargebacks.

6. Payment Processing Through Stripe and PayPal

Payments made through xormaki.com are processed by independent third-party payment service providers, including Stripe and PayPal. Depending on the payment method chosen at checkout, payment information is transmitted directly to the applicable provider for authorization and processing.

XORMAKI, LLC does not directly receive or store customers' complete card numbers, CVV/CVC security codes, bank login credentials, PayPal passwords, Apple Pay credentials, Google Pay credentials, or other sensitive payment authentication information.

Sensitive payment credentials are handled by Stripe, PayPal, or the relevant payment network. We may retain non-sensitive transaction information such as payment status, transaction identifiers, payment method type, refund status, and associated order references where reasonably required for order management, accounting, refunds, fraud prevention, or dispute handling.

7. Payment Security

Transactions may be protected using technologies and security measures provided through our website infrastructure and payment providers. These may include HTTPS, SSL/TLS encryption, tokenization, PCI DSS-compliant payment processing infrastructure, fraud screening, secure payment gateways, and supported 3D Secure authentication.

Tokenization allows sensitive card details to be replaced with a non-sensitive token, reducing the need for the merchant to directly store the original card information. Where additional verification is required, your bank or payment provider may request authentication before approving the payment.

8. How We Use Personal Information

We may use personal information to operate xormaki.com, process purchases, confirm payments, prepare and dispatch orders, provide tracking information, communicate about transactions, answer customer-service requests, process returns and refunds, prevent fraud, manage disputes, maintain business records, meet legal obligations, and improve our website operations.

We do not use personal information for purposes that are materially incompatible with the reason it was collected unless such use is permitted or required under applicable law.

9. Shipping and Logistics Providers

To deliver purchases, we may provide relevant information to shipping and logistics providers such as USPS, UPS, DHL, DPD, EMS, or other local or international carriers used for a particular order.

Information provided to carriers may include the recipient's name, shipping address, telephone number, email address where required for delivery communication, parcel information, order reference, and other details reasonably necessary to complete delivery.

Shipping carriers process information according to their own privacy practices and applicable law.

10. Returns, Refunds, and Customer Service Records

When you request a return, refund, replacement, or assistance with a hat, scarf, or other order, we may collect and retain information including your order number, the reason for the request, communications, photographs supplied by you, return tracking details, delivery records, inspection information, and refund status.

These records allow us to assess requests, provide appropriate remedies, maintain accurate transaction histories, and document the handling of an order if the transaction is later questioned.

11. Payment Disputes and Chargeback Records

If a payment dispute, chargeback, or transaction inquiry is opened through Stripe, PayPal, a card issuer, bank, or payment network, we may use relevant information associated with the transaction to investigate and respond.

This information may include the order confirmation, transaction reference, billing details, shipping information, carrier tracking, proof of delivery, customer communications, return requests, refund confirmations, product-related records, and other material reasonably relevant to the disputed transaction.

Where reasonably necessary, these records may be supplied to Stripe, PayPal, the relevant bank, card network, or another authorized payment provider for dispute review.

12. Legal Bases for Processing

Where applicable law requires a lawful basis for processing personal information, including under the European Union General Data Protection Regulation, processing may occur because it is necessary to perform a contract with you, comply with legal obligations, pursue legitimate business interests, establish or defend legal claims, prevent fraud, or because you have provided consent.

Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

13. Cookies and Similar Technologies

xormaki.com may use cookies and similar technologies to operate essential website features, maintain shopping carts, remember account sessions, support checkout, improve website performance, identify security issues, and understand how visitors interact with our store.

Some cookies may be necessary for the website and WooCommerce functions to operate correctly. Other cookies, where used, may support analytics, preferences, or optional website features. Where required by applicable law, non-essential cookies will be used subject to the appropriate consent mechanism.

14. Server Logs and Technical Information

Our hosting environment may automatically create server or security logs that include information such as IP addresses, browser details, request timestamps, error messages, access events, and security activity.

We may use these records to maintain website availability, diagnose technical problems, identify suspicious behavior, prevent unauthorized access, investigate security events, and protect the integrity of xormaki.com.

15. Data Security Measures

We use reasonable administrative, technical, and organizational safeguards intended to protect personal information against unauthorized access, alteration, disclosure, destruction, loss, or misuse.

These safeguards may include HTTPS and SSL/TLS encryption, controlled administrative access, role-based permissions, strong authentication practices, secure account credentials, software updates, WordPress and WooCommerce security maintenance, server-level security controls, firewall protections, malware monitoring, activity logging, secure backups, and restricted access to customer records.

Administrative access is limited to persons requiring access for legitimate operational purposes. Where practical, we apply the principle of least privilege so that access to customer information corresponds with relevant responsibilities.

16. Protection Against Unauthorized Access and Fraud

We may use security monitoring, login protections, rate limiting, fraud-detection tools, transaction screening, access controls, and other safeguards to help identify suspicious activity and reduce unauthorized access.

Where a potentially suspicious transaction is detected, Stripe, PayPal, a bank, or another payment provider may request additional verification or decline the payment according to its own security procedures.

No internet-based system can guarantee absolute security. However, we maintain safeguards designed to reduce foreseeable risks and to respond appropriately to security incidents.

17. Sharing Personal Information

We do not sell customers' personal information. Limited information may be shared with service providers only where reasonably necessary for us to operate our website, fulfill orders, and provide related services.

Such providers may include hosting providers, payment processors, shipping carriers, website technology providers, security providers, email service providers, professional advisers, accounting providers, fraud-prevention providers, and other vendors that provide legitimate services on our behalf.

We may also disclose information where required by law, legal process, court order, regulatory request, or where reasonably necessary to protect our rights, customers, website systems, or business.

18. International Data Transfers

Because XORMAKI, LLC provides worldwide shipping and uses service providers that may operate internationally, personal information may be processed outside your country of residence.

Where personal information protected by European data-protection law is transferred internationally, we seek to use appropriate safeguards where required, including contractual protections, adequacy decisions, or other lawful transfer mechanisms recognized by applicable data-protection law.

19. Data Retention

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including order fulfillment, customer support, returns, refunds, fraud prevention, accounting, tax compliance, dispute management, chargebacks, and other legal or operational needs.

General customer-service or contact records may normally be retained for up to approximately 12 months after the relevant matter has been resolved unless a longer period is reasonably necessary or legally required.

Order, payment, refund, shipping, tax, dispute, and accounting records may be retained for longer periods where necessary to satisfy financial recordkeeping rules, payment-provider requirements, legal obligations, or the establishment, exercise, or defense of legal claims.

20. European Privacy Rights and GDPR

If you are located in the European Economic Area, European Union, or another jurisdiction in which the General Data Protection Regulation (GDPR) applies, you may have specific rights regarding your personal information.

Subject to applicable conditions and exceptions, these rights may include:

• The right to request access to personal information we hold about you.
• The right to request correction of inaccurate or incomplete information.
• The right to request deletion of personal information in certain circumstances.
• The right to request restriction of processing.
• The right to object to certain processing based on legitimate interests.
• The right to receive certain personal information in a portable format.
• The right to withdraw consent where processing is based on consent.
• The right to lodge a complaint with an applicable data protection authority.

To exercise an applicable privacy right, please contact us at team@xormaki.com. We may need to verify your identity before completing certain requests to protect customer information from unauthorized access or disclosure.

Some records may still need to be retained after a deletion request where continued retention is required for legal compliance, accounting, tax obligations, fraud prevention, dispute resolution, chargebacks, or the establishment or defense of legal claims.

21. Children's Privacy

xormaki.com is a general online retail store and is not specifically designed or directed toward children. We do not knowingly seek to collect personal information from children in a manner prohibited by applicable law.

If you believe a child has provided personal information without appropriate authorization, please contact team@xormaki.com so that we can review the circumstances and take appropriate action.

22. Privacy Questions, Policy Updates, and Contact Information

We may update this Privacy Policy from time to time to reflect changes to our website, WooCommerce configuration, service providers, payment systems, security measures, business operations, or applicable legal requirements.

Any updated version will be published on xormaki.com. Material changes may also be communicated using another reasonable method where required by applicable law.

For questions concerning this Privacy Policy, our handling of personal information, your privacy rights, or a transaction-related privacy matter, please contact:

XORMAKI, LLC
24 Drayton St, Ste 702, Savannah, GA 31401, US
+1 (912) 790-8450
team@xormaki.com

For information concerning payments, shipping, returns, or refunds, please also refer to our Payment Policy, Shipping Policy, and Refund and Returns Policy.