Privacy policy

Last updated: 11 October 2026

This policy explains how we handle personal data when you visit xovist.com, buy from us or contact us.

Who we are

FOOTXO LLC, a Wyoming limited liability company trading as XOVIST, 1021 East Lincolnway, Cheyenne, WY 82001, United States, run from Lahore, Pakistan, is responsible for your data (the "controller"). Contact: support@xovist.com.

What we collect

  • Order details: name, delivery and billing address, email, phone number if you give one, what you buy, return and refund history.
  • Payment: your card, Apple Pay or Google Pay details go straight to our payment provider. We receive the payment result, never your full card number.
  • Messages: what you send by email, through our contact or withdrawal forms, or in the store chat.
  • Reviews: your name, rating, text and any photos, if you leave a review.
  • Newsletter: your email address, if you subscribe.
  • Device and usage data: IP address, browser and device, pages viewed and items added to the cart, through cookies and similar technologies.

Why we use it

  • To take, pay for, ship and support your order, including returns and refunds (to perform our contract with you).
  • To prevent fraud and keep the store secure (our legitimate interests).
  • To keep tax and accounting records and answer lawful requests (legal obligation).
  • To send marketing emails, only if you subscribed (your consent). Every email has an unsubscribe link.
  • To measure and improve the store and, where you allow it, to show you ads (your consent where the law requires it, otherwise our legitimate interests).

Who we share it with

Only the service providers we need to run the store, each for its own job:

  • Shopify: hosts the store, checkout, order records, customer accounts, store emails and the Shopify Inbox chat, including its AI-assisted replies. Shopify also uses some data under its own policy (privacy.shopify.com).
  • Whop: takes your payment on our secure payment page, checkout.xovist.com.
  • Vercel: hosts checkout.xovist.com.
  • DSers and our suppliers on AliExpress, in China: receive your name, delivery address and phone number to pack and send your order.
  • Carriers and customs: receive your name, address and phone number to deliver your parcel.
  • Google Workspace: runs our support@xovist.com mailbox.
  • Loox: sends the review request after delivery and shows reviews on the store.

We may also share data when the law requires it, to protect our rights, or if the business is sold. Our Track page opens 17TRACK in a new tab with the number you enter; 17TRACK's own privacy policy applies there.

Cookies, ads and the "sale" or "sharing" of data

We do not sell personal data for money. The store uses cookies for the cart and checkout, statistics and, where you allow it, advertising, which some US state laws call a "sale" or "sharing" of data. In the UK, the EU and other places where the law requires it, our cookie banner asks first. You can opt out at any time on Your Privacy Choices; a Global Privacy Control signal from your browser counts as an opt-out for that browser.

International transfers

Our providers work in several countries, including the United States, Canada, China and Pakistan. When data leaves the UK or the EEA, we rely on adequacy decisions or the Standard Contractual Clauses (or the UK equivalent); sending your order details to our suppliers in China is necessary to deliver what you bought.

How long we keep it

We keep order records for as long as tax and accounting rules require, usually up to 7 years. We keep support messages for up to 3 years after your last message, and newsletter data until you unsubscribe.

Your rights

Depending on where you live, you can ask to see, correct, delete or receive a copy of your data, to restrict or object to how we use it (including any marketing, at any time), and withdraw a consent you gave. In US states with privacy laws you can also opt out of targeted advertising and appeal our answer, and you may use an authorised agent. Email support@xovist.com. We may need to confirm who you are, we answer within one month (45 days for US state requests), and we never treat you differently for using your rights. You can also complain to your data protection supervisory authority, for example the ICO in the UK or the authority in your EU country.

Children and security

The store is not meant for children under 16, and we do not knowingly collect their data. The store and payment page use HTTPS, card data is handled only by our PCI DSS certified payment provider, and access to your data is limited to what each task needs.

Changes

We may update this policy. The date at the top shows the latest version.