Privacy Policy (Pre-Launch Draft)
Version 2026-10-v1.0-prelaunch · Confidential Merchant Privacy Protection
This privacy policy is a pre-launch draft prepared for review and staging. GOXOW is operated by an individual sole proprietor. We strictly protect merchant catalog confidentiality with zero marketing trackers or cross-site cookies.
1. Overview & Privacy Commitment
GOXOW is operated by an individual sole proprietor committed to transparent, minimalist data processing. We collect only the information strictly necessary to clean your catalog, deliver order receipts, and provide secure customer download access. We do not sell, rent, license, or monetize your personal or catalog data.
2. Information We Collect
We collect: (a) Customer Email Address — used to send transactional order receipts, merchant question links, and download readiness notices; (b) Optional Company Name — used for spreadsheet attribution; (c) Uploaded Catalog Spreadsheets — CSV or Excel files containing product titles, descriptions, dimensions, prices, and SKUs; (d) Transaction Confirmation Data — Stripe Checkout session identifiers and payment status (we never see, process, or store full credit card numbers or CVVs); (e) Technical Security Logs — masked IP addresses and endpoint access records used strictly for fraud prevention and rate limiting.
3. How We Process Customer Catalog Data
Your uploaded catalog data is processed by our automated software solely to execute the normalization, dimensional structuring, categorization, and export generation you requested. Raw spreadsheets and generated files are stored in encrypted object storage and are never accessed for advertising or public profiling.
4. Third-Party Infrastructure Providers
We rely on trusted enterprise infrastructure providers bound by confidentiality and security obligations: (a) Stripe — payment processing and PCI-DSS compliant checkout; (b) Cloudflare R2 / AWS S3 — encrypted cloud object storage for raw uploads and completed deliverables; (c) Supabase / PostgreSQL — encrypted database for order metadata, quote snapshots, and audit records; (d) Resend — transactional email delivery service.
5. Zero Third-Party Advertising & Cookie Policy
GOXOW uses zero third-party advertising cookies, zero tracking pixels, and zero cross-site behavioral analytics (such as Google Analytics or Meta Pixel). Public browsing and guest catalog diagnostics on GOXOW are completely cookie-free. The only cookies used by GOXOW are strictly necessary, first-party, HTTP-only technical session cookies: (a) 'goxow_customer_session' — issued exclusively when a customer accesses their order via an email return link (/access/[token]) or logs into an optional merchant account, allowing secure deliverable downloads and order review across browser tabs for 7 days; and (b) 'goxow_admin_session' — reserved exclusively for internal administrative authentication. Neither cookie is ever used for tracking, advertising, or marketing.
6. Data Retention Schedule & Staging Status
Our codified retention schedule specifies: Unpaid uploads (7 days), abandoned diagnostics (14 days), paid source files (30 days post-completion), generated deliverables (30 days post-completion), and security audit logs (180 days). IMPORTANT STAGING NOTICE: While the automated data retention engine has been implemented in our codebase in dry-run mode, automated destructive deletion routines are currently in deployment staging and are not yet active in production. Customer deletion requests submitted via email are honored manually and immediately.
7. Customer Deletion Requests & Rights
You have the right to request immediate deletion of your uploaded catalog files, generated deliverables, and personal email records at any time. To request deletion, email support@goxow.com with your order number. We will permanently delete your files from storage within 5 business days, retaining only non-identifying accounting and tax records as required by law.
8. Data Security Safeguards
We enforce strict defense-in-depth security controls: automated MIME and file signature validation, request memory caps, formula injection sanitization, tenant-partitioned object storage keys, cryptographic guest access tokens, and TLS 1.3 encryption in transit.
9. Contact Information
For any privacy inquiries, data deletion requests, or questions regarding this Privacy Policy, please contact our support desk directly at support@goxow.com.
Privacy inquiries or data deletion requests? Contact support@goxow.com