Privacy policy
OUXP gets only what you choose to send – by form, email or phone – plus the request logs every website keeps. We use it to reply and to scope or deliver the work you ask for. This policy covers who helps us handle it, how long we keep it and your rights under California’s CCPA and the EU and UK GDPR.
Draft – pending legal review before launch. This policy describes how the site works today; its wording may change after review.
Who we are and what this policy covers
OUXP – short for Outstanding Experience – is a Shopify Plus agency based in Los Angeles, California. We decide how the information described here is used, which makes us its controller under the GDPR. We also honor the rights California’s privacy law gives consumers, as set out under your privacy rights.
This policy covers ouxp.com, its contact and migration assessment forms, and the emails, calls and meetings that follow from them. Using the site is also covered by our terms of use.
It doesn’t cover customer and order data inside your store while we work on it – the agreement for that project governs it, as explained under store access and security. Other websites we link to have their own policies, as noted under other sites.
What information do we collect?
Nothing beyond what’s listed here. We don’t buy contact lists or enrich your details from other sources.
Information you give us
| Channel | What we receive |
|---|---|
| Contact form | Your name, work email, the service you need and your message – including any call times you suggest – plus your company and website URL if you add them. |
| Free migration assessment form | Your name, work email, store URL and current platform – plus what’s driving the change, your target timing and any notes, if you add them. |
| Your address, your message, your signature details and anything you attach. | |
| Phone | Your number, the time of the call and our notes of what you asked. |
| Strategy and project calls | The names and contact details of the people on the call, and our notes. We don’t record a call unless everyone on it agrees first. |
| Becoming a client | Billing contacts, company details and the records we create together – scopes, approvals and invoices. |
While a form shows a “Preview form” notice, nothing you type into it is sent or stored.
When you send a form, it reaches us as an email to our hello@ouxp.com inbox, and you get a short confirmation at the address you entered. The confirmation doesn’t repeat what you wrote, so the form can’t be used to send your words to someone else; before sending it, we check that the address’s domain can receive email (a lookup of the domain name only, through Cloudflare). With each form we also receive the date and time, the page you sent it from and the country your connection comes from, which Cloudflare works out from your IP address. Your IP address itself isn’t added to the emails.
Information collected automatically
Cloudflare hosts this site and delivers every page from its network. Like any web server, it logs each request:
- your IP address, and the approximate location it implies, such as the country
- the page or file requested, the date and time, and the result
- your browser and device type (the user agent) and the page that linked to us (the referrer)
To make pages open faster, some browsers load a page on this site a moment before you click a link to it. That request is logged the same way.
What we don’t collect
- Analytics, session recordings, heatmaps or advertising pixels
- Payment card or bank details through this website
- Passwords – please don’t send any by form or email
- Your customers’ data through the forms
- Sensitive personal information, such as government ID numbers, health information or precise location
How do we use it?
For the purposes below and nothing else. If you’re in the EU or the UK, the GDPR requires a legal basis for each purpose, so the table names one.
| Purpose | Legal basis (EU and UK) |
|---|---|
| Replying to your message and answering your questions | Our legitimate interest in answering business inquiries, and steps you ask for before a contract |
| Preparing a free migration assessment, a proposal or a quote | Steps you ask for before entering a contract |
| Delivering the projects, support and emergency help you hire us for | Performing our contract with you or your company |
| Recording a call, only if everyone on it agrees | Your consent, which you can withdraw at any time |
| Invoicing and keeping business and tax records | Our legal obligations |
| Keeping the site and our systems secure – blocking attacks, spam and abuse | Our legitimate interest in running a secure service |
| Handling legal claims and lawful requests from authorities | Our legal obligations, and our legitimate interest in protecting our rights |
What we don’t do with it
- Sell your personal information, or share it for cross-context behavioral advertising
- Send you marketing email you didn’t sign up for – any newsletter is opt-in, with an unsubscribe link in every email
- Make automated decisions about you that have legal or similarly significant effects
Do we use cookies or analytics?
Not of our own, and no analytics. Nothing in this site’s code sets a cookie or runs an analytics, advertising or social media tag. Fonts and scripts load from our own domain, and there are no embedded videos, maps or chat widgets to bring in third-party trackers.
One script comes from elsewhere, and only on the contact and migration assessment pages: Cloudflare Turnstile, the spam check on our forms. It loads from challenges.cloudflare.com once you start filling in a form – not before – and usually runs without asking you to do anything. To tell people from bots, it checks signals such as your IP address and browser details. Cloudflare states that it uses these signals to detect and block bots, not to identify, profile or target anyone, and we don’t use Turnstile for anything else. It is strictly necessary to keep the forms usable, so it runs without a consent banner. Cloudflare’s Turnstile privacy addendum (external site) has the details.
The one exception sits outside our page code. Cloudflare can set a strictly necessary security cookie when it needs to tell people from automated traffic – for example __cf_bm, which expires after 30 minutes of inactivity, or cf_clearance after you pass a security check. Cloudflare says __cf_bm doesn’t track you from site to site, and cf_clearance isn’t shared across sites.
Because we don’t sell or share personal information, a Global Privacy Control or Do Not Track signal has nothing to switch off here. If that ever changes, we’ll treat a Global Privacy Control signal as a valid opt-out.
If we add analytics or any other tool that sets cookies, we’ll update this policy before the tool goes live and ask for your consent where the law requires it. Our cookie policy covers cookies in more detail.
Who do we share it with?
Only with service providers that help us run the website and the business, under terms that limit them to providing that service.
| Provider | What they do and what they see |
|---|---|
| Cloudflare | Hosts and delivers the site, runs our form handler and the Turnstile spam check, and blocks attacks and bots. Sees request logs – IP address, pages requested, browser details – and passes on what you send in a form. |
| Resend | Delivers the emails our forms send: the notice to our inbox and your confirmation. Sees your name, email address and what you write in the form. Based in the US. |
| Our email provider | Runs the hello@ouxp.com inbox. Sees the messages you send us and our replies. |
| Our phone provider | Connects calls to +1 (818) 651-3226. Sees your number and call times. |
| Video-call and scheduling tools | Run strategy and project calls. See attendees’ names, email addresses and meeting times. |
| Accounting and invoicing tools | Invoicing and business records, for clients only. See billing contacts and invoices. |
Beyond that, we disclose information only when the law requires it, such as under a court order; to protect our rights or someone’s safety; or to a buyer if OUXP is ever merged or sold, in which case this policy keeps applying. Anything else needs your permission.
Cloudflare’s own privacy policy (external site) explains how it handles request data across its network, and Resend’s privacy policy (external site) how it handles the emails it delivers.
Do we need access to your store?
Not to reply to you, and not for the free migration assessment – engineers work from your public storefront and your answers. A fixed quote comes later, from a deeper pass with read-only access under NDA.
When you hire us for a project, a retainer or emergency support, Shopify access goes through a collaborator request that you approve, with the permissions you choose. For your current platform during a migration, and for tools such as Google Analytics or Search Console, you give us our own account.
We never ask for a shared password, and you can remove access at any time. If you need an NDA, we sign yours before any access or details change hands.
Customer and order data inside your store stays yours, as the merchant. We handle it only on your instructions and only as far as the work needs, as your service provider (a processor, in GDPR terms). The agreement for each project sets the details, such as how customer records move in a migration.
How we protect what we hold
- The whole site runs over HTTPS, so what you type into a form is encrypted on its way to us
- The forms accept only the fields you see, check every submission for spam and never put your entries in a web address
- Inquiries and client records are open only to the OUXP team members working on them
- If an ERP, 3PL or payment provider is involved, we agree on a secure way in with whoever manages it – no shared passwords
If a breach affects your information, we’ll tell you without undue delay and as the law requires. Found a security problem on this site? Email hello@ouxp.com.
How long do we keep it?
As long as we need it for the purposes above, then we delete it.
| Information | How long we keep it |
|---|---|
| Inquiries and assessment requests that don’t lead to work | Up to 24 months after our last contact, so we have the context if you come back |
| Contracts, project records and invoices | For the engagement, then up to 7 years for tax, accounting and legal records |
| Form submissions | In our inbox, as above. Our form handler keeps a backup copy for 30 days, in case an email doesn’t arrive, then deletes it automatically. Resend’s delivery log keeps the emails for up to 30 days. |
| Spam-check records | Counters stored under a one-way scrambled form (a keyed hash) of your IP address and email address, used to limit repeated sending: for 10 minutes (IP address) and up to 2 days (email address) |
| Hosting and security logs | Up to 30 days, unless a security investigation needs them longer |
Ask us to delete your information sooner and we will, unless the law requires us to keep it.
Your privacy rights
Wherever you live, you can ask what we hold about you, have it corrected or deleted, and object to how we use it. We answer every request, whether or not a privacy law requires it where you are, and requests are free. If the law requires us to keep something, such as an invoice, we’ll tell you.
How to make a request
- Email hello@ouxp.com with “Privacy request” in the subject, or call +1 (818) 651-3226, Mon–Fri, 9 AM–9 PM ET.
- Say what you want – a copy, a correction or deletion – and which email address or phone number you used with us.
- You get a first reply within 30–60 minutes during business hours, as with any message, and written confirmation of your request within 10 business days at the latest. We answer in full within 45 calendar days, or within 1 month for EU and UK requests. A complex request can take longer – up to 45 more calendar days in California, or 2 more months under the GDPR – and we’ll tell you why.
To protect you, we check that a request really comes from you, usually by replying to the address we have on file. An authorized agent can act for you with your signed permission, and we may ask you to confirm it directly.
California residents (CCPA/CPRA)
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents the right to:
- Know what personal information we collect, use and disclose, and get a copy of it
- Delete it, and correct anything inaccurate
- Opt out of its sale or sharing – we don’t sell or share it
- Limit the use of sensitive personal information – we don’t collect any
- Use these rights without being treated differently
In the past 12 months we collected the categories below, from you directly and automatically from your browser when you visited, for the purposes listed under how we use it. That period includes the earlier version of ouxp.com, whose contact form also asked for a phone number and accepted file attachments, whose footer offered a newsletter sign-up and which counted visits with Cloudflare’s cookie-free web analytics. We have not sold or shared personal information, including that of anyone under 16.
| Category | What it means here, and who receives it for a business purpose |
|---|---|
| Identifiers | Name, email address, phone number, IP address. Disclosed to Cloudflare, our web host, our email, form, phone and video-call providers, and – for clients’ billing contacts – our accounting and invoicing tools. |
| Professional or employment-related information | Company, store URL and any job title you share. Disclosed to our email and form providers. |
| Commercial information | Services you asked about or bought, project and billing records. Disclosed to our email provider and our accounting and invoicing tools. |
| Internet or network activity | Request logs: pages requested, browser type, referrer and the approximate location an IP address implies (never precise location), plus page-view statistics on the earlier site. Disclosed to Cloudflare and our web host. |
| Sensitive personal information | None collected. |
EU, EEA and UK visitors (GDPR)
The GDPR and the UK GDPR give you the right to access your information, rectify it, erase it, restrict how we use it, receive it in a portable format and object to uses based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time.
OUXP is based in the United States, so what you send us is handled in the US, and our providers may process it in other countries. When they move EU or UK personal data to the US, they rely on recognized safeguards, such as the EU-U.S. Data Privacy Framework with its UK extension, or standard contractual clauses (with the UK addendum for UK data).
You can also complain to your local data protection authority – find yours in the EU and EEA (external site), or in the UK, the Information Commissioner’s Office (external site). We’d appreciate the chance to put things right first.
Children, other sites and changes
Three short points that apply to everyone: who this site is for, where its links lead and how this policy changes.
Children
This site and our services are for businesses. We don’t knowingly collect information from anyone under 16; if you think a child has sent us information, email us and we’ll delete it.
Other websites
Links to other sites – such as the Shopify Partner Directory, Upwork, Cloudflare and our clients’ stores – lead to sites with their own privacy policies. If you hire us through Upwork, Upwork’s policy also covers what you share there.
Changes to this policy
We review this policy at least once a year and change the date at the top whenever we update it. If a change affects information you’ve already given us, we’ll tell you before it applies – by email, if we have your address.
How to contact us
Privacy questions, requests and complaints go to the same team that answers everything else.
- hello@ouxp.com
- Phone
- +1 (818) 651-3226
- Hours
- Mon–Fri, 9 AM–9 PM ET (6 AM–6 PM PT)
- Based in
- Los Angeles, California
An engineer replies within 30–60 minutes during business hours, as with every message; formal requests follow the timelines under your privacy rights.