Privacy Policy

1. Who is responsible for your information?

XAVEXRA LABS is our website brand.

Data controller: LMP AESTHETICS SOLUTIONS LTD, trading as XAVEXRA LABS.

XAVEXRA LABS is a trading name of LMP AESTHETICS SOLUTIONS LTD. Registered in England and Wales. Company number: 17556343. Registered office: 5 St. Thomas Street, Newcastle Upon Tyne, NE1 4LE, United Kingdom.

For privacy enquiries, contact info@xavexralabs.com or write to:

This is our correspondence address. Our registered office is stated above.

2. Information we handle

When you submit an order request, we collect your name, email address, delivery address, optional telephone number and order notes, together with the products, quantities, prices and delivery charges.

We retain order references, payment and fulfilment status, relevant timestamps, payment-verification records, delivery tracking details where entered, and order-management history. New bank-transfer requests also retain the applicable contractual information so it can accompany acceptance after verified payment.

Submitting an order request does not commit you to buy or pay. Opening WhatsApp does not verify payment or mean your request has been accepted.

If you contact us by email or WhatsApp, we receive the information you choose to provide. Please do not send bank-login details, passwords or unnecessary sensitive information. Payment evidence should show only what is needed to identify and reconcile your payment.

Private administrator access involves account details, password hashes, session and security records, and passkey or recovery credentials where configured. Passkey authentication does not give us your device’s fingerprint or facial-recognition data.

Hosting and communications providers may also process technical information needed to operate and secure their services.

3. Why we use information and our lawful bases

We use information to:

• Respond to enquiries and handle order requests, including steps you ask us to take before entering a contract.
• Verify payment, communicate acceptance, fulfil accepted orders and handle contractual returns, refunds and complaints.
• Meet applicable accounting, tax and other legal obligations.
• Protect the website, administer access, prevent fraud, maintain reliable records and recover from technical failures.
• Produce internal sales and returning-customer reports using existing order records.

Our lawful bases are requested pre-contractual steps and performance of a contract, applicable legal obligations, and legitimate interests where appropriate.

Our legitimate interests include proportionate security, fraud prevention, service administration, recovery and internal business reporting. We consider necessity and your rights when relying on these interests. You may object to processing based on legitimate interests.

Where delivery-recipient or business-contact information concerns someone who is not our contracting customer, we assess an appropriate basis, including legitimate interests, rather than assuming that our contract covers that person.

4. WhatsApp and payment processing

Bank-transfer checkout saves an awaiting-payment order request and offers a separate WhatsApp handoff.

The prepared link contains the order reference, customer name, products, quantities, delivery charge, total and a request for bank-transfer instructions. Opening it shares those details with WhatsApp/Meta. You must separately press Send to send the message.

You can decide whether to proceed after receiving bank-transfer instructions. A payment screenshot does not itself verify receipt. Acceptance is communicated through the Paid order-confirmation email only after payment has actually been received and verified.

WhatsApp processes information under its applicable terms and privacy arrangements. Messages may also remain on the devices used for the conversation.

Cryptocurrency processing is currently disabled. If enabled separately in future, this notice will be reviewed to describe the relevant payment-provider processing.

5. Providers and international processing

We use the following services as applicable:

• Render: hosts the website. The deployed service is in Frankfurt, Germany, with private SQLite storage. This does not mean all provider support or technical processing is confined to Germany.
• Backblaze B2: stores encrypted database backups in EU Central. Backups are encrypted before upload. We have requested written clarification of the current account-applicable processing agreement and UK international-transfer arrangements.
• Resend: processes transactional email recipients, message content and delivery information when email delivery is enabled. Its primary processing and stored customer data are in the United States. Its applicable DPA includes the 2021 EU Standard Contractual Clauses and UK Addendum.
• Namecheap Private Email: hosts our business mailbox. We have requested written confirmation of the applicable processing arrangements, locations, international-transfer safeguards and provider retention.
• WhatsApp/Meta: handles information shared through the customer-initiated WhatsApp journey and subsequent conversations.
• Royal Mail: receives the delivery information needed when we arrange shipment.

Apple Mail is an application used to access the business mailbox; it is not the mailbox host.

Providers may act as processors for some activities and independently determine processing for their own service administration, security or legal obligations. Processing outside the UK requires an applicable lawful transfer arrangement. We do not promise UK-only storage or processing.

You may contact us for further information about applicable transfer safeguards.

6. Cookies, browser storage and email tracking

Essential functionality uses:

• A payment-session cookie lasting up to 24 hours.
• Administrator session cookies lasting up to eight hours, or up to 30 days when a trusted session is selected. Security controls may end sessions earlier.
• Passkey challenge cookies lasting five minutes.
• Browser local storage for basket product identifiers and quantities, until changed or cleared.
• Session storage for checkout-attempt identifiers, a digest of checkout details and an acknowledged order reference, helping prevent duplicate submissions.

Clearing or blocking storage may affect these functions.

The application does not currently include website analytics or advertising trackers. External services have their own storage practices when you visit them.

Resend’s current domain configuration enables click tracking and disables open tracking. When messages use click tracking, Resend can process events associated with links being clicked. Customer email delivery remains disabled during staging. This disclosure will be updated if the configuration changes before activation.

7. How long we retain information

Our working retention schedule is:

Unpaid or expired order requests

30 days after expiry, unless an active enquiry or dispute requires longer

Necessary paid-order, refund, accounting and acceptance evidence

Six years from the relevant financial year end, subject to applicable requirements, accountant confirmation and legal holds

Routine customer enquiries and WhatsApp correspondence

12 months after resolution; necessary contractual or dispute evidence may be retained separately

Unnecessary payment screenshots

Deleted within 90 days after reconciliation or issue closure, retaining minimum necessary verification evidence

Routine administrator/security audit records

12 months, unless needed as financial or incident evidence

Operational logs

A 30-day target where configurable, with documented incident-related extensions

Local recovery-test copies

Deleted after review and recording the recovery-test results

Isolated email-test ledger

Consumed run identifiers retained to prevent replay, while associated administrator information is minimised

Retention is administered through a manual review and deletion procedure; the application does not automatically delete customer orders after a fixed period.

Encrypted backups under xavexra/ are configured to be hidden after 30 days and eligible for deletion one day later, subject to Backblaze lifecycle processing. Backup retention is separate from the longer retention of necessary accounting records in the active system.

Resend confirms 30-day retention for email content, metadata, delivery events, logs and metrics on our current Free plan. Its published documentation separately states that provider backups persist for seven days.

Namecheap’s provider-side mailbox and backup retention remains subject to written confirmation. Messages we control remain subject to our correspondence-retention procedure.

Where deletion is appropriate, restricted backup copies may remain until scheduled expiry. They are reserved for recovery, and relevant deletions and corrections must be reapplied before restored data returns to operational use.

8. Security

We use access controls, protected administrator sessions and encrypted off-site backups to help safeguard information. Access is limited to legitimate operational needs.

No system can guarantee absolute security. We may retain or disclose information where required by law or necessary to establish, exercise or defend legal claims.

9. Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your information, and object to processing based on legitimate interests.

Rights are subject to applicable conditions. We may retain information required by law or needed for a justified legal claim. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Contact info@xavexralabs.com. We may request proportionate identity verification and normally respond within one month, subject to lawful extensions.

You may also complain to the Information Commissioner’s Office.