Privacy policy

Who we are and what this policy covers

OUXP – short for Outstanding Experience – is a Shopify Plus agency based in Los Angeles, California. We decide how the information described here is used, which makes us its controller under the GDPR. We also honor the rights California’s privacy law gives consumers, as set out under your privacy rights.

This policy covers ouxp.com, its contact and migration assessment forms, and the emails, calls and meetings that follow from them. Using the site is also covered by our terms of use.

It doesn’t cover customer and order data inside your store while we work on it – the agreement for that project governs it, as explained under store access and security. Other websites we link to have their own policies, as noted under other sites.

What information do we collect?

Nothing beyond what’s listed here. We don’t buy contact lists or enrich your details from other sources.

Information you give us

While a form shows a “Preview form” notice, nothing you type into it is sent or stored.

When you send a form, it reaches us as an email to our [email protected] inbox, and you get a short confirmation at the address you entered. The confirmation doesn’t repeat what you wrote, so the form can’t be used to send your words to someone else; before sending it, we check that the address’s domain can receive email (a lookup of the domain name only, through Cloudflare). With each form we also receive the date and time, the page you sent it from and the country your connection comes from, which Cloudflare works out from your IP address. Your IP address itself isn’t added to the emails.

Information collected automatically

Cloudflare hosts this site and delivers every page from its network. Like any web server, it logs each request:

• your IP address, and the approximate location it implies, such as the country
• the page or file requested, the date and time, and the result
• your browser and device type (the user agent) and the page that linked to us (the referrer)

To make pages open faster, some browsers load a page on this site a moment before you click a link to it. That request is logged the same way.

Information collected only with your permission

If you choose “Allow analytics” in the cookie banner or under Cookie settings, Google Analytics measures your visit – see how we use Google Analytics. Whatever you choose, we keep a record of the choice itself – see your cookie choice.

What we don’t collect

• Analytics data before you allow it – and session recordings, heatmaps or advertising pixels at any time
• Payment card or bank details through this website
• Passwords – please don’t send any by form or email
• Your customers’ data through the forms
• Sensitive personal information, such as government ID numbers, health information or precise location

How do we use it?

For the purposes below and nothing else. If you’re in the EU or the UK, the GDPR requires a legal basis for each purpose, so the table names one.

What we don’t do with it

• Sell your personal information, or share it for cross-context behavioral advertising
• Send you marketing email you didn’t sign up for – any newsletter is opt-in, with an unsubscribe link in every email
• Make automated decisions about you that have legal or similarly significant effects

Do we use cookies or analytics?

One cookie of our own, and analytics only if you allow it. The site’s own code sets one strictly necessary cookie, __Host-ouxp_consent, which remembers your cookie choice for 6 months. Google Analytics runs only after you choose “Allow analytics” – until then no Google script loads and no Google cookie is set. There are no advertising or social media tags, and no embedded videos, maps or chat widgets to bring in other trackers.

The cookie banner offers “Allow analytics” and “Essential only” side by side, with the same weight. Closing or ignoring it isn’t a yes, the site works either way, and Cookie settings – at the bottom of every page – lets you change your mind as easily as you made it.

One script comes from elsewhere whatever you choose, and only on the contact and migration assessment pages: Cloudflare Turnstile, the spam check on our forms. It loads from challenges.cloudflare.com once you start filling in a form – not before – and usually runs without asking you to do anything. To tell people from bots, it checks signals such as your IP address and browser details. Cloudflare states that it uses these signals to detect and block bots, not to identify, profile or target anyone, and we don’t use Turnstile for anything else. It is strictly necessary to keep the forms usable, so it doesn’t need your consent. Cloudflare’s Turnstile privacy addendum (external site) has the details.

Cloudflare can also set a strictly necessary security cookie when it needs to tell people from automated traffic – for example __cf_bm, which expires after 30 minutes of inactivity, or cf_clearance after you pass a security check. Cloudflare says __cf_bm doesn’t track you from site to site, and cf_clearance isn’t shared across sites.

We honor Global Privacy Control. If your browser sends it, analytics stays off without a click, and the footer of every page and Cookie settings show “Opt-Out Preference Signal Honored”; you can still switch analytics on in Cookie settings yourself. We don’t sell or share personal information, so a Do Not Track signal has nothing further to switch off.

Our cookie policy lists each cookie, who sets it, what it’s for and how long it lasts.

How do we use Google Analytics?

Only with your permission. Google Analytics 4 is a service of Google LLC, based in the US. It loads only after you allow analytics, and only on this website.

What it collects

• the pages you view, when and for how long, and how far you scroll
• how you arrived: the site or search engine that linked to us, or a campaign tag in the link
• your browser, device type (computer, phone or tablet), operating system and language
• your approximate location – country and region, never city – worked out from your IP address. Google Analytics doesn’t log or store IP addresses
• links to other sites you click, and files you download
• that a contact or assessment form was sent, and which form it was – never your name, email address or anything you typed
• a random ID, kept in the _ga cookie, that tells your visits apart without saying who you are

What we use it for

To see which pages help visitors decide, which ones lose them and which channels bring inquiries, so we can improve the site. We don’t use it to identify you, to build advertising profiles or to make decisions about you.

How it’s set up

• Off until you allow it – “Essential only” and Global Privacy Control keep it off
• Google signals and ad personalization switched off, and not linked to Google Ads
• No user IDs, and nothing typed into a form is sent to Google
• Its cookies, _ga and _ga_56TC5VVQ7N, last up to 13 months and are deleted when you switch analytics off
• Google Analytics keeps event-level data – the visits and events tied to the random ID in your _ga cookie – for 14 months, then deletes it. Aggregated reports that don’t identify anyone, such as page-view totals, stay in our Google Analytics account
• Google processes the data for us under its data processing terms – as our processor under the GDPR and our service provider under the CCPA – with data sharing for Google’s own purposes switched off

Where the data goes

Google processes it in the United States and other countries. Google LLC is certified under the EU-U.S. Data Privacy Framework, with its UK extension and the Swiss-U.S. framework, and also offers standard contractual clauses for transfers. How Google uses information from sites that use its services (external site)

Your choice

Our legal basis is your consent (GDPR Article 6(1)(a) and the ePrivacy rules on cookies). You can withdraw it at any time: under Cookie settings, switch analytics off and save. That stops Google Analytics, deletes its cookies from ouxp.com and reloads the page. Data collected before then stays in Google Analytics until it expires after 14 months. If you want it deleted sooner, ask us before you switch analytics off and include your analytics ID – Cookie settings shows it while analytics is on. We can find your data only by that random ID, and switching analytics off deletes the cookie that holds it; once it’s gone, we can no longer tell which data is yours. Google also offers a browser add-on that blocks Google Analytics on every site (external site).

What do we keep about your cookie choice?

A record that shows we asked and what you chose, because the GDPR expects us to be able to demonstrate consent. Each time you make or change a choice, your browser sends it to our site, and we store:

• a random consent ID – the same one your __Host-ouxp_consent cookie holds
• your choice – analytics allowed or essential only – how you made it (the banner, Cookie settings, a withdrawal or your browser’s Global Privacy Control signal) and whether that signal was on
• the version and fingerprint of the banner text your page showed, when you chose, and the page that sent the choice
• the date and time the choice reached us, and the country your connection comes from
• a shortened IP address – the first three numbers of an IPv4 address, or the first three blocks of an IPv6 address – which points to a network, not to your device
• your browser type (the user agent), shortened

We keep the record of an opt-in or a withdrawal for 3 years and the record of a refusal for 2 years, then it is deleted automatically – long enough to answer a question or complaint about the analytics data Google still holds and the choice behind it, and to show that a refusal or a Global Privacy Control signal was respected. The records sit in a database at Cloudflare, can’t be read through the website and are open only to OUXP and to Cloudflare, which stores them for us. Our legal basis is our legitimate interest in being able to show that we asked for and respected your choice, as Article 7(1) of the GDPR requires.

Cookie settings shows your consent ID. Quote it if you want a copy of your records or want them deleted.

Who do we share it with?

Only with service providers that help us run the website and the business, under terms that limit them to providing that service.

Beyond that, we disclose information only when the law requires it, such as under a court order; to protect our rights or someone’s safety; or to a buyer if OUXP is ever merged or sold, in which case this policy keeps applying. Anything else needs your permission.

Cloudflare’s own privacy policy (external site) explains how it handles request data across its network, Resend’s privacy policy (external site) how it handles the emails it delivers, and Google’s privacy policy (external site) how Google handles data.

Do we need access to your store?

Not to reply to you, and not for the free migration assessment – engineers work from your public storefront and your answers. A fixed quote comes later, from a deeper pass with read-only access under NDA.

When you hire us for a project, a retainer or emergency support, Shopify access goes through a collaborator request that you approve, with the permissions you choose. For your current platform during a migration, and for tools such as Google Analytics or Search Console, you give us our own account.

We never ask for a shared password, and you can remove access at any time. If you need an NDA, we sign yours before any access or details change hands.

Customer and order data inside your store stays yours, as the merchant. We handle it only on your instructions and only as far as the work needs, as your service provider (a processor, in GDPR terms). The agreement for each project sets the details, such as how customer records move in a migration.

How we protect what we hold

• The whole site runs over HTTPS, so what you type into a form is encrypted on its way to us
• The forms accept only the fields you see, check every submission for spam and never put your entries in a web address
• Inquiries and client records are open only to the OUXP team members working on them
• If an ERP, 3PL or payment provider is involved, we agree on a secure way in with whoever manages it – no shared passwords

If a breach affects your information, we’ll tell you without undue delay and as the law requires. Found a security problem on this site? Email [email protected].

How long do we keep it?

As long as we need it for the purposes above, then we delete it.

Ask us to delete your information sooner and we will, unless the law requires us to keep it.

Your privacy rights

Wherever you live, you can ask what we hold about you, have it corrected or deleted, and object to how we use it. We answer every request, whether or not a privacy law requires it where you are, and requests are free. If the law requires us to keep something, such as an invoice, we’ll tell you.

How to make a request

1. Email [email protected] with “Privacy request” in the subject, or call +1 (818) 651-3226, Mon–⁠Fri, 9 AM–⁠9 PM ET.
2. Say what you want – a copy, a correction or deletion – and which email address or phone number you used with us.
3. You get a first reply within 30–⁠60 minutes during business hours, as with any message, and written confirmation of your request within 10 business days at the latest. We answer in full within 45 calendar days – within 30 days for Quebec requests and 1 month for EU and UK requests. A complex request can take longer – up to 45 more calendar days in California, or 2 more months under the GDPR – and we’ll tell you why.

To protect you, we check that a request really comes from you, usually by replying to the address we have on file. An authorized agent can act for you with your signed permission, and we may ask you to confirm it directly.

California residents (CCPA/CPRA)

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents the right to:

• Know what personal information we collect, use and disclose, and get a copy of it
• Delete it, and correct anything inaccurate
• Opt out of its sale or sharing – we don’t sell or share it, and we honor Global Privacy Control
• Limit the use of sensitive personal information – we don’t collect any
• Use these rights without being treated differently

In the past 12 months we collected the categories below, from you directly and automatically from your browser when you visited, for the purposes listed under how we use it. That period includes the earlier version of ouxp.com, whose contact form also asked for a phone number and accepted file attachments, whose footer offered a newsletter sign-up and which counted visits with Cloudflare’s cookie-free web analytics – and, from October 2026, Google Analytics for visitors who allow it. We have not sold or shared personal information, including that of anyone under 16.

Notice at collection. When you use ouxp.com we collect the categories above for the purposes under how we use it, and keep them for the periods under how long we keep it. We don’t sell personal information or share it for cross-context behavioral advertising, and we don’t collect sensitive personal information. Analytics data is collected only after you allow it, and a Global Privacy Control signal is honored as an opt-out.

EU, EEA and UK visitors (GDPR)

The GDPR and the UK GDPR give you the right to access your information, rectify it, erase it, restrict how we use it, receive it in a portable format and object to uses based on our legitimate interests. Where we rely on your consent – analytics – you can withdraw it at any time under Cookie settings.

OUXP is based in the United States, so what you send us is handled in the US, and our providers may process it in other countries. When they move EU or UK personal data to the US, they rely on recognized safeguards, such as the EU-U.S. Data Privacy Framework with its UK extension, or standard contractual clauses (with the UK addendum for UK data).

You can also complain to your local data protection authority – find yours in the EU and EEA (external site), or in the UK, the Information Commissioner’s Office (external site). We’d appreciate the chance to put things right first.

Quebec residents (Law 25)

Google Analytics can be used to build a picture of how someone uses a site, so it is off by default: it runs only if you switch it on, after the banner tells you what it does. You can access and correct your personal information, ask for it in a portable format, withdraw your consent and ask us to stop using or sharing it. Your information may be stored and processed outside Quebec, by the service providers listed under who we share it with. Requests go to OUXP’s person in charge of the protection of personal information, our owner, at [email protected] or +1 (818) 651-3226. We answer access and correction requests from Quebec within 30 days. You can also complain to the Commission d’accès à l’information du Québec (external site).

Children, other sites and changes

Three short points that apply to everyone: who this site is for, where its links lead and how this policy changes.

Children

This site and our services are for businesses. We don’t knowingly collect information from anyone under 16; if you think a child has sent us information, email us and we’ll delete it.

Other websites

Links to other sites – such as the Shopify Partner Directory, Upwork, Cloudflare and our clients’ stores – lead to sites with their own privacy policies. If you hire us through Upwork, Upwork’s policy also covers what you share there.

Changes to this policy

We review this policy at least once a year and change the date at the top whenever we update it. If a change affects information you’ve already given us, we’ll tell you before it applies – by email, if we have your address.

How to contact us

Privacy questions, requests and complaints go to the same team that answers everything else.

Email

[email protected]

Phone

+1 (818) 651-3226

Hours

Mon–⁠Fri, 9 AM–⁠9 PM ET (6 AM–⁠6 PM PT)

Based in

Los Angeles, California

An engineer replies within 30–⁠60 minutes during business hours, as with every message; formal requests follow the timelines under your privacy rights.

• Terms of usePrices here aren’t a quote until a proposal is signed
• Cookie policyEvery cookie on the site, and how to change your choice
• AccessibilityOur WCAG 2.2 AA target and how to report a problem