This policy explains what ExiusCart collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it, wherever you are in the world.
Last updated: October 17, 2026
We never sell data
Not your data, and not your customers' data. Not now, not ever.
You own your store
Products, orders and customers are yours. Export them anytime.
Encrypted end to end
TLS in transit, encryption at rest, scoped staff access.
Delete on request
Ask us and we erase your account data, minus what law requires.
The short version. Tap any card for the full detail.
What do we process?
Account, billing and store data you give us, plus device and usage data collected as you use ExiusCart.
Any sensitive data?
No. We do not collect health, religious, biometric or similar special category data.
Data from third parties?
Yes, from the sales channels, ad accounts and suppliers you choose to connect, and from social sign-in.
Why do we process it?
To run your store, bill your plan, support you, keep the platform secure, and with your consent, market to you.
Do we share it?
Only with service providers that help us run ExiusCart, under contract. We never sell it.
How do we keep it safe?
Encryption, access controls, monitoring and backups. No system is 100% secure, but we work hard at it.
What are your rights?
Access, correction, deletion, portability, objection and more, depending on where you live.
How do you use them?
Email support@exiuscart.com or use your account settings. We reply within 30 days.
ExiusCart, EC Sourcing and Eevo are operated by NexCodeNova ("we", "us", "our"), a technology company based in Sri Lanka with operations in Dubai, UAE. This policy covers exiuscart.com, store.exiuscart.com, ecsourcing.exiuscart.com, our Shopify app, our affiliate program, and any page that links here (together, the "Services").
When we are the controller
For your account, billing, support chats and website visits, we decide how your data is used and we are responsible for it.
When we are the processor
For your store's customers, orders and leads, you are the controller. We process that data only on your instructions. See section 10.
We collect information you give us, information collected automatically when you use the Services, and information from other sources you connect. We do not collect sensitive personal information such as health, religion, ethnicity or biometric data.
| Category | Examples | Where it comes from |
|---|---|---|
| Identity & contact | Name, email, phone, business name, country, job title | You, at sign-up or in settings |
| Login credentials | Email and password (stored as a one-way hash), social sign-in IDs | You, Google or Facebook |
| Billing | Plan, invoices, billing address, last 4 card digits, payment status | You and our payment processors |
| Store & business data | Products, prices, stock, orders, invoices, suppliers, staff and roles | You and your connected channels |
| Your customers' data | Shopper names, emails, phones, shipping addresses, order history, leads | Your storefront, channels and ad lead forms |
| Communications | Support tickets, Eevo chat messages, WhatsApp and email threads, feedback | You |
| Device & usage | IP address, browser, OS, pages viewed, features used, crash and error logs | Automatically, as you use the service |
| Approximate location | Country and city derived from IP, used for currency and fraud checks | Automatically |
| Affiliate & referral | Referral codes, clicks, conversions, payout email or account details | You and our tracking links |
Card payments are handled directly by our payment processors. We only ever receive a token, the card brand and the last 4 digits.
We use your information only for the purposes below, and never to build profiles that we sell or rent.
Create and manage your account
Sign-up, login, team access and plan management.
Deliver the service
Run your store, sync channels, fulfil orders, send invoices and reports.
Bill your subscription
Charge plans, trials and add-ons, issue receipts and handle refunds.
Support you
Answer questions through Eevo, email and WhatsApp, and fix issues.
Send service messages
Security alerts, trial and billing reminders, policy changes.
Market to you, with consent
Product news and offers. Unsubscribe from any email in one click.
Keep ExiusCart secure
Detect fraud, abuse, spam and unauthorised access.
Improve the product
Understand which features are used so we build the right things.
Measure our campaigns
See which ads and channels bring new merchants to us.
Meet legal duties
Tax, accounting, court orders and lawful requests from authorities.
Under the EU and UK GDPR, Sri Lanka's Personal Data Protection Act No. 9 of 2022 and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), we must have a lawful reason to use your data. We rely on:
Contract
Processing needed to provide the plan you signed up for, such as running your store and billing.
Legitimate interests
Keeping the platform secure, preventing fraud, improving features and measuring our marketing, balanced against your rights.
Consent
Marketing emails, non-essential cookies and optional integrations. You can withdraw consent at any time.
Legal obligation
Keeping tax and accounting records and answering lawful requests.
Vital interests
Rarely, to protect someone's life or safety.
If you are in Canada
We rely on your express or implied consent, which you may withdraw at any time. In limited cases the law lets us process without consent, for example to investigate fraud, collect a debt, or comply with a subpoena or court order.
When you connect a channel, we access its data only to provide that integration. You can disconnect at any time from your dashboard, and we stop syncing immediately. Access tokens are stored encrypted.
Shopify
Orders, products, inventory, customers and abandoned checkouts via the Shopify Admin API and webhooks. Our Shopify app honours Shopify's customer data request and redaction webhooks.
TheDersi
Orders, customer details, listings and stock via webhook and API, with product and stock changes pushed back in real time.
Amazon
Orders, listings and inventory via the Selling Partner API, used only to sync your Amazon business with ExiusCart.
eBay
Listings, orders and inventory via the eBay REST API using OAuth 2.0 and platform notifications.
Daraz
Orders, products and inventory via the Daraz Open Platform API using OAuth 2.0.
Noon
Orders, listings and inventory via the Noon Partner API.
WooCommerce
Orders by webhook and two-way inventory sync using API keys you provide.
TikTok Shop (rolling out)
Products, orders and inventory via the TikTok Shop Open Platform API using OAuth 2.0.
Google Ads & Meta lead forms
Lead name, email and phone sent to ExiusCart by webhook and stored as leads on your behalf.
EC Sourcing suppliers
When you auto-fulfil with suppliers such as CJ Dropshipping or Printful, we pass the shipping name, address and phone needed to ship that order.
Custom websites
Order and lead data your own site sends to your ExiusCart webhook URL.
Eevo, our AI agent, and tools such as AI Studio send the text, images or product details you give them to our AI providers (OpenAI, Google Gemini and Anthropic) to generate a result.
We do not sell or rent personal information. We share it with service providers who help us run the Services. Each is bound by contract to use it only to provide their service to us and to protect it.
| Category | Providers | Why |
|---|---|---|
| Payment processors | Whop, PayPal, Stripe, PayHere | Charge plans and add-ons. We never see or store full card numbers. |
| Cloud hosting & storage | Amazon Web Services and other cloud hosts | Run the platform and store files, images and backups. |
| Email delivery | Resend, Amazon SES | Send account, billing and marketing emails, including Eevo Flows. |
| SMS & WhatsApp | Twilio | Send verification codes and messages you set up. |
| AI providers | OpenAI, Google Gemini, Anthropic | Power Eevo, AI Studio, product writing and image tools. |
| Market data | Apify | Collect public product and trend data. No personal data of yours is sent. |
| Fulfilment suppliers | CJ Dropshipping, Printful | Ship orders you choose to auto-fulfil. |
| Analytics | Google Analytics | Understand how visitors use our website. |
| Sign-in providers | Google, Facebook | Let you log in without a new password. |
| Sales channels | Shopify, Amazon, eBay, Daraz, Noon, TikTok Shop | Sync data with the channels you connect. |
We may also share data in these situations
We use cookies and similar technologies such as local storage and pixels. They fall into three groups:
Keep you signed in, secure your session, remember your currency and cart. The site does not work without them.
Remember choices like dismissed banners and dashboard layout.
Google Analytics tells us which pages are visited and how people find us, so we can improve the site.
You can block or delete cookies in your browser settings. Blocking essential cookies will stop login from working. To opt out of Google Analytics everywhere, use the Google Analytics opt-out add-on. Pixels you add to your own storefront (for example Meta or TikTok) are controlled by you.
For shoppers on your store, you are the controller and we are your processor. You are responsible for having a privacy policy on your storefront and a lawful basis for your marketing.
We are based in Sri Lanka and the UAE, and our service providers operate in other countries, including the United States and the European Union. Your data may be processed outside the country where you live.
Where data leaves the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or an adequacy decision, together with the security measures in section 13.
We keep data only as long as we need it for the purposes in this policy or as the law requires. Then we delete or anonymise it.
| Data | How long we keep it |
|---|---|
| Account and store data | While your account is active, then 30 days after it closes so you can export or reactivate |
| Billing and tax records | As long as tax and accounting laws require, usually 5 to 7 years |
| Support tickets and Eevo chats | Up to 24 months after the conversation ends |
| Security and access logs | Up to 12 months, longer if needed for an investigation |
| Marketing preferences | Unsubscribes are kept on a suppression list so we never email you again |
| Storefront browsing (for stores) | Linked to a browser id for 90 days, then kept only as anonymous counts for about two years |
| Shopper erasure (for stores) | A store can erase a shopper on request at any time; only their email is kept, as unsubscribed |
| Backups | Rolled over automatically and overwritten within 35 days |
TLS encryption
All traffic is encrypted in transit.
Encrypted at rest
Databases, backups and tokens are encrypted.
Daily backups
Automated and tested for recovery.
Access controls
Role-based, least-privilege staff access.
No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. Please use a strong, unique password and keep your devices up to date. If a breach affects you, we will tell you and the relevant authorities as the law requires. Read more on our Security page.
The Services are for businesses and people aged 18 or over. We do not knowingly collect data from anyone under 18. If we learn that we have, we will close the account and delete the data. If you think a minor has given us data, email support@exiuscart.com.
Depending on where you live (including the EEA, UK, Switzerland, Canada, Sri Lanka and the UAE), you have the rights below. We will never treat you differently for using them.
Access
Get a copy of the personal data we hold about you.
Correction
Fix anything that is wrong or out of date.
Deletion
Ask us to erase your data.
Portability
Download your data in a common, machine-readable format.
Objection
Object to processing based on legitimate interests or for marketing.
Restriction
Ask us to pause processing while a concern is checked.
Withdraw consent
Withdraw at any time. Past processing stays lawful.
Complain
Lodge a complaint with your local data protection authority.
Opting out of marketing
Click unsubscribe in any marketing email or tell us. We will still send service messages such as billing and security alerts.
Your account
Update your details in settings at any time. You can close your account from billing or by contacting us.
Complaints
You can complain to your local data protection authority. In Switzerland, contact the Federal Data Protection Commissioner.
Most browsers offer a Do-Not-Track setting. There is no agreed standard for it yet, so we do not currently respond to Do-Not-Track signals. Where the law requires it, we treat a Global Privacy Control (GPC) signal as a valid request to opt out of sale or sharing. If a standard is adopted, we will update this policy.
Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws have extra rights. In the last 12 months we have collected these categories of personal information:
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Name, email, phone, IP address, account ID | Yes |
| B. Customer records (Cal. Civ. Code 1798.80) | Name, address, phone, billing details | Yes |
| C. Protected classifications | Gender, age, race, religion | No |
| D. Commercial information | Plans bought, invoices, payment history | Yes |
| E. Biometric information | Fingerprints, face or voice prints | No |
| F. Internet or network activity | Pages viewed, features used, device and browser data | Yes |
| G. Geolocation data | Approximate location from IP (no precise GPS) | Yes |
| H. Audio, electronic, visual or similar | Call recordings, CCTV | No |
| I. Professional information | Business name, role, team membership | Yes |
| J. Education information | Student records | No |
| K. Inferences | Profiles about preferences or traits | No |
| L. Sensitive personal information | Account login and password only | Yes |
Your rights
How it works
We update this policy when our Services or the law change. The "Last updated" date at the top shows the latest version. For material changes we will email active account holders or show a notice in the dashboard at least 14 days before the change takes effect.
Questions, requests or complaints about privacy? Reach our data protection team:
Email support@exiuscart.com from your account email
Say what you want: a copy, a correction or deletion
We verify it is you, usually by email
We complete it within 30 days and confirm
You can also export your store data and edit your profile yourself from the dashboard at any time. We may keep some data after deletion where the law requires it, such as invoices.
The terms, refunds and security rules that sit alongside this policy.
9. Social Logins
If you sign in with Google or Facebook, we receive your name, email address and profile picture from that provider. We use them only to create and secure your account.
We are not responsible for how Google or Facebook use your data. Please read their privacy policies.