Privacy Policy

Last updated: September 6, 2026

This Privacy Policy explains how the operator of exodia.world ("Exodia", "we", "our", "us") processes personal information when you browse the store, place an order, receive a digital product, leave a review, or contact support.

1. Information We Process

Depending on how you use Exodia, we may process:

• Order and contact information: email address, public order ID, products and variants ordered, quantities, prices, discounts, currency, timestamps, and order status.
• Payment metadata: payment provider, transaction or checkout identifiers, payment status, payment amount, currency, and refund information. Full payment-card numbers are handled by the payment provider and are not stored by Exodia.
• Fulfillment information: whether delivery is automatic or manual, delivery status, stock/reservation information, and digital access information assigned to an order. Sensitive automatic-delivery contents are stored using server-side encryption and are made available only through the protected order flow and authorized administrative tools.
• Review information: reviewer display name, rating, review text, product/variant, related order item, review status, and reminder/invitation status.
• Checkout consent records: whether the separate digital-content consent was accepted, the exact consent wording/version, acceptance time, checkout language, and request IP so the transaction record can show what was agreed before fulfillment began.
• Security and technical information: IP address and related request information used for rate limiting, security, fraud prevention, and server/audit records.
• Support information: information you choose to provide when contacting us by email, Discord, or another official support channel.

2. How We Use Information

We use information where reasonably necessary to:

• create, process, verify, and manage orders and payments;
• deliver products automatically when stock is available or support manual Discord fulfillment when required;
• send order confirmations, delivery information, review invitations/reminders, and refund notifications;
• provide support and investigate delivery or product problems;
• prevent fraud, abuse, duplicate redemptions, unauthorized order access, and payment disputes;
• administer verified-purchase reviews and moderation;
• record and confirm checkout consent or acknowledgments where required for digital fulfillment;
• maintain accounting, audit, security, and legally required records; and
• operate, secure, diagnose, and improve the store.

3. Legal Bases

Where data-protection law such as the GDPR applies, our legal basis depends on the purpose. Processing may be necessary to perform a contract or take steps requested before a purchase, to comply with legal obligations, or for legitimate interests such as store security, fraud prevention, record keeping, and resolving disputes. Where the law requires consent for a particular activity, we rely on consent and you may withdraw it as allowed by law.

4. Automatic and Manual Delivery Data

Exodia uses a stock-aware fulfillment system. If automatic stock is available, digital delivery information may be assigned to your paid order and sent to your checkout email and/or displayed on the protected order page. If automatic stock is unavailable or the product uses manual fulfillment, the order may require you to contact Exodia on Discord with your order ID.

We process delivery status and assigned-access information so we can fulfill the order, prevent the same stock item from being delivered twice, provide support, and investigate disputes. Keep delivered credentials and order-access information private.

5. Sharing With Service Providers

We do not sell personal information. We may share or make information available to service providers only where needed for the store to operate, including:

• payment providers such as Stripe and NOWPayments, which process payments under their own terms and privacy notices;
• email/SMTP providers used to send transactional messages;
• hosting, infrastructure, security, and backup providers used to run and protect the website;
• Discord when you choose to contact us through Discord, in which case Discord's own privacy terms also apply; and
• authorities or professional advisers where disclosure is legally required or reasonably necessary to protect legal rights, investigate fraud, or respond to a valid legal request.

6. Cookies and Browser Storage

The storefront uses browser storage for functions such as the shopping cart and language preference. The protected order flow may use a secure, HttpOnly cookie so the browser can access the correct order without exposing the private access token in the page URL.

Payment providers and other third-party services may use their own cookies or similar technologies when you interact with their services. Their use of those technologies is governed by their own privacy notices.

7. Data Retention

We keep information only for as long as reasonably necessary for the purpose for which it was collected, including order fulfillment, support, accounting, security, fraud prevention, refunds, dispute handling, and compliance with legal obligations. Some transaction and audit records may need to be kept longer where required by tax, accounting, payment, or legal rules.

Review information may remain associated with the verified purchase so review integrity and moderation can be maintained. Security/rate-limit records are intended to be short-lived where they are no longer needed. We may retain limited records where reasonably necessary to establish, exercise, or defend legal claims.

8. Security

We use technical and organizational safeguards appropriate to the type of information we process. These include access controls, protected administrative sessions, payment-provider verification, encrypted storage for automatic-delivery contents, and restricted access to private application data.

No online system can be guaranteed to be completely secure. You should also protect your email account, order information, and any credentials delivered to you.

9. Your Data-Protection Rights

Depending on applicable law, you may have rights to request access to, correction of, deletion of, restriction of, or portability of your personal information, and in some cases to object to processing or withdraw consent. These rights can be subject to legal exceptions, including obligations to retain transaction records.

If GDPR or similar law applies, you may also have the right to complain to the competent data-protection supervisory authority.

10. International Processing

Some service providers may process information in countries other than your own. Where required by applicable data-protection law, transfers are handled using legally recognized safeguards or another valid transfer mechanism. For details about a payment provider's or Discord's processing locations, review that provider's own privacy notice.

11. Changes to This Policy

We may update this Privacy Policy when our services, providers, or legal obligations change. The updated version will be posted on this page with a revised date.

12. Contact

For privacy questions or requests, contact:

• Email: exowrld.support@gmail.com
• Discord: discord.gg/exowrld