Privacy policy

Last updated: June 24, 2026

Skux Pte Ltd (UEN 202414847K), trading as Xyro ("we", "us", "our"), operates this store and website and the related products and services (the "Services"). Xyro is powered by Shopify. This Privacy Policy describes how we collect, use and disclose your personal data when you visit, use, or make a purchase using the Services, or otherwise communicate with us. We handle personal data in accordance with the Singapore Personal Data Protection Act 2012 (PDPA). If you access the Services from the EU, UK or United States, additional rights may apply where relevant.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read it and understand the collection, use and disclosure of your information as described here.

Personal information we collect or process

Depending on how you interact with the Services, we may collect or process:

Contact details, including your name, billing and shipping address, phone number and email address.
Financial information, including payment card and transaction details. Card numbers are handled by our payment processor; we do not store full card numbers.
Account information, including your username, password, preferences and settings.
Transaction information, including items you view, add to cart, purchase, return or cancel, and your subscription status.
Communications with us, including support enquiries and reviews.
Device information, including your device, browser, IP address and other identifiers.
Usage information, including how and when you interact with the Services, via cookies and similar technologies.

Personal information sources

Directly from you; automatically through the Services (including cookies and analytics); from service providers acting on our behalf; and from partners or other third parties.

How we use your personal information

To provide, tailor and improve the Services — process payments, fulfil and ship orders, manage your account and subscriptions, handle returns and exchanges, enable reviews, and personalise your experience.
For marketing and advertising — with consent where required. For SMS marketing to Singapore mobile numbers we obtain your express consent, screen against the Do Not Call Registry where required, and you can opt out at any time by replying STOP.
For security and fraud prevention.
To communicate with you and provide customer support.
For legal reasons — to comply with applicable law and respond to valid legal process.

Consent (PDPA). We collect, use and disclose personal data for purposes a reasonable person would consider appropriate, for which you have given consent or deemed consent, or as permitted or required by law. You may withdraw consent at any time (see "Your rights and choices").

How we disclose personal information

With service providers who perform services on our behalf — for example Shopify (hosting and commerce), our payment processor, Appstle (subscription billing), our shipping partners, Klaviyo (email and SMS), and our reviews provider — who are bound to protect your data and use it only to provide services to us.
With business and marketing partners, where you have consented.
When you direct or consent to disclosure, such as to ship your order.
With our affiliates or within our corporate group.
In connection with a business transaction (such as a merger), or to comply with legal obligations, enforce our terms, or protect our rights and those of others.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your use of the Services in order to provide and improve them. Information you submit may be transmitted to and processed by Shopify and third parties located outside Singapore. To learn more, see the Shopify Consumer Privacy Policy and the Shopify Privacy Portal (privacy.shopify.com).

Overseas transfer (PDPA)

Your personal data may be transferred, stored and processed outside Singapore (including by Shopify and other providers). Where we transfer personal data overseas, we take reasonable steps to ensure it receives a standard of protection comparable to the PDPA. For transfers out of the EEA or UK, we rely on recognised mechanisms such as the European Commission's Standard Contractual Clauses.

Cookies

We use cookies and similar technologies for functionality, analytics and, with consent where required, advertising. You can control cookies through your browser settings.

Children's data

The Services are not directed to, and our products are not intended for, persons under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact our Data Protection Officer to request deletion.

Security and retention

No security measures are perfect, and information sent to us may not be secure in transit; please do not send sensitive information over unsecured channels. We retain personal data only as long as needed to provide the Services, maintain your account or subscription, comply with legal obligations, and resolve disputes.

Data breaches

If a data breach occurs that is likely to result in significant harm to affected individuals, or that affects 500 or more individuals, we will notify the Personal Data Protection Commission of Singapore and, where required, affected individuals, in accordance with Part VIA of the PDPA.

Your rights and choices

Access and correction. You may request access to, or correction of, the personal data we hold about you.
Withdraw consent. You may opt out of marketing at any time via the unsubscribe link or by contacting our Data Protection Officer. We may still send transactional or account messages.

We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your rights.

Complaints

If you have a complaint about how we handle your personal data, please contact our Data Protection Officer. You may also lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised version here and update the "Last updated" date.

Contact — Data Protection Officer

Skux Pte Ltd has designated a Data Protection Officer responsible for our compliance with the Singapore Personal Data Protection Act 2012. For questions about this Privacy Policy, to exercise your rights, or to raise a complaint, you can contact our Data Protection Officer at hello@xyro.co.

Skux Pte Ltd, trading as Xyro (UEN 202414847K)
68 Circular Road, #02-01, Singapore (049422)