Privacy Policy & Information Security Program

1. Information We Collect & How We Use It

XL Exhibit Production LLC (“we,” “our,” or “us”) collects business contact, account, and project specification details that you voluntarily provide when registering in our Account Portal, booking 90-minute 1-on-1 coaching sessions, purchasing Support Credits via Stripe, or submitting a 3D trade show booth or 9:16 live-selling studio quote request. This includes your name, business email address, company name, optional US phone number, TikTok Shop handle, and coaching session notes.

We use this information strictly to: (a) provision and authenticate your Seller, Exhibitor, Coach, or Admin portal account; (b) schedule and confirm 90-minute remote coaching and full-day onsite studio calibration appointments; (c) deliver custom 3D booth and 9:16 studio fabrication quotes; (d) display your authorized TikTok Shop health and coaching readiness metrics; and (e) process Support Credit transactions and issue booking confirmations.

2. TikTok Shop Partner (TSP) API Integration & Non-PII Data Minimization

Our custom partner integration, Official XL Exhibit Production Website (TikTok Shop Partner Center Service ID: 7702342809785403149), adheres to strict data minimization by design:

• Authorized Non-PII Scopes Only: When a seller voluntarily connects their US TikTok Shop via OAuth 2.0, our application requests only three pre-approved, read-only non-PII scopes: seller.shop.info (Global Shop Information), data.shop_analytics.public.read (TikTok Shop Analytics), and seller.global_product.info (Global Product Information).
• Zero Buyer PII Collection: We do not request, collect, process, or store end-customer or buyer Personal Identifiable Information (no buyer names, buyer phone numbers, buyer email addresses, or shipping addresses).
• United States Data Residency: All application data, OAuth token vaults, and shop analytics metadata are physically stored and processed exclusively in the United States on Google Cloud Platform (us-central1).

3. Information Security Program, Network Segregation & Encryption Standards

XL Exhibit Production LLC maintains a published Information Security & Data Governance Program aligned with NIST Cybersecurity Framework (CSF) and CIS Controls, reviewed semi-annually by Executive Management:

• Network Segregation & Threat Prevention: Production backend services run in isolated, serverless Google Cloud Run containers (us-central1) protected by Google Front End (GFE) and Cloud Armor DDoS/WAF mitigation, strict CORS origin allowlisting, and constant-time HMAC-SHA256 webhook signature verification. Development and production environments are logically segregated.
• Endpoint Anti-Virus & Daily Operations Security Baseline: All company endpoints enforce active real-time anti-virus/EDR protection with automated daily signature updates, host firewalls, BitLocker/FileVault full-disk encryption, automatic OS screen locking after 5 minutes of inactivity, a strict clear-desk policy, 14+ character password complexity, and mandatory Multi-Factor Authentication (MFA/2FA) across all cloud and partner portals.
• Access Control & Principle of Least Privilege (PoLP): System access is restricted via Role-Based Access Control (RBAC) in Google Cloud IAM and per-seller UID tenant isolation in Firebase Security Rules.
• 4-Tier Data Classification & Dual-Layer Encryption: Data is classified into Public, Internal, Confidential, and Restricted tiers. All data in transit is encrypted via HTTPS/TLS 1.2+ (TLS 1.3 preferred). All data at rest is encrypted via Google Cloud AES-256 storage encryption, and Restricted OAuth tokens (access_token and refresh_token) are additionally encrypted at the application layer using AES-256-GCM with unique 96-bit initialization vectors and 128-bit authentication tags before storage.

4. Vulnerability Management, Incident Response & Breach Notification

We enforce continuous automated dependency vulnerability auditing (npm audit and GitHub Dependabot), minimal container image hardening, and pre-release static secret scanning, with critical security patches applied within 24–48 hours. Under our published Security Incident Response Plan (SIRP), any confirmed security incident or suspected personal data breach is triaged immediately by our Incident Response Team, and notification is sent to TikTok Shop Partner Center and affected sellers within 24 hours of confirmation. Over the past 3 years, XL Exhibit Production LLC has experienced zero data breaches and zero regulatory privacy complaints.

5. Data Retention, Seller Deauthorization & End-of-Contract Deletion

Sellers may disconnect their TikTok Shop or request data access, correction, or complete deletion at any time inside the Account Portal or via TikTok Seller Center. Upon receiving a Seller Deauthorization webhook event (Type 6), a seller deletion request, or at the end of the contractual relationship, all associated TikTok Shop OAuth tokens and cached shop metadata in our possession are immediately purged from active production storage, and any residual encrypted backups are permanently expunged within 30 days.

6. Payment Processing (Stripe)

All online credit card and payment transactions for Support Credit packs are processed securely by Stripe, Inc. XL Exhibit Production LLC does not store raw credit card numbers or CVV codes on our servers. Stripe's collection and use of your payment data is governed by the Stripe Privacy Policy.

7. Appointed Data Protection Officer (DPO) & Privacy Inquiries

XL Exhibit Production LLC does not sell or rent your personal information to third parties. To exercise your data access, update, or deletion rights—or to contact our appointed Data Protection Officer (DPO) & Security Officer—please email info@xlexhibitproduction.com. All seller and partner data requests are fulfilled within 24 to 72 hours.

XL Exhibit Production LLC • California • Las Vegas • Los Angeles • United States