Privacy Policy

Last updated: July 23, 2026

This policy explains what information Xenon Ophthalmics Inc. ("Xenon", "we", "us") collects on xophthalmics.com, why we collect it, and the choices you have. We wrote it to be read, not skimmed past. If anything is unclear, write to us at [email protected] and a person will answer.

Who we are

Xenon Ophthalmics Inc.
525 Washington Blvd, Suite 300
Jersey City, NJ 07310, United States
[email protected]

The short version

What we collect and why

Information you give us

Our forms are the main way we collect personal information, and you always see exactly what you are sending:

• Contact and demo requests. Name, email, phone, organization, and your message. We use these to answer you and to schedule what you asked for.
• Media release form. The details on the form plus your drawn signature, captured in the browser. We use it to document your consent to be filmed or photographed.
• Order and preorder forms. Contact and shipping details, your product choices, your signature where required, and payment through Square (see Payments below).

Form submissions are stored on our website's server and sent to us by email. We keep them as long as we need them to handle your request and to meet business and legal record-keeping obligations. If you have turned on Marketing/Advertising, HubSpot also receives form submissions so we can follow up properly. Our Cookie Policy names what that involves.

Server logs and security

Our site runs on WP Engine behind Cloudflare. Like nearly every website, both keep standard server logs: IP address, browser type, pages requested, and timestamps. We use them only for security, troubleshooting, and keeping the site online, and they rotate out on the hosts' standard schedules. Cloudflare also sets a short-lived cookie, __cf_bm (about 30 minutes), to tell humans from bots. That one is strictly necessary and is the only cookie that exists before you make any choices, apart from the one that stores those choices.

Cookies and your consent

Our Cookie Policy is the full account: every cookie we use, by category, with its provider, purpose, type, and how long it lasts. We keep the detail in that one document so it stays accurate, rather than repeating it here where the two could drift apart.

How your choice works

Your decision lives in your browser in a single small entry named xo_consent_v1. It records which categories you turned on and when, identifies no one, and is never sent anywhere, including to us. We ask again after 12 months, or sooner if we add a new category. Declining is one click and never degrades the parts of the site we control.

Nothing in a category loads until you turn that category on. We do not load tracking code in a paused or limited state, and we do not send anonymous pings while you have not decided. Withdrawing consent is immediate: turn a toggle off and that category's cookies are deleted from your browser on the spot, and its code stops loading. If it was running on the page you are on, the page reloads clean. Cookies that a provider set on its own domain can only be removed in your browser settings; the Cookie Policy names every provider so you know where to look. Our pages also tidy up after retired tools: cookies left behind by systems we no longer use are cleared automatically.

We honor recognized browser opt-out signals, including Global Privacy Control. If your browser sends one, we detect it, we say so in the Preferences Center, and nothing in Marketing/Advertising runs unless you turn it on there yourself.

Payments (Square)

Payments on our order pages are processed by Square. The card fields are hosted by Square inside secure frames on the page: what you type in them goes directly to Square and never touches our servers. Square sets its own cookies inside those frames for payment security and fraud prevention; they are part of making the payment work. Square's privacy policy: squareup.com/us/en/legal/general/privacy.

Embedded videos

Product videos hosted on our own server play with no third party involved. YouTube videos on our site are click-to-play: you see a preview image, and YouTube's player loads only when you press play, in YouTube's privacy-enhanced mode. Pressing play means YouTube (Google) learns your IP address and may set its own cookies on its own domain, governed by Google's privacy policy.

Virtual try-on (xoFit)

The frame try-on feature on our xoFit page is provided by TINT (built on Banuba technology). Nothing from TINT loads when the page opens. When you tap the try-on button, the feature loads from TINT's servers and your browser asks for camera permission, which you can refuse. Use of the feature is governed by TINT's own terms and privacy practices.

Fonts

Our typeface (Europa) is delivered by Adobe Fonts from Adobe's servers, as Adobe's license requires. To deliver the font files, Adobe receives your IP address and counts the page view for licensing purposes. Adobe states it does not use advertising cookies for this service. Adobe's privacy policy: adobe.com/privacy/policy.html.

What we do not do

• We do not run advertising or ad trackers on this site today. If you turn on Marketing/Advertising, that category may involve a "sale" or "sharing" of information under some US state laws, which is why it is off unless you switch it on, and why you can switch it back off at any time.
• We do not profile you, and we make no automated decisions about you.
• We do not knowingly collect information from children under 16. Our products and site are for eye care professionals and their institutions.

Your rights

If you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR give you the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time (the footer's Cookie preferences link does exactly that for cookies, instantly, no email needed). You also have the right to complain to your data protection authority, or in the UK, the ICO.

If you are a California resident, the CCPA/CPRA gives you the rights to know, correct, and delete the personal information we hold about you, and the right to opt out of sale or sharing. Because the Marketing/Advertising category may involve a "sale" or "sharing" under those laws, you can opt out at any time using the Do Not Sell or Share My Personal Information control, which turns that category off and deletes its cookies immediately. We also honor Global Privacy Control signals, and everything optional stays off unless you switch it on.

To exercise any of these rights, email [email protected]. We will verify the request and answer within the legal deadline that applies to you. We never discriminate against you for exercising a privacy right.

International transfers

We are a United States company and our site is served from the United States. If you visit from the EEA or the UK, the providers named in this policy process data in the United States under recognized safeguards, such as the EU-US Data Privacy Framework and standard contractual clauses, per each provider's published terms.

Changes to this policy

When we change this policy, we change the date at the top and, for meaningful changes, we say so plainly on this page. We will never treat your continued use of the site as agreement to something you did not choose.

Contact