Privacy Policy

Last updated: 8 September 2026 · Version 1.0

Your privacy is important to us. This policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

From Customers

Name, email address, and profile photo from Google Sign-In
Phone number (optional, provided during checkout)
Purchase history, order receipts, and license keys
IP address and device information for security
Session data for account security

From Vendors

Full name, email, phone, business name
National ID documents and selfie (for KYC verification)
Bank account information (for payouts, encrypted at rest)
Product listings and sales data

2. How We Use Your Data

To process and fulfill your digital orders
To verify vendor identities (KYC compliance)
To process vendor wallet payouts
To send transactional emails and receipts
To prevent fraud and ensure platform security
To comply with legal obligations

3. Data Security

Sensitive data including identity documents, bank account numbers, and delivery credentials are encrypted at rest. Payments are processed by Stripe — XSITE never stores credit card details. All data is transmitted over HTTPS.

4. Data Retention

Order records are retained for 7 years for accounting and legal compliance. KYC documents are retained for the duration of the vendor relationship plus 5 years. You may request deletion of your account data subject to legal retention requirements.

5. Your Rights

Right to access your personal data
Right to correct inaccurate data
Right to request deletion (subject to legal obligations)
Right to data portability
Right to withdraw consent at any time

6. Contact

Data protection inquiries: privacy@xsite.com