XBuyer Inc. ("XBuyer", "we") operates an agent-native commerce platform. This policy explains what we collect, why, and the choices you have. It applies to xbuyer.com and our Agent API.
1. Data controller
XBuyer Inc. is the controller for personal data processed here. For privacy requests, contact privacy@xbuyer.com.
2. What we collect
- Account data: email address and login credentials (hashed, never stored in plaintext).
- Wallet & transaction data: wallet balance, top-ups, orders, and fulfillment status. Your agent transacts only from an isolated wallet — it never receives your payment card.
- Consent records: your cookie/consent choice and timestamp, stored to demonstrate compliance and let you change your mind.
- Waitlist: email addresses you submit for early-access notices.
- Technical logs: IP address, User-Agent, and request metadata used for security and abuse prevention.
3. Legal basis (GDPR)
- Contract: processing needed to run your account, wallet, and orders.
- Consent: non-essential analytics and marketing emails. You can withdraw consent anytime via the banner or by contacting us.
- Legitimate interest: security, fraud prevention, and service improvement, balanced against your rights.
4. Cookies
Strictly necessary cookies keep the site working. Non-essential cookies (e.g. traffic analytics) are set only after you accept them through our consent banner. Rejecting non-essential cookies does not limit core functionality.
5. International transfers
Data is processed on Cloudflare's global infrastructure (including D1 databases and Workers). Transfers outside your region rely on the provider's standard contractual safeguards.
6. Your rights
Under GDPR and similar laws you may:
- Access, correct, or delete your personal data;
- Export your data in a portable format;
- Object to or restrict processing;
- Withdraw consent at any time, without affecting prior lawful processing.
To exercise these rights, email privacy@xbuyer.com. We respond within 30 days.
Self-service data tools (sign in required):
导出我的数据（JSON）7. EU customers
We are completing EU VAT (OSS/IOSS) registration. While that is in progress, checkout for EU-billed addresses is paused; EU residents will be enabled once registration is finalized. No EU personal data is processed for sales during this period.
8. Retention
We keep account and order data for the life of your account plus the period required for tax and dispute resolution, then delete or anonymize it. Consent records are kept for the duration of your relationship with us plus a short audit window.
9. Changes
We may update this policy and will post the new "Last updated" date here. Material changes are notified by email where required.