Privacy Policy

1. XOOBAY Introduction

1.1 XOOBAY Global Limited and its affiliates ("XOOBAY", "we", "us") are dedicated to protecting your privacy and complying with applicable privacy laws. This Privacy Policy ("Policy") explains our data collection, use, disclosure, and processing practices. By using our Services or Platform, you consent to these practices. We may update this Policy and will notify you of changes by posting them on our Platform.

1.2 "Personal Data" refers to any information that can identify you, such as your name, contact details, or ID number.

1.3 Using our Services implies acceptance of our data practices and any Policy updates.

1.4 This Policy complements other agreements regarding your personal data and does not override them unless specified.

1.5 The Policy applies to both buyers and sellers on our Platform unless stated otherwise.

2. Data Collection

2.1 We collect personal data when you: Register or use our Services. Submit forms or agreements. Interact with us via calls, emails, or social media. Use our Platform, including cookies. Link your account with social media. Participate in transactions or feedback. Register for contests or submit data for any reason.

2.2 We may also obtain personal data from affiliates, third parties, business partners, and public sources.

2.3 If you provide personal data of others, you must have their consent.

3. Types of Personal Data Collected

3.1 We may collect: Basic details (name, email, date of birth, etc.). Payment information and contact details. Device information and usage data. Location data. Social media account information if linked. Any other data relevant to your use of our Services.

3.2 Ensure the accuracy of your data and notify us of changes. We may request additional documentation to verify information.

3.3 You can opt out of data collection by contacting our Data Protection Officer. However, this may affect your use of our Services.

4. Other Data

4.1 Your device may send data about you (e.g., IP address, device type). This helps us understand your use of our Platform.

4.2 We may track content and software interactions on our Platform.

5. Cookies

5.1 We use cookies to improve our Platform, offer new services, and provide relevant content. Cookies may be linked to your personal data and usage patterns.

5.2 You can refuse cookies through your browser settings, but this may limit functionality.

6. Use of Information

6.1 We may use your data to: Process transactions and manage your account. Respond to requests and communications. Enforce terms, ensure safety, and comply with laws. Conduct research, marketing, and development. Facilitate customer service and audits. Handle business transactions.

6.2 We may access and disclose your data if required by law or for other specified reasons.

6.3 Additional purposes will be disclosed at the time of consent.

7. Data Protection and Retention

7.1 We implement security measures to protect your data, though absolute security cannot be guaranteed.

7.2 Personal data will be retained as required by law and destroyed or anonymized when no longer needed.

8. Data Disclosure

8.1 We may share your data with: Subsidiaries, affiliates, and platform users. Service providers and partners. Government authorities and entities involved in business transactions.

8.2 We may use your data without consent if permitted by law.

8.3 Pages may embed third-party video players (such as YouTube or Bilibili) for shop videos. When you play a video, that provider may collect data under its own privacy policy.

8.4 Users handling others' data must comply with Privacy Laws and allow data removal if requested.

8.5 Sellers must use buyer data only for transactions, protect it, and report breaches.

9. Children's Information

9.1 Our Services are not for children under 18. We do not knowingly collect data from them. If we do, we will delete it and close their accounts.

10. Third-Party Data Collection

10.1 We do not use Google Analytics. We use our own site statistics, which run only after you agree in the cookie banner at the bottom of the site; see section 15.

10.2 Third-party applications linked to our Platform may access your data. Review their policies separately.

11. Security and Third-Party Sites

11.1 We strive to secure your data but cannot guarantee absolute security.

11.2 We are not responsible for third-party sites linked from our Platform.

12. Data Transfer

12.1 Your data may be transferred and processed outside your country in accordance with privacy laws.

13. Access, Correction, and Consent Withdrawal

13.1 You may withdraw consent or request deletion by emailing [email protected]. Note that this may affect your use of our Services.

13.2 You can access or correct your data through your account settings or by submitting a written request. We may charge a fee for processing these requests.

14. Contact Us

14.1 For questions or concerns about our privacy practices, contact us at [email protected].

15. Cookies and Local Storage in Detail

15.1 We use the cookies and browser storage that are necessary to provide our services. Analytics cookies are used only with your consent. We do not use advertising or cross-site tracking cookies. Specifically:

· xoobay_session (cookie): keeps you signed in; expires after 30 days and is deleted when you sign out.

· xoobay_guest (cookie): keeps your shopping cart while you are not signed in; set the first time you add an item to your cart and expires after 90 days. When you sign in, the cart is merged into your account and this cookie is deleted.

· xoobay_site_session (cookie): keeps you signed in after you sign in on a store website with your email or a third-party account; valid only on that store’s web address, expires after 30 days and is deleted when you sign out.

· xoobay_oauth_state (cookie): when you sign in to a store website with Google, Facebook, X, Microsoft, GitHub, LinkedIn or Discord, confirms that the sign-in request came from you; expires after 10 minutes.

· xoobay_store_preview (cookie): set only when a store owner opens the preview link of a store website that is not yet live, so the owner can view it; valid only on that store’s web address and expires after 24 hours.

· xb_currency, xb_ship_to (cookies): remember the display currency and ship-to country you chose; expire after 1 year and are written only after you change these settings.

· NEXT_LOCALE (cookie): remembers the site language you are using; deleted when you close your browser.

· invite_code (cookie): records the invitation code when you arrive through an invitation link, so the inviter can be linked when you register.

· Recent searches (browser local storage): stored on your device only, never uploaded, and can be cleared at any time from the search box.

· AI assistant and store AI support conversations (browser session storage): the conversation shown on screen is kept in the current tab and cleared when you close it; the conversation is also stored on our servers as described in section 18.

· xb_consent (cookie): remembers your choice in the cookie banner or “Cookie settings”; expires after 1 year.

· xb_vid, xb_visit (analytics cookies, only with your consent): set only after you accept analytics cookies, to count visits: xb_vid is a randomly generated visitor number that expires after 1 year; xb_visit identifies the current visit and expires after 30 minutes of inactivity. Both are deleted if you withdraw your consent.

· Recently viewed products (browser local storage): stored on your device only, so you can quickly pick a product in the inquiry form (up to 12 products); never uploaded — a product link is sent only if you select it in an inquiry.

15.2 Analytics cookies are used only after you accept them through the banner at the bottom of the site or in “Cookie settings”. You can change or withdraw your choice at any time in “Cookie settings”; if you do not agree, we store nothing on your device for analytics. We do not currently use advertising cookies.

15.3 You can delete or block cookies in your browser settings. Blocking the necessary cookies above may prevent you from signing in or using the shopping cart.

16. Image Search and Search Records

16.1 Images you upload for image search are sent to our AI service provider (Alibaba Cloud) to generate image features used to find similar products. Uploaded images are kept for 90 days to review and improve search quality, and are deleted automatically afterwards. Please do not upload images containing identity documents, faces or other sensitive personal information.

16.2 We record search terms, the number of results and the language used, to understand popular searches and improve results. IP addresses are stored only as an irreversible digest for de-duplication; we do not store your original IP address.

17. Third-Party Sign-In

17.1 Sign-in on this site is provided by XOO Wallet (XOOWallet). When you sign in, XOO Wallet sets its own cookies and processes your account information under its privacy policy. We receive only what is needed to complete sign-in: your wallet address and verified email. Your nickname and avatar are fetched in real time for display and are not stored on our site.

17.2 Store websites (a store’s subdomain or its own domain) do not use XOO Wallet sign-in. You can sign in with an email code instead: we send a one-time code to the email address you enter (valid for 10 minutes; we keep only an irreversible digest of it), and once it is verified we find or create your account by that email address. The same email address is one account across XOOBAY and all store websites, with shared orders and shipping addresses. We record which store website you signed up on.

17.3 You may also sign in to a store website with your Google, Facebook, X, Microsoft, GitHub, LinkedIn or Discord account (using the store’s own app on that platform, shown only if the store has set it up). From these platforms we receive only your account ID, your name and the email address the platform has confirmed (no email address is used when you sign in with X or Microsoft), which we use to identify your account. We never receive your password for these platforms and never post anything on your behalf. These platforms process your information under their own privacy policies.

17.4 When you pay on a store website that has set up its own payment methods, your payment goes directly to that store. Card payments are processed by Stripe and PayPal payments by PayPal; your card and payment details are collected by these providers and do not pass through our site. For offline methods such as bank transfer or cash on delivery, you pay following the store’s instructions and may leave details such as the payer name or transfer reference for the store to check. To complete a payment we share the order number, the amount and your email address with the store’s payment provider. The store is responsible for the money it receives and for refunds; XOOBAY helps resolve disputes.

17.5 When you sign up on a store’s website or place an order with a store, that store can see in its “Customers” page your name, full email address, how and when you signed up, and the number of paid orders, amount spent and last order date with that store. It uses this to contact you and handle orders and after-sales service, and may add tags and notes about you that only the store can see. Stores cannot see your wallet address, points, or your orders with other stores.

18. AI assistant, store AI support and inquiries

18.1 When you use the XOOBAY AI assistant or a store’s “Ask this store” (store AI support), we store your questions, the AI’s answers, the language used and a randomly generated conversation ID. If you are signed in, the conversation is linked to your account; if you are not signed in but have used the cart, it is linked to the cart cookie (xoobay_guest).

18.2 We use these conversations to generate answers, to understand context within the same conversation, to check answers for accuracy and improve the service, to prevent abuse, and to count how many inquiries the AI assistant leads to.

18.3 Conversations with a store’s AI support can be viewed by that store’s seller in the seller center, so they can see what buyers ask about. XOOBAY staff can view all conversations when needed for their work. The seller can also take over the conversation in “Live chat” and reply to you directly; the AI then stops answering until the seller hands it back or ends the chat. If you and the seller use different languages, messages are translated by AI.

18.4 To generate answers, your questions and the relevant product and store information are sent to our AI service providers for processing. We only send what is needed to generate an answer and do not deliberately send your name, email address, wallet address or other account details.

18.5 Inquiries you send to sellers or to XOOBAY are analysed by AI (to judge purchase intent, write a summary and detect spam), and sellers may use AI to draft replies. A reply is only sent after the seller confirms it. Inquiries and sellers’ replies may be translated by AI into the other party’s language. Product reviews you post are shown publicly (you can post anonymously); reviews and seller replies are translated by AI into the site’s other languages and shown to visitors in their language, labelled “Translated by AI”, with the original always available.

18.6 AI conversations are kept for 180 days after the last message and then deleted automatically. Please do not enter ID numbers, bank card numbers, passwords or other sensitive information in a conversation. You can email [email protected] to ask to see or delete the AI conversations linked to your account.

19. Shopping activity records

19.1 To improve product recommendations, we record some of your actions on the site: adding to cart, saving a product to favorites and sending an inquiry, together with the time and the product involved. If you are signed in, these records are linked to your account; if you are not signed in, we do not record anything that identifies you.

19.2 If you accept analytics cookies, we record the pages and products you view on the XOOBAY marketplace and on store websites, which website brought you to us (for example a search engine, social media or an AI assistant), the country or region derived from your IP address, and your device type, browser and language, to measure traffic and improve our services. We also link any add-to-cart, favorite, inquiry or order made during the visit to that visit to calculate conversion rates, and if you reached a store by searching on the XOOBAY marketplace, we record the search term. We do not store your IP address. Stores can see aggregated traffic for their store pages, product pages and store website in their seller dashboard (number of visitors, sources, countries and so on), but cannot see who any individual visitor is.

19.3 We do not combine these records with data from other websites. Activity records and traffic statistics are deleted automatically after one year.

20. Invoices, after-sales evidence and order notifications

20.1 The billing details you enter on the order page (company name, VAT or tax number, billing address) are printed, together with your shipping details and the order items, on the proforma or commercial invoice issued by the seller. The seller can view and download that invoice. Once a commercial invoice is issued its content no longer changes; it is kept with the order record for the seller’s bookkeeping and customs needs.

20.2 Photos you upload when requesting a refund or return, asking XOOBAY to review a case or reporting a missing refund are kept as evidence in the record of that request. The seller and XOOBAY customer service can view them to assess and handle your request; evidence uploaded by the seller (for example a screenshot of a refund transfer) is visible to you as well. Evidence is kept together with the after-sales record.

20.3 Notifications about your orders (order placed, payment, shipping and after-sales) are sent to the email address on your account in the language you used when placing the order, and are also added to your on-site messages. For orders placed on a store website, notifications are sent in the store’s name and replies go directly to that store.

20.4 Inquiries you send while signed in are linked to your account. The inquiry, the quantity, target price, destination country, required delivery time and attached images you provide, together with the seller’s replies and quotes, are kept under “My inquiries” and can be viewed by the seller and XOOBAY customer service. Inquiries sent without signing in from the same email address also appear there once you sign in. Your chats with store assistants while signed in are shown in your account as well and are kept for the period described in section 18. The “Country / region” field on inquiry forms is preselected from your IP address (worked out only when the form opens; we do not store your IP address), and you can change it.

20.5 Messages you send through “Contact support”, or when the AI assistant hands you over to a person (your name, email address, your question, any order numbers you mention, and your conversation with the AI assistant before the handover), are kept and can be viewed by XOOBAY customer service to handle your request; staff also record internal notes and progress. So that staff who speak other languages can understand it, your message and that AI conversation may be translated by AI, and the translations are kept with the message. Replies may be translated by AI into your language before they are sent to you, and the original is kept as well. Replies are sent to the email address you gave and, if you are signed in, also added to your on-site messages.

21. Store staff

21.1 Stores can invite staff to help run them. When a store owner enters a staff member’s email address (and an optional display name) in the seller center, we send an invitation to that address. After the staff member signs in with their own XOO Wallet and accepts, the owner can see their email address, display name, member name, role and joining date under “Staff”. Staff can only open the pages their role allows, and on those pages they see the same orders, customer and inquiry details as the owner. Removed staff lose access immediately; invitation and staff records are kept for security checks and dispute handling. To ask for deletion, email [email protected].

22. Coupons, shopping points and marketing emails

22.1 Coupons you claim, the coupons and shopping points you use on orders, and your points earned and spent are stored with your account to calculate order amounts, handle refunds and prevent abuse. A store can see which of its store coupons were used on its orders, but not your points balance. Shopping points can only be used on XOOBAY marketplace orders and cannot be withdrawn.

22.2 We send marketing emails from XOOBAY or from a store only if you opt in (at checkout or in your profile; the box is unticked by default). A store can only email customers who subscribed to that store and sees no account details beyond the subscriber’s email address. If you subscribe to XOOBAY emails, we may also remind you about items left in your cart or price drops on items you saved. Every marketing email has an unsubscribe link, and you can turn subscriptions off in your profile at any time; order, account and after-sales emails are not affected.

22.3 When you tap “Notify me when it’s back” on an out-of-stock item, we record the request and send one email when it is back in stock. When you save an item to favorites, we note its price at that time to detect price drops. Records of marketing emails sent are deleted after 1 year; unsubscribe records are kept so that we do not email you again.

22.4 Your “Compare” list, like “Recently viewed”, is stored only in your browser’s local storage and is not uploaded to our servers.

23. Account and store activity records

23.1 To keep accounts secure, handle disputes, prevent fraud and improve our services, we record the important actions you take on XOOBAY while signed in: signing in and out, changing your profile and delivery addresses, placing and cancelling orders, confirming receipt, writing reviews and requesting after-sales service. If you run a store (including store staff and people managing a store on the platform’s behalf), we also record actions taken in the seller center, such as creating or editing products (prices, stock, listing status), changing the store profile, payout account and payment methods, inviting or removing staff, shipping orders, handling after-sales requests, requesting withdrawals, setting up promotions and marketing emails, and publishing the store website and store content, together with what was changed before and after. Keys and tokens are never recorded in clear text, bank account numbers and wallet addresses keep only their last 4 characters, long texts such as product descriptions are recorded only by length, and the contents of delivery addresses are not recorded.

23.2 Each record also keeps the time, a truncated IP address (for IPv4 only the first three parts, for example 203.0.113.*; for IPv6 only the first 48 bits) and the type of browser and operating system (for example “Chrome / Windows”). We do not store the full IP address or browser identifier. These records are necessary to protect accounts and transactions and do not depend on the analytics cookies described in section 15; the visit statistics in section 19 still do not store IP addresses.

23.3 Store activity records are kept for 7 years, in line with business record-keeping requirements; members’ own account activity records are kept for 1 year. Records are deleted automatically when these periods end. Only authorised XOOBAY staff can view them, to investigate security issues, handle disputes and complaints, detect unusual activity (for example alerting staff to check when a payout account is changed or many products are sharply discounted), and analyse how merchants and members use our services in aggregate in order to improve them. Stores cannot see members’ activity records. To ask about or request deletion of records about you, email [email protected]; records we must keep to handle a dispute or meet a legal obligation may not be deletable before the retention period ends.

Last updated: October 23, 2026