Privacy Policy

Who we are and what this covers

XOrders is a platform for building and running online stores. This policy covers x-orders.com, the merchant dashboard, and stores hosted on myxorders.com and custom domains.

We act in two different roles: we are the controller of merchant account data, and a processor acting for the merchant when it comes to the data of shoppers who buy from their store. Each merchant is responsible for their own store policy towards their customers.

What we collect

• Account data: name, email, phone number, and a password stored as a hash, never in plain text.
• Store data: name, logo, products, prices, settings and the content you upload.
• Order data: buyer name, phone, delivery address and order contents — collected on the merchant’s behalf to fulfil the order.
• Payment data: we never receive or store card numbers. The payment provider handles them directly and returns a transaction reference, its status and the amount.
• Technical and usage data: IP address, browser type, pages visited, and the visit events behind store analytics.
• Support conversations: what you send us through support or the AI assistant.

Why we use it

• Running the service: creating the store, showing products, taking orders and sending system email.
• Billing: managing subscriptions, invoices and payments.
• Security and fraud prevention: detecting fake orders and protecting accounts.
• Improvement and support: understanding failures and answering your requests.

Who your data reaches

We use providers to run parts of the service. Each receives only what their function requires:

• Stripe and PayPal — payment and subscription processing.
• OpenAI, Google Gemini and Anthropic — AI features: the assistant, content and image generation, the order-address risk check inside fake-order detection, and the XReply reply assistant. This means your prompt text, a shipping address or conversation text may be sent to the provider at the moment you use those features.
• Meta Platforms, Inc. (“Meta”) — the Messenger, Instagram and WhatsApp Business Platform services, when a merchant connects their accounts to the XReply app (see the dedicated section below).
• Zoho Mail — system email and notifications.
• Hetzner — server and database hosting inside the European Union.
• Cloudflare — DNS, content delivery and attack protection.

Trackers the merchant enables

The platform supports adding Meta Pixel, TikTok, Snapchat and Google Tag Manager to a store. None of them run by default: the merchant switches them on for their own store, and from that point is responsible for disclosing them in their store policy and for collecting visitor consent where the law requires it. The platform never enables them on anyone’s behalf.

Connecting a Google account (Google Sheets app)

When a merchant connects a Google account to the Google Sheets app in the dashboard, we request a single permission — access only to the files the app creates or the merchant picks themselves (drive.file) — and use it only to create an orders spreadsheet or open the one the merchant selects in Google’s file picker, write the store’s orders into it and update their status. We cannot see any other Google Drive file, and we do not read email or contacts.

The data written to the sheet is the store’s own order data (order number, buyer name, phone and address, products, amount, status), with columns chosen by the merchant. The spreadsheet stays in the merchant’s own Google account.

The access tokens Google issues are stored encrypted in our database and are used only to perform the sync the merchant asked for. We do not sell Google user data or share it with third parties, we do not use it for advertising or to train AI models, and our staff do not read it except with the merchant’s consent for support, or where required for security or by law.

The merchant can disconnect at any time from the Google Sheets app in the dashboard, which deletes the stored tokens, or from their Google account permissions page: https://myaccount.google.com/permissions

XOrders’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

XReply: the store inbox for Messenger and Instagram

XReply is an optional app in the dashboard that brings a store’s Messenger and Instagram conversations and post comments into one inbox. Connecting a WhatsApp Business Platform number is not available yet and is coming soon; what follows about WhatsApp applies only once it is available and a merchant connects a number. Nothing below happens until a merchant enables the app and connects a Facebook Page, an Instagram professional account or a WhatsApp Business Platform number through Meta’s login dialog; Meta operates these services under its own terms and privacy policy.

What we access. When an account is connected we request only the permissions the inbox needs: for a Facebook Page, listing the Pages the merchant manages, reading and sending its messages, managing its notification subscription, and reading and managing the comments on its posts; for an Instagram account, basic account identity, reading and sending its direct messages, and reading and managing the comments on its posts; for a WhatsApp number, managing the business account and sending and receiving its messages. We then receive from Meta, for the connected account only: the account’s identity (ID, name, username or phone number); the messages customers send and the replies the store sends, including attachments, button selections and the ad a conversation started from; delivery and read receipts; message reactions (emoji); and the customer’s name and profile picture as Meta exposes them (first and last name or username and picture on Messenger and Instagram; the profile name and phone number on WhatsApp). Meta also notifies our app of comments on the connected Page’s posts and on the connected Instagram account’s posts. For comments written by others we store the commenter’s ID and name (or Instagram username), the comment text, the post ID and its type (and, for a Facebook post, its link), the comment it answers, when it was written and last changed, and whether the comment is hidden, and we show them in the inbox. When a commenter edits a comment on Facebook we update the stored text, and when they delete it we erase its text. Instagram does not notify us of edits or deletions, so an Instagram comment keeps the text first received until it is deleted with the account or on request. Apart from the fourteen-day processing queue described below, we keep nothing else from these notifications, and we ignore Page post activity other than comments. When a Messenger or Instagram account is connected, its earlier conversation history is imported into the inbox. From the inbox, the merchant or their team can reply publicly to a comment, send the commenter one private message within the seven days Meta allows after the comment was written, hide or unhide a comment, and like it (Facebook only); we store the text of those replies and the outcome of each action. We only post on the merchant’s behalf when the merchant or their team chooses to reply, hide or like from the inbox; we never post on our own, and we do not read anything outside the connected account.

Access tokens. The access tokens Meta issues are stored only in our database, encrypted at the application layer with AES-256-GCM and bound to the one store and account they belong to; they are decrypted only when our servers call Meta on the account’s behalf, and never appear in logs or API responses. The merchant can disconnect an account at any time from the XReply app: we ask Meta to unsubscribe our app from the account, delete the stored token (and the WhatsApp number’s PIN), and discard any of its notifications not yet processed. Removing XOrders from the Facebook, Instagram or WhatsApp business settings invalidates the token at Meta so it can no longer be used; write to us to have the remaining connection record deleted.

Message content and retention. Customer messages and comments, the store’s replies, delivery and read receipts, reactions and contact names and pictures are stored in our database so the merchant can read and answer them and see what was delivered and read. Files the store sends from the inbox are kept on our servers for thirty days and then deleted; the message keeps only the attachment description. Customer WhatsApp media is not copied to our servers: it is fetched from Meta only when the merchant opens it. Raw notifications from Meta are kept in a processing queue for fourteen days for reliability and then deleted. Conversations and comments stay for as long as the merchant’s account exists and are deleted with the account under the Security and retention section below, or earlier on a request that reaches us from the merchant, from the customer directly or through the merchant, or from Meta.

Optional AI reply assistant. A merchant may turn on an AI assistant that answers routine questions on Messenger and Instagram (products, prices, availability, shipping, returns and payment policies, and order status) from the store’s own data alone. It is off by default, runs only after the merchant explicitly accepts its terms in the dashboard, and does not cover WhatsApp. While it is on, the conversation text, the store facts the assistant answers from and, for an order-status question, the order details are sent to the AI provider XOrders has configured, OpenAI or Anthropic, under their API terms, which do not use this data to train their models; we do not use it for training either. Assistant replies carry a short notice that they are automated — on the first automated reply, after a gap of more than twelve hours, and after each hand-over to the team or reply by a person — and the merchant can pause the assistant for a single conversation or switch it off entirely at any time.

Processors for this feature: Meta (the messaging services and their APIs), the AI provider named above when the assistant is on, and Hetzner (hosting inside the European Union (Finland; backups in Germany)).

The merchant’s responsibilities. The merchant is the controller of their customers’ conversations and must comply with Meta’s platform terms and messaging policies, including the WhatsApp Business Platform rules: XReply sends a WhatsApp marketing template only to a contact who has opted in, and obtaining and documenting that consent is the merchant’s responsibility, as is replying within the messaging windows Meta allows.

Privacy requests about XReply data — access, correction or deletion — go to [email protected]. A store’s customers may also contact the merchant directly, and we help the merchant act on the request.

Cookies and local storage

• Session token: keeps you signed in. Required for the service to work.
• Interface preferences: language and light/dark theme, stored in your browser.
• Visit events: used for store analytics and never sold to anyone.

Security and retention

Traffic is encrypted with TLS, and credentials for external integrations (store and gateway keys) are stored encrypted. Internal access is restricted by role.

We keep account and store data for as long as the account exists. On deletion, data is removed or anonymised within a reasonable period, except what we must keep for accounting or legal reasons.

Your rights

You can request access to your data, its correction or deletion, or an export of your store data. Write to [email protected] from the address registered on the account and we will handle it within a reasonable period.

If you bought from a merchant’s store, that merchant is your first point of contact, and we can help them act on your request.

Children

The service is aimed at business owners and is not intended for anyone below the age of majority in their country.

Changes to this policy

We may update this policy and will change the date above. Material changes are announced by email or in the dashboard. Questions: [email protected]