Xonbay Privacy Policy

Xonbay is a product of Dimarak Limited, which operates Xonbay and is responsible for the platform personal-data processing described in this Policy. Xonbay operates from Achimota, Accra, Ghana. This Policy explains how personal information is handled on www.xonbay.com, business.xonbay.com, Xonbay-hosted storefronts and related services. References to Xonbay’s handling of information mean Dimarak Limited acting as the platform operator. Contact privacy@xonbay.com or the Xonbay contact page for privacy questions and requests.

Xonbay is responsible for deciding how platform account, security, support, payment-status and marketplace activity data is used. A merchant is separately responsible for the customer and staff information it uses for its own business. Where we hold workspace data solely on that business’s instructions, the Data Processing Agreement describes that relationship.

Learn about Dimarak Limited at www.dimarak.com. For matters relating to Xonbay, use the Xonbay contact details in this document.

Providing information needed to register, complete an order or send a request is necessary for that action. Optional profile content and uploads are your choice. Avoid uploading identity documents, health information or other sensitive personal data unless a supported process specifically requires it. Do not include payment PINs or passwords in messages or files.

• Create and secure accounts, verify email addresses and manage authorised team access.
• Provide products, inventory, storefronts, order and in-house sales records, files and creative tools.
• Connect buyers and sellers, support fulfilment and reconcile verified payment and settlement statuses.
• Deliver requested messages, invitations, account notices and support responses.
• Provide business analytics, understand service performance and suggest relevant products based on shopping activity.
• Prevent fraud, misuse and security incidents and comply with applicable recordkeeping and legal obligations.
• Send newsletters or promotional communications to recipients who have given the required permission and honour unsubscribe requests.

We process personal data to provide the services you request, meet legal obligations, protect the service and pursue legitimate operational interests where the law permits, or with your consent where it is required. We use information for stated purposes and seek to keep it relevant and proportionate. If you withdraw consent, it does not affect processing already lawfully completed or information needed on another lawful ground.

A seller receives information needed to fulfil an order and provide customer service, such as buyer contact and delivery details. Delivery parties receive information needed for the selected fulfilment option. A business owner and team members with relevant permissions can access information within their workspace. Contact that business for questions about how it uses your details independently.

Published storefronts, product listings, reviews and content you intentionally share can be seen by their intended audience, including the public where published. Shared links and downloaded files may be forwarded by recipients. Private workspace files are not automatically public; check permissions and sharing options before distributing them.

For customer and staff data we process on a business’s behalf, see the Data Processing Agreement.

We use service infrastructure and providers for hosting, file storage and delivery, communications, supported sign-in and payment processing. Uploaded files use Amazon Web Services storage and content delivery. Online payments use Paystack where offered; payment providers handle payment credentials through their own flows. Xonbay records payment references and status needed to reconcile transactions.

We disclose information as needed to the transaction’s buyer, seller or delivery provider, to service providers carrying out their assigned functions, and where required by law or a valid regulatory or court process. Information may also be shared at your direction or with professional advisers for a specific legal or operational need. We do not give sellers authority to use buyer details for unrelated marketing.

Connecting Xonbay Business in ChatGPT is optional. You sign in to Xonbay, select a shop and approve the permissions shown during connection. Access is limited to that shop, the permissions you grant and your current shop role. Reconnecting does not add permissions unless you approve an authorization request that includes them.

At your direction, the integration can return shop and account context, product names, descriptions, prices, stock and images; order details, including buyer contact and delivery information where provided by the order tools; sales and visitor analytics; storefront settings and drafts; and Library file or folder details and file links. Creative Studio tools use shop products and images to create editable video drafts. Information returned by these tools is sent to ChatGPT so it can answer or carry out your request. Only request and share business or customer information you are authorised to use.

Xonbay receives the tool requests and arguments ChatGPT sends to the integration, including requested edits, draft content and file references. This is not access to your entire ChatGPT conversation history. When you choose an attachment to upload, Xonbay downloads the file using its temporary attachment link and saves the file, its name, type, size and source metadata in the selected shop Library using our file-storage infrastructure. The temporary attachment link is used to retrieve the chosen file. Uploads are subject to file-size and business storage limits.

To operate the connection, Xonbay stores the authorising user, selected shop, approved permissions, connection status and security records such as hashed authorization codes and tokens. For supported write requests, it keeps request identifiers and saved action results so retries can return the existing action rather than duplicate it. Files, products, order changes and Studio or storefront drafts created through the integration become ordinary Xonbay workspace records. Their retention and deletion follow the approaches described below; disconnecting does not undo completed changes or automatically delete those records.

OpenAI operates ChatGPT. Information returned to ChatGPT and attachments or prompts you submit there are handled under OpenAI’s applicable terms, privacy policy and your ChatGPT account settings, including any applicable data-retention or model-improvement settings. Xonbay does not control those settings or remove copies already held by OpenAI. Review OpenAI’s Privacy Policy and your ChatGPT data controls before sharing information.

You can disconnect Xonbay Business in ChatGPT’s app settings and contact Xonbay to request revocation of a connection. A revoked connection cannot make further authorised tool requests. To request deletion of Xonbay-held connection or workspace information, contact privacy@xonbay.com and identify the account, shop and records concerned. We verify the request and apply the retention and rights provisions of this Policy. Disconnecting does not delete information already returned to ChatGPT; manage that information through OpenAI’s privacy and account controls.

Xonbay’s first-party analytics records browsing, searches, product and shop interactions, cart and checkout activity, referral or campaign information and engagement measurements. Browser visitor and session identifiers distinguish visits; signed-in activity may also be linked to the account. This information supports platform and merchant analytics and personalised product suggestions. Where configured, IP-based lookup can provide an approximate visitor country; it is not a precise device-location reading.

The commerce event tracker skips event collection when your browser sends Do Not Track with the value 1. Clearing site storage resets browser identifiers but does not erase records already received. Product recommendations can still use an identifier or your account when you request them. For access, objections or deletion requests, contact us.

See our Cookie Policy for the browser technologies and available controls.

Xonbay is based in Ghana, but infrastructure and providers can process data in other countries. Storage location depends on the service and configured infrastructure; a selected Business country is not a guarantee that information stays in that country. International processing remains subject to applicable data-protection obligations and any required safeguards. Contact us if you need information about the location or handling of particular workspace data.

We assess retention by the purpose of the record and applicable obligations rather than promise a single period for all data. When data is no longer needed, it should be deleted or de-identified. Ask us about a particular record or request; we will explain if legal, security or transaction obligations prevent immediate deletion.

• Ask what personal information we hold about you and request access.
• Request correction of inaccurate information or deletion where applicable.
• Object to particular processing, including direct marketing, or request restrictions where applicable.
• Withdraw consent where processing relies on it and unsubscribe from newsletters using the message’s unsubscribe link.
• Request portability or review of a significant automated decision where applicable law provides that right.
• Complain to Xonbay or the relevant data-protection authority.

Email privacy@xonbay.com or use the contact page, describe your request and identify the account or transaction concerned. We may request proportionate verification to protect your information. If a business controls the relevant data, we may direct the request to it or assist it in responding. We explain any applicable limits or reasons information must be retained.

You can raise a privacy complaint with Ghana’s Data Protection Commission. You may also contact the competent authority where other applicable law gives you that right.

We use account authentication, permission controls, secure connections and operational measures to protect information. Security also depends on how you configure access, share files and protect your devices. No online service can guarantee absolute security. Report suspected unauthorised access or exposure promptly and do not send sensitive credentials with the report.

Xonbay accounts and commercial use are intended for people aged 18 or older. Do not register an account or operate a business if you do not meet that requirement. If you believe a child has provided personal information without appropriate authority, contact us so we can review it.

We may update this Policy when our services or handling of information change. The version and dates shown on this page identify the current policy. We communicate material changes through the service or another appropriate channel and seek any additional consent required by law.