Privacy Policy

Account data: email, password hash, display name, member level, registration and login times.

Transaction data: cart, wishlist, orders, shipping addresses, phone numbers, payment method, after-sale and review records.

Support data: chat messages, image or video attachments, and system notification read status.

Technical data: IP address, accessed domain, device and browser information, cookies, and access logs.

To create and manage accounts and prevent bot registration, abnormal login, and abuse.

To process browsing, cart, order confirmation, QC, delivery, after-sale, refund, and customer notifications.

To provide multilingual, multicurrency, translation, in-site messaging, and membership-level services.

To perform security audits, analytics, service improvement, and legally required retention.

Account data is retained until account deletion or for a necessary period after service termination.

Order, payment, delivery, tax, after-sale, and dispute records are retained as required by law or business necessity.

Browsing and cart activity records are retained for short periods according to site settings and then deleted or anonymized.

We may use delivery, payment, CDN, security, translation, push notification, hosting, and support providers to process necessary data.

Processors may use personal information only within the commissioned purpose and must apply reasonable safeguards.

Because the service is international, orders, support, servers, CDN, translation, and notification services may involve cross-border processing.

We process cross-border data only as necessary and require reasonable protection measures from service providers.

We use cookies for login status, language, currency, cart, unread messages, and security identification.

You may restrict cookies in your browser, but some account, order, and member functions may not work properly.

You may request access, correction, deletion, suspension of processing, or account withdrawal.

We may verify your identity before handling requests to protect account security.

If you choose Sign in with Google, Xlett requests only the basic identity scopes openid, email and profile through Google's authorization page. We receive your unique account identifier, email address and verification status, and the name and profile-picture URL supplied by Google. Xlett does not receive your Google password. This login feature does not access Gmail messages, Google Drive files, contacts or YouTube data.

We use this information to identify you, create or sign you into an Xlett account, link an existing account with the same email address, and display account details. Signed-in features include your cart, orders and support. Browsing products does not require login. Google sign-in is optional; Xlett email login is also available.

The account identifier, Google email, name (when creating an account) and profile-picture URL are stored in Xlett's server database. During sign-in, a short-lived access token retrieves identity information from Google. The current Google login implementation does not persist that access token in the database, request offline access or store refresh tokens. Xlett separately stores its own session cookie, login timestamps and IP addresses for session management and security.

Google sign-in information is used for the account and service purposes above. Authorized site administrators and providers of necessary hosting, security and account services may process it only as needed to deliver those services. We do not sell Google sign-in information or use it for targeted advertising. Information may also be disclosed to authorities when legally required.

Necessary account-linking information is retained while your account exists. Start account deletion from the Profile page in the member center, or email [email protected] to request access, correction or deletion. Account deletion clears the account's Google identifier, Google email and avatar association and anonymizes the member profile. Necessary transaction records and deletion-audit records containing the original email, nickname, login provider and deletion IP may remain for disputes, security and abuse prevention. Re-registration is blocked for 30 days after deletion; this does not mean all audit records are automatically erased after 30 days. Contact the email above about remaining records and deletion.

You can revoke Xlett's access at https://myaccount.google.com/connections Revoking Google access does not automatically delete your Xlett account or previously stored information, or end an existing Xlett session. Sign out or submit an account/data-deletion request separately if needed. Google's own data practices are described at https://policies.google.com/privacy

We use access control, password hashing, log audits, upload restrictions, real IP logging, and abnormal access checks.

For privacy requests, contact us through online support or [email protected].