Privacy policy

01Who we are

Xolt is a service of AUTHECT - FZCO, a company registered in Dubai under IFZA Trade License No. 70505, with its address at Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.

We are the controller of your account data. For the Amazon business data you choose to connect, we process it on behalf of your organization, to provide the service you asked for.

Xolt uses the official Amazon Selling Partner API with your authorization. Xolt is not affiliated with or endorsed by Amazon. Amazon, Seller Central and all related marks are trademarks of Amazon.com, Inc. or its affiliates.

02What we collect

Account data: your name, email address, a hash of your password, two-step verification settings, and your organizations, workspaces and roles.

Seller business data, only after you authorize it through Amazon: sales, traffic, fees, settlements, inventory, returns and listings for the accounts you connect. We do not request buyer names, addresses, emails or phone numbers. If a report contains such columns we drop them before storing anything, and we keep order IDs only as keyed hashes.

Data you enter: product costs, fixed costs and targets.

If you connect Google for Sheets export: an authorization limited to the spreadsheets Xolt creates in your Drive.

If you use the assistant on the public website ("Ask Xolt"): the name and email address you enter before your first question, with the moment you agreed.

Technical data: IP addresses for rate limiting and security, and error reports with personal data removed.

03Why we use it, and on what basis

To provide the service you signed up for (performance of our contract with you): sync your Amazon data, calculate profit and inventory metrics, write your monthly action plan, build exports and send the emails the service needs, such as sign-in, verification, invitations, re-authorization reminders and the monthly report you schedule.

To keep Xolt secure and working (our legitimate interest in protecting the service and our customers), and to meet legal obligations.

We do not sell your data, use it for advertising, or use it to train AI models.

04AI processing

The monthly action plan is written by Anthropic's API from aggregated findings only (product identifiers, titles and the related numbers). Raw reports, order data and buyer data are never sent, and Anthropic does not use the data to train its models. The assistant on the public site ("Ask Xolt") sends your question and the matching public help text to Anthropic's API to write an answer; nothing from any account is included and the conversation is not stored. We keep the name and email you gave before your first question, so a person can follow up, and token counts.

05Who processes data for us

We use a small set of sub-processors for hosting, the database, background jobs, encryption and storage, AI, email and error monitoring. The current list, with purpose and region, is on the Sub-processors page, and we update it before a new one starts processing customer data. We share data with others only if the law requires it.

06Where data is stored and international transfers

Our application, database and file storage run in the European Union (Frankfurt). Some sub-processors, such as the AI provider, may process data in the United States. Where data leaves the country it was collected in, we rely on appropriate safeguards such as the European Commission's standard contractual clauses and the transfer rules of UAE Federal Decree-Law No. 45 of 2021.

07How long we keep it

Seller data is kept while the Amazon connection exists. When you disconnect, sync stops at once, the authorization is wiped, and the data is deleted 30 days later unless you reconnect, or immediately if you choose.

Deleting an organization or your account removes its data at once. Sessions expire after 7 days of inactivity. Security audit records are kept for up to 2 years, and a minimal record that a deletion happened is kept to prove it.

The name and email you give the assistant on the public website are kept for 12 months, or until you ask us to delete them.

08Your rights

Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format and withdraw consent. These rights come from the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the EU General Data Protection Regulation, and the data protection laws of Saudi Arabia and Egypt.

You can export your organization's data, disconnect Amazon or Google, and delete your account or organization directly in the app. For anything else, write to privacy@xolt.io. We answer within 30 days. You can also complain to your local data protection authority.

09Security

We encrypt data in transit and at rest, encrypt authorizations with AWS KMS, isolate each customer's data in the database and require two-step verification for everyone. The Security page has the details. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as the law requires.

10Cookies

Xolt uses the cookies it needs to work: your sign-in session, the two-step verification step, your language and sidebar preferences, and your cookie choice. Page views on the public website are counted with Vercel Web Analytics only after you accept analytics in the cookie banner; it sets no cookies. No advertising or tracking cookies. The Cookie policy lists each one and how to change your choice.

11Children

Xolt is a business service and is not meant for anyone under 18.

12Changes to this policy

We will update this page and the date above when this policy changes, and tell account owners by email about material changes before they apply.

13Contact

AUTHECT - FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. Email: privacy@xolt.io. This policy covers Xolt; Authect's own website has its own privacy policy at authect.com/privacy.