Privacy Policy

2.1 Introduction

X Football ('we', 'us', 'our') is committed to protecting the personal data of everyone who uses our Platform. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights in relation to it. This Policy applies to data processed through xfootball.co and any associated mobile applications or services.

2.2 Data Controller

X Football is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Australian Privacy Act 1988 (Cth).

2.3 Data We Collect

Account Data

• Name, email address, and password (hashed)
• Billing and shipping address
• Phone number (optional)
• Profile photograph (optional)

Listing Data

• Item descriptions, photographs, and pricing information uploaded by Sellers
• Transaction history, sale prices, and payout records

Transaction Data

• Purchase history and order details
• Payment method information (held by Stripe, we do not store card data)
• Shipping and delivery records

Communications

• Messages sent through the Platform's messaging system
• Customer support correspondence
• Email communications

Device and Analytics Data

• IP address and approximate location
• Device type, browser, and operating system
• Pages visited, time on site, and clickstream data
• Referring URL

2.4 Legal Basis for Processing

• Contract performance: to operate your account, process transactions, and fulfil our obligations to you.
• Legitimate interests: to prevent fraud, improve the Platform, and conduct marketing to existing users.
• Legal obligation: to comply with applicable law, including tax and anti-money-laundering requirements.
• Consent: for marketing communications where required by law (you may withdraw consent at any time).

2.5 Third-Party Processors

• Supabase: database storage and user authentication (US-based)
• Stripe: payment processing and Seller payouts (US-based)
• Vercel: platform hosting and infrastructure (US-based)
• Resend: transactional email delivery (US-based)
• Klaviyo: marketing email platform (US-based)
• Google Maps API: address validation and location services (US-based)
• Shopify: sales-channel integration for Sellers who choose to connect a Shopify store (Canada-based). See section 2.12 for detail.

All processors are engaged under data processing agreements incorporating Standard Contractual Clauses for cross-border transfers from the UK and Australia.

2.6 International Data Transfers

Our key processors are based in the United States. Personal data transferred to the US is protected by Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office and, for Australian users, is transferred in accordance with APP 8 of the Australian Privacy Principles.

2.7 Data Retention

• Account data: retained for the duration of the account and 7 years after closure (for tax and legal purposes)
• Transaction records: 7 years from transaction date (legal/tax obligation)
• Marketing data: until consent is withdrawn or 3 years of inactivity
• Support communications: 3 years from last contact
• Analytics data: 26 months

2.8 Your Rights

UK Users (UK GDPR)

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction
• Right to data portability
• Right to object
• Right not to be subject to automated decision-making

Australian Users (Privacy Act 1988)

• Right of access
• Right to correction

To exercise any of these rights, email privacy@xfootball.co. We will respond within 30 days (UK GDPR) or a reasonable period (Australian Privacy Act).

2.9 Cookies

We use cookies and similar tracking technologies. For full details, see our Cookie Policy.

2.10 Security

We implement industry-standard security measures including encryption at rest and in transit, access controls, and regular security reviews. No method of transmission over the internet is entirely secure; we cannot guarantee absolute security.

2.11 Complaints

UK users may lodge a complaint with the Information Commissioner's Office (ico.org.uk). Australian users may lodge a complaint with the Office of the Australian Information Commissioner (oaic.gov.au). We ask that you contact us at privacy@xfootball.co in the first instance so we can attempt to resolve the matter directly.

2.12 Store Integrations (Shopify and Other Sales Channels)

Sellers may choose to connect a third-party sales channel — currently Shopify — so that their existing product catalogue can be listed on X Football and their orders kept in sync. Where a Seller connects such an integration:

• What we access: with the Seller's explicit authorisation, we access their store's product, inventory, and order and fulfilment data through the sales channel's official API. For Shopify this is limited to the product, inventory, order and fulfilment permissions the Seller grants when connecting.
• How we use it: to import products for the Seller to review and publish as X Football listings, to keep stock levels and listing status accurate, to create a corresponding order in the Seller's store when a sale is made on X Football, and to mark X Football orders as dispatched when the Seller fulfils them.
• Customer data: when an X Football sale is fulfilled through a connected store, we transmit the buyer's name and delivery address to that store solely so the Seller can ship the order. We do not import, store, or market to a connected store's own customer lists.
• Security: integration access tokens are encrypted at rest and transmitted only over secure connections, and all inbound data is verified for authenticity before it is processed.
• Retention and deletion: connection data and imported product data are retained only while the integration is active. If a Seller disconnects the integration or uninstalls the X Football app from their store, we delete the associated integration records and imported product data. We also honour the sales channel's mandated data-erasure requests (for Shopify, the customers/redact and shop/redact requests) within the required timeframe.

Sellers can disconnect a connected store at any time from their Seller Dashboard.

2.13 Changes to This Policy

We may update this Policy from time to time. Material changes will be notified to registered users by email. The current Policy is always available at xfootball.co/privacy-policy.