Welcome to Xalista (the “Service”), operated by VantageLogic LLC (“we,” “us,” or “our”). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share information about you when you use our web application.
By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.
Information We Collect
We collect information you provide directly and information generated automatically through your use of the Service.
Account and Authentication
Xalista uses Google OAuth and Facebook OAuth for account creation and login. We do not store your Google or Facebook passwords. Upon successful authentication, we receive and permanently store only your name and email address as your user identifier. OAuth session tokens are held in memory during your active browser session only and are never written to our database or logs.
Payment Information
Billing details when you subscribe to a paid plan, processed via Lemon Squeezy. We do not store full credit card numbers or sensitive payment details on our servers.
Listing and Product Content
Photos, titles, descriptions, and related data you upload or generate for product listings. This includes:
- Photos captured from your device camera or selected from your Google Photos library.
- Photos uploaded to eBay as part of a submitted listing. Once transmitted to eBay, those images are hosted on eBay’s infrastructure and subject to eBay’s own terms and privacy practices. Deleting your Xalista account does not remove images already published to eBay.
- Imported eBay inventory — images associated with inventory imported directly from your existing eBay account remain hosted on eBay’s CDN. Xalista does not download, re-host, or process those images.
Fallback Photo Storage
If a photo upload to eBay fails during listing submission, the affected photo is retained in our secure cloud storage solely to enable retry of the upload. Fallback photos are not used for any other purpose and are deleted when the upload succeeds, when you delete the associated listing, or when you close your account — whichever occurs first.
Google Photos Data
When you use the optional Google Photos picker, we receive the file name, media URL, thumbnail URL, and MIME type of photos you explicitly select. We do not browse, scan, index, or access any photos you have not selected. See Section 05 for full Google API compliance details.
Information Collected Automatically
- Usage data — pages visited, features used, clicks, and error logs.
- Device & browser data — IP address, browser type, and operating system.
- Cookies — strictly necessary cookies for authentication and security only.
How We Use Your Information
- Authenticate your account via Google or Facebook OAuth.
- Provide, operate, and improve the Xalista AI listing engine and workflow tools.
- Transmit your product photos to Google Gemini for AI-powered item identification and structured attribute generation.
- Transmit the structured attributes produced by Gemini to Anthropic Claude to generate listing titles and descriptions.
- Submit completed listing drafts and photos to eBay via official API on your behalf.
- Source market price intelligence through third-party data aggregation services to support pricing suggestions.
- Process payments and manage your subscription and token balance.
- Send transactional emails such as account verification and password resets.
- Analyze usage trends to enhance features.
- Detect and prevent fraud or abuse.
We do not sell your personal data. Your listing photos, descriptions, and data are processed solely to facilitate your use of the Service and are not used to train public AI models without your explicit consent.
AI Processing & Sub-Processors
Delivering the Xalista listing pipeline requires transmitting your content to third-party AI providers. Each sub-processor receives your data solely to perform its designated function and is prohibited from using it for any other purpose.
Google Gemini
Your product photos are transmitted to Google Gemini to identify the item and generate structured attributes (e.g., brand, category, condition). Google does not use API-submitted data to train its general models.
Anthropic Claude
The structured attributes produced by Gemini are sent to Anthropic Claude to generate listing titles, descriptions, and draft copy. Anthropic does not use API-submitted data to train its general models.
Other Service Providers
- Supabase — database, authentication, and file storage.
- Vercel — web application hosting.
- Lemon Squeezy — payment processing and subscription management.
- Google Photos Picker API — optional photo import from your Google Photos library.
- Third-party market intelligence services — aggregated resale pricing data used to generate price suggestions.
A current list of sub-processors is available upon request at legal@xalista.com.
Payment Information
All payment transactions are processed by our Merchant of Record, Lemon Squeezy. We do not store full credit card numbers or sensitive payment details on our servers.
By making a purchase, you are also subject to Lemon Squeezy’s privacy policy.
Google User Data & Limited Use Disclosure
Xalista integrates with Google Photos via the Google Photos Picker API to let you select photos from your own Google Photos library for use in product listings. This section describes how we handle data received from Google APIs.
What we access
When you use the photo picker, we request the photospicker.mediaitems.readonly scope. This allows us to receive the file name, media URL, thumbnail URL, and MIME type of photos you explicitly select. We do not browse, scan, index, or access any photos you have not selected.
How we use it
Selected photos are downloaded and stored in our infrastructure to attach images to your product listings. Photos you select may be transmitted to Google Gemini for item identification and to Anthropic Claude for listing copy generation, as described in Section 03. We do not use Google user data for advertising, market research, or any purpose unrelated to providing the Service.
How we store it
When you select photos via Google Photos, we download and re-upload them to our secure storage infrastructure so your listings have permanent, reliable image URLs. We store the resulting image files and associated metadata (file name, MIME type). The original Google Photos URLs are not retained after transfer is complete. OAuth access tokens are held in memory during your active browser session and are never persisted to any database, file system, or log. If you delete a listing or your account, the associated images and metadata are deleted within 30 days.
Photo transmission to eBay
When you submit a listing to eBay, your selected photos — including those sourced from Google Photos — are transmitted to and hosted by eBay’s platform. At that point, those images become subject to eBay’s own terms of service and data practices. Xalista’s copy of the photo is deleted upon successful upload confirmation. Deleting your Xalista account does not remove images already published on eBay.
How we share it
We do not share Google user data with any third parties except as strictly necessary to provide the Service — specifically, transmission to Google Gemini for item identification, Anthropic Claude for listing copy, and eBay for listing publication. We never sell, lease, or trade Google user data.
Google API Services User Data Policy Compliance: Xalista’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We only use Google user data to provide and improve user-facing features of Xalista that are apparent to you in the application’s interface.
- We do not transfer Google user data to third parties unless it is necessary to provide or improve user-facing features, you provide affirmative consent, it is necessary for security purposes, or it is required to comply with applicable law.
- We do not use or transfer Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
- We do not allow humans to read Google user data unless we have obtained your affirmative consent, it is necessary for security purposes, it is required to comply with applicable law, or the data has been aggregated and anonymized in accordance with applicable requirements.
Revoking access
You can revoke Xalista’s access to your Google account at any time by visiting your Google Account Permissions page and removing Xalista. Revoking access will prevent future photo selection from Google Photos but will not automatically delete images already saved to existing listings or published to eBay. To remove Xalista’s stored copies, delete the relevant listings or your account.
Data Security & Storage
We implement industry-standard security measures to protect your data:
- Encryption at rest — All sensitive data is encrypted using AES-256 encryption within our Supabase database and storage infrastructure.
- Encryption in transit — All data transferred between your browser and our servers is encrypted via TLS/SSL.
- Access controls — Access to production data is limited to authorized personnel under least-privilege principles.
No method of transmission or storage is 100% secure. While we use commercially reasonable means to protect your data, we cannot guarantee absolute security.
Data Retention & Deletion
Active Account Data
We retain your account data (name, email, listing history) for as long as your account is active.
Photo Retention
- Device-uploaded or Google Photos-imported images — retained in our storage until the associated listing is deleted or your account is closed.
- eBay-submitted images — once successfully uploaded to eBay, our copy is deleted. Images hosted on eBay remain there subject to eBay’s policies.
- Fallback photos (failed eBay uploads) — retained solely until the upload succeeds, the listing is deleted, or your account is closed.
- Imported eBay inventory images — not stored by Xalista; hosted entirely on eBay’s CDN.
Account Deletion
If you delete your account via the Dashboard or by written request to legal@xalista.com, your personal data, active session tokens, listing history, and associated images will be deleted from our live databases and storage within 30 days. Some anonymized aggregate data may be retained for legal compliance purposes.
Backups and Logs
Encrypted backups and system logs may retain residual data for up to 90 days as part of standard infrastructure operations. This data is used solely for system integrity and disaster recovery and not for any business purpose.
Your Privacy Rights
Depending on your jurisdiction, you may have the following rights with respect to your personal data:
California Residents (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete, the right to opt-out of sale (we do not sell personal data), and the right to non-discrimination for exercising your rights. To submit a CCPA request, contact us at legal@xalista.com with the subject line “CCPA Request.”
How to Exercise Your Rights
To exercise any of the rights above, contact us at legal@xalista.com. We will respond within 30 days. We may need to verify your identity before processing your request.
Contact Us
If you have any questions about this Privacy Policy, how we handle your data (including Google user data), or wish to exercise your data rights, please contact: