Privacy Policy

Last updated: October 1, 2026

xbbuy.net ("xbbuy," "we," "us," or "our") is operated by KSD LLC, a company registered in the United States. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website xbbuy.net and use our services.

If you use xbbuy from the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR), or the UK and Swiss law that mirrors it, applies to what we do with your personal data, because we offer our service to people there (GDPR Article 3(2)). KSD LLC is the data controller. You can reach us about anything in this policy at support@xbbuy.net.

1. Information We Collect

We collect information you provide directly:

• Account information: email address, display name, and password when you register

• OAuth data: name, email, and avatar from Google or Amazon when you sign in with one of those accounts

• Search queries: the product searches you perform

• Usage data: clicks, favorites, and search preferences

We automatically collect:

• IP address and approximate location derived from it

• Browser type and device information (user agent)

• Pages visited and time spent on the site

• Cookies for session management and analytics

2. How We Use Your Information

• To provide and maintain our product comparison service

• To personalize your experience (search history, favorites, recommendations)

• To process subscription payments via Stripe

• To send transactional emails (password resets, purchase confirmations)

• To send marketing emails (weekly product digests), only with your opt-in consent, with unsubscribe in every email

• To improve our service through aggregated, anonymized analytics

• To enforce our Terms of Service and prevent abuse

Why we are allowed to (our legal bases under GDPR Article 6):

• Performance of a contract with you: your account, the search and comparison service, the people and purchases you save, your subscription and the automatic searches it includes

• Our legitimate interests: keeping the service secure and free of abuse (rate limits, bot detection, address-based bans), keeping our emails deliverable (suppressing addresses that bounce or complain), and understanding how the service is used through aggregated statistics. You may object to any of these; see your rights below

• Your consent: analytics and advertising cookies and pixels, and marketing emails. Where you are decides whether the cookies and pixels wait for you to accept them or start on until you switch them off; section 4 sets out which, region by region. You can withdraw it at any time, and withdrawing does not affect anything done before

• A legal obligation: keeping payment and invoicing records for as long as tax and accounting law requires

3. Affiliate Disclosure

xbbuy.net is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com. When you click an Amazon product link on xbbuy and make a purchase, we may earn a commission at no additional cost to you.

Walmart product links on xbbuy are not affiliate links. We do not earn commissions from Walmart purchases.

4. Information Sharing

We do NOT sell your personal information. We share data only with:

• Stripe: payment processing (PCI-compliant, they receive only billing data)

• Amazon Web Services (AWS): infrastructure hosting (data stored in US-East-1)

• OpenAI (United States): the text of what you type into the search, and, when you search for someone you have saved, the details you saved about that person (their name or label, relationship to you, interests, sizes, budget, things they dislike or already own, gender, and an age worked out from a birthday you entered). This is what lets the AI understand the request and plan the search. We do not send your email address, your password or your payment details. OpenAI acts as our processor and does not use this data to train its models

• Microsoft (Microsoft 365 / Graph): sends our transactional and digest emails on our behalf, so it processes your email address and the content of those messages

• Law enforcement: only when required by valid legal process

• Meta (Facebook/Instagram), TikTok and Google (Analytics and Ads): advertising and analytics, as set out below.

Advertising and analytics, by region. We tell where you are from your browser's time zone, not from your IP address, so a VPN does not change it; setting your device to another time zone does, and so does travelling with a clock that sets itself. Before you choose anything:

You can change your choice at any time with the cookie settings, which the "Do Not Sell or Share" button in section 5a opens. Where Google's cookies are off, its tag still loads and sends Google measurements without cookies (the page, the event and your browser details), with no identifier stored on your device.

What they receive. While they are on, Meta, TikTok and Google receive the pages you view on xbbuy.net, the words you type into a search (the first 100 characters), your clicks through to a store, the start of a checkout (the plan and its price), a sign-up and a purchase, together with your IP address, browser information and their own cookie identifier. They use this to measure and target ads.

From our server. When you create an account, pay for a plan, or a subscription renews, our server also reports that event directly to Meta and TikTok, for each network where we have switched this on. The report carries a SHA-256 hashed copy of your email address and of your account ID, which they use to match the event to an account on their platform, and for a payment the amount. For a sign-up or a first payment it also carries your IP address, browser information and the ad click identifiers and cookies from your visit; to report a first payment we keep those for 72 hours from checkout. We send it only when marketing is allowed for you. At sign-up and checkout that is the last cookie choice recorded for your browser and internet address or, if there is none, the Meta or TikTok pixel having run for you (in the United States it runs until you switch it off). For payments and renewals it is the choice recorded on your account at sign-up or checkout, which a cookie choice you make while signed in updates.

Links to stores. A link to Amazon carries our Amazon Associates tag and a short campaign tag: the source that brought you to xbbuy (for example the name of an ad campaign) and the page you first landed on. Walmart links that go through Walmart's affiliate network carry the same campaign tag. This is the same in every region and does not depend on your cookie choices. The tag holds no name, email address or account ID.

Under California law, letting an advertising network observe your browsing in this way counts as "sharing" personal information for cross-context behavioural advertising, even though no money changes hands and we never sell your data. Section 5 explains how to turn it off, at any time.

International transfers. KSD LLC is based in the United States, so if you use xbbuy from elsewhere your personal data is processed there, by us and by Stripe, Amazon Web Services, OpenAI, Microsoft, Meta, TikTok and Google. Where the recipient is certified under the EU-U.S. Data Privacy Framework we rely on that certification; otherwise we rely on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards in place for any recipient.

5. Your Rights in the EEA, the UK and Switzerland (GDPR)

You have the right to:

• Access the personal data we hold about you, and receive a copy of it

• Have inaccurate data corrected

• Have your data erased. You can delete any saved person, any purchase record, or your whole account yourself from your profile at any time; deleting the account removes your data from our systems

• Restrict how we use your data while a question about it is being resolved

• Receive the data you gave us in a machine-readable form (portability)

• Object to processing we base on our legitimate interests, and to direct marketing at any time (every marketing email carries an unsubscribe link)

• Withdraw a consent you gave, at any time, using the cookie settings button below or the unsubscribe link

• Complain to a supervisory authority: the data protection authority of the EEA country where you live or work, or where you believe the problem happened; in the UK, the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch)

To exercise any of these, email support@xbbuy.net. We answer within one month, and we will tell you if we need longer for a complex request. We do not make decisions about you by automated means that have legal or similarly significant effects; personalisation only changes the order in which products are shown to you.

People you save. When you save a person (a child, a partner, a friend) and what they like, you give us information about someone who did not give it to us. We use it only to shop for them on your behalf, we keep it for as long as your account exists (see section 9), and we share it with OpenAI as described in section 4. If you type it into a search while advertising and analytics are on for you, the words of that search also reach Meta, TikTok and Google, as section 4 describes. Please make sure the people you save are comfortable with this. They may write to support@xbbuy.net to ask what we hold about them or to have it removed.

5a. Your Rights (CCPA / State Privacy Laws)

If you are a California resident or resident of another US state with privacy legislation, you have the right to:

• Know what personal information we collect and why

• Request deletion of your personal information

• Opt out of the sale or SHARING of personal information. We do not sell data, but the advertising pixels in section 4 are "sharing" under California law, and you can switch them off below.

• Non-discrimination for exercising your privacy rights

To exercise these rights, contact us at support@xbbuy.net. We will respond within 45 days.

That opens your cookie choices. Turning "Marketing" off stops the advertising pixels immediately, on this device, and you can change it again whenever you like.

6. Children's Privacy (COPPA and GDPR)

In the EEA, only a person aged 16 or over (or the lower age your country has set, never below 13) can consent to the cookies and marketing described here; a younger person needs a parent's consent. xbbuy is not directed to children under 13. We do not knowingly collect personal information from children under 13. Our platform includes content moderation that blocks inappropriate queries. If we learn we have collected data from a child under 13, we will delete it immediately. Parents may contact us at support@xbbuy.net.

7. Cookies

We use essential cookies for authentication (JWT session tokens), and the analytics and advertising cookies described in section 4, which start on or off depending on your region. Our cookie banner and the cookie settings let you accept or decline them, and you can also control cookies through your browser settings.

8. Data Security

We protect your data with HTTPS encryption, bcrypt password hashing, JWT authentication tokens, and AWS infrastructure security. Payment data is handled entirely by Stripe and never touches our servers.

9. Data Retention

Account data is retained as long as your account is active. Search history is retained based on your subscription tier: 30 days on Free, 1 year on Family, and kept until you delete it on Pro.

Some records have fixed lives whatever your tier: the structured reading the AI makes of each search is deleted after 180 days, usage counters after 90 days of inactivity, and anonymous visit events after 30 days. Payment records are kept for as long as tax and accounting law requires.

The people you save, what you record about them, and your purchase history are treated differently from search history. They are kept for as long as your account exists, on every tier including Free, and they are not deleted when a paid plan ends or is cancelled. Ending a subscription pauses the automatic searches and price checks we run for you; it does not remove what you have saved. You can delete any person, any purchase record, or your whole account at any time, and you can request full data deletion by contacting support@xbbuy.net.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or a prominent notice on our website. Continued use after changes constitutes acceptance.

11. Third-Party Data Attribution

IP-to-region lookups powering our "Trending in your state" feature use the free DB-IP IP-to-City Lite database, available from https://db-ip.com under CC-BY 4.0. We never persist your inferred state - it's computed in-request and replaced on every page load.

12. Contact Us

KSD LLC 9169 W State St #4453 Garden City, ID 83714 United States Phone: +1 (707) 401-4517 Email: support@xbbuy.net Website: https://xbbuy.net