Version: 1.0 Effective date: 9 October 2026
1. Who we are
XEWI is provided by KF Premium LTD, a company registered in England and Wales (company number (to be confirmed)), registered office (to be confirmed) ("we", "us"). ICO registration number: (to be confirmed).
Contact for anything about your personal data: privacy@xewi.app.
This notice explains how we handle personal data when you visit our website, create an account, or use the XEWI platform (the "Service").
2. Our two roles
- We are the controller of personal data about you as our customer or website visitor: your account, login, billing and support data, and how you use the Service.
- We are a processor of personal data contained in the data you connect from Amazon, for example your buyers' details in order and VAT reports. For that data, you (the seller) are the controller, and we process it only on your instructions under our Data Processing Addendum. If you are one of a seller's customers, please contact that seller about your data.
3. Personal data we collect as controller
| Category | Examples | Source |
|---|---|---|
| Account | Name (optional), email address, password (stored hashed by our authentication provider), sign-in method (email, Google, GitHub or Login with Amazon) | You, or the sign-in provider you choose |
| Amazon connection | Your seller and advertising account identifiers, marketplaces, and the access credentials Amazon issues when you connect | Amazon, when you authorise the connection |
| Usage and content | Settings, products and markets you track, approvals and rejections, workflows you build, messages you send to the assistant, exports you create | You, through the Service |
| Billing | Plan, subscription dates, payment status and payment-provider customer references (we do not store card details) | You and our payment provider |
| Technical and security | IP address, browser and device information, request logs, security events | Automatically, when you use the Service |
| Support | What you send us when you contact us | You |
4. Why we use it, and our lawful basis (UK GDPR Art. 6)
| Purpose | Lawful basis |
|---|---|
| Create and run your account; provide the Service, including connecting to Amazon and carrying out actions you approve or automations you enable | Performance of our contract with you |
| Take payment and manage your plan | Contract; legal obligation (tax and accounting records) |
| Keep the Service secure, prevent fraud and abuse, and enforce our terms | Legitimate interests (protecting our customers and our business) |
| Improve the Service, including aggregated and de-identified analysis of how features perform | Legitimate interests (developing a better product), balanced against your interests |
| Send service messages (security, billing, changes to terms) | Contract; legitimate interests |
| If you are a Silent Tribe member and switch on "Share summary" in Settings: let our Silent Tribe programme team see a summary of your account figures, so they can coach you (see section 6) | Consent, which you can withdraw at any time with the same switch |
| Send marketing emails | Consent, which you can withdraw at any time. |
| Comply with the law and respond to lawful requests | Legal obligation |
5. AI processing
The Service uses AI to draft listing copy, generate images, explain analysis and power the assistant, as described in our AI Use Policy. In short:
- AI providers receive only what a task needs. This includes messages you type into the assistant, which are also stored so the conversation can continue.
- We do not send your buyers' personal data to AI providers.
- When the assistant searches the web, your question is sent to our web search provider.
- No decision with legal or similarly significant effects on you is made solely by automated means. Money and listing changes prepared by AI wait for your approval.
6. Who we share it with
We share personal data only with:
- Our sub-processors, who host and run parts of the Service for us, under written contracts. The current list, what each receives and where it is located is in our Sub-processor List.
- Amazon, when you connect your accounts and when approved actions or enabled automations are sent to it. Amazon processes that data under its own terms and privacy notice.
- AI clients you connect yourself. If you connect your own AI assistant (for example, a Claude client) to XEWI through our MCP connection, we send it the data it requests on your instruction.
- Our Silent Tribe programme team, only if you switch it on. If you are a Silent Tribe member, Settings → Profile has a "Share summary" switch. It is off until you turn it on, and you can turn it off at any time; the team loses access at once. While it is on, the programme team at KF Premium can see a summary XEWI calculates each night: your programme stage as your data shows it, sales and units for the last 30 days, advertising spend and TACOS for the last 30 days, how many products are out of stock or low, whether your data is up to date, and alerts (Amazon disconnected, old data, out of stock, no ads). They never see your buyers' data, individual orders or addresses, your Amazon or Amazon Ads credentials, your listings, costs, notes or conversations in XEWI, or any comparison with other members. We record each time a team member views your summary.
- Professional advisers, authorities and successors, where the law requires it, to protect our rights, or if our business is sold or restructured (you will be told).
We do not sell personal data.
7. International transfers
Our core infrastructure (AWS and our database provider) is located in the UK (London, AWS region eu-west-2). Some sub-processors, including AI providers, process data in the United States or elsewhere. When personal data is transferred outside the UK, we use an approved safeguard:
- UK adequacy regulations (including the UK-US data bridge for certified US companies); or
- the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the relevant safeguard.
8. How long we keep it
| Data | Retention |
|---|---|
| Account, usage and Amazon data (including buyer data in reports we process for you) | While your account is open. When you close your account, we disconnect Amazon at once and permanently delete this data 30 days later, including from our data lake and file storage. Signing back in during those 30 days cancels the deletion |
| Shared summary (if you switched sharing on) | Recalculated each night while sharing is on; deleted as soon as you switch it off |
| Records of programme-team views of your summary | While your account is open; deleted with your account |
| Assistant conversations | While your account is open; deleted with your account |
| Security and application logs | Up to 90 days. Logs do not contain raw email addresses or seller identifiers |
| Billing records | 6 years after the transaction (UK tax and accounting law) |
| Backups | Deleted data can remain in our database provider's encrypted backups until they are overwritten, within 7 days |
You can close your account in Settings → Security, or ask us to delete your data by emailing privacy@xewi.app.
9. How we protect it
- Data is hosted in the UK, encrypted in transit (TLS/HSTS) and at rest.
- Amazon access credentials are encrypted with a key held in AWS Secrets Manager.
- Each customer's data is isolated by tenant, with row-level security in our database.
- Personal identifiers are hashed in logs, and sensitive fields (such as buyer VAT numbers) are masked in responses.
- The Service sits behind a web application firewall with rate limiting, and runs threat detection and security scanning.
- Staff access is restricted to what their role needs.
No system is completely secure. If a breach affects your personal data, we will notify you and the ICO as the law requires.
10. Cookies
We use only strictly necessary cookies to keep you signed in, plus browser-storage settings for your preferences. There are no advertising or analytics trackers. See our Cookie Notice.
11. Your rights
Under UK data protection law, you have the right to:
- access your personal data;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to processing, including processing based on legitimate interests;
- receive your data in a portable format; and
- withdraw consent where we rely on it.
Email privacy@xewi.app. We will respond within one month. If you are a seller's customer, we will pass your request to the seller who controls your data and help them respond.
You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to deal with your concern first.
12. Children
The Service is for businesses and is not directed at anyone under 18.
13. Changes
We will post any update here and, for material changes, notify account holders by email or in the Service before it takes effect.