Privacy Policy
Last updated: October 2026 · Zixo Homes Ltd · ICO Registered
1. Who We Are
Zixo Agent is operated by Zixo Homes Ltd (Company No. 16143515), registered in England and Wales at Boston Commercial Centre Limited, William Garfit Walk, 116 High Street, Boston, PE21 8TG. For privacy matters, contact: hello@zixoagent.com
2. What Data We Collect
Account data: Email address, name, country, business type — collected on registration via Supabase Auth. Business data: Products, suppliers, orders, listings — stored in your browser (localStorage) and optionally synced to Supabase. Usage data: Basic analytics on feature usage (no personal browsing data). Marketplace connections: When you connect a marketplace account (e.g. eBay, WooCommerce), we store the OAuth access tokens needed to act on your behalf. We never see or store your marketplace passwords. We do NOT collect: Payment card details (handled by Stripe) or marketplace passwords.
3. How We Use Your Data
• To provide and improve the Zixo Agent service • To send important service notifications • To process subscriptions via Stripe • To comply with legal obligations We do NOT sell your data to third parties.
4. Data Storage
Your account data is stored securely in Supabase (EU West — Ireland) with row-level security. Only you can access your own data. Your business data (products, orders etc.) is stored in your browser's localStorage and synced to your private row in our Supabase database so you can access it across devices. When you use AI features, your request and relevant business data are processed by our servers and passed to Anthropic's API to generate the response. We do not store your AI conversations on our servers, and your data is not used to train AI models.
5. Third-Party Services
We use the following third parties: • Supabase — authentication and database (EU) • Vercel — hosting (EU) • Anthropic — AI processing (via our servers) • Stripe — payment processing (when billing is active) • Marketplaces you connect (eBay, Amazon, TikTok Shop, Shopify and others) — to read your listings and orders and to act on your behalf • Suppliers you choose (for example CJ Dropshipping, AliExpress) — to place and track the orders you approve Each has their own privacy policy. We choose GDPR-compliant EU providers where possible. International transfers: when you approve a supplier order, the delivery details for that order (your buyer's name, address and contact details as supplied by the marketplace) are sent to that supplier so the parcel can be shipped. Some suppliers, including CJ Dropshipping and AliExpress, are located outside the UK and EEA. This transfer is necessary to perform the order you have asked us to place. We send only what is needed to ship the parcel.
6. The Zixo Browser Extension
The Zixo browser extension (Chrome, Firefox) is covered by this policy and is operated by the same data controller named in section 1. Where it runs: only on the marketplace product pages it supports — Amazon, eBay and AliExpress — and on zixoagent.com. It does not run on any other website, it cannot see any other tab, and it does not read your browser's history. What it reads: on a supported product page it reads the details needed to identify that product — the title, the main photo, the price and the product identifiers (ASIN, GTIN/EAN, MPN). These are sent to our own API to look up what the same product sells for elsewhere and where it can be sourced. The panel opens by itself when you land on a supported product page; you do not have to click anything. We do not store the rest of the page, and no request is made from those pages to anyone but us. What we keep, and why: we keep a record of which supported product pages you opened, and whether you went on to look for a supplier or — on a supplier page only — to send the product to Zixo. Products are never imported from Amazon or eBay pages; there the extension only compares prices. We do this so Zixo can tell every seller what is genuinely starting to sell, rather than guessing — it is the same reason section 7 exists, and it is covered by the safeguards described there. This record is held against your account for 90 days and then deleted; only the aggregated, anonymous counts in section 7 outlive it. It is never shown to anyone as your activity. You can switch this off at any time in Settings → Data Management, and while it is off nothing is recorded in the first place. What it stores: if you are signed in to Zixo Agent, the extension keeps your Zixo session token in the browser's own extension storage so you are not asked to sign in on every product page. That token stays on your device and is sent only to zixoagent.com, as the authorisation header on the requests described above. It is removed when you sign out and it goes with the extension when you uninstall it. What it does not do: there is no advertising code and no third-party analytics in the extension. It does not read pages other than the supported marketplace product pages and your own Zixo tabs, it does not read your browser's history, and nothing it reads is sold, rented or shared with any third party. It collects no name, email address, payment details or location.
7. Aggregated Market Insights
To tell you what is genuinely selling in the UK, we build aggregated signals from what happens across Zixo Agent, instead of relying on static third-party estimates. There are two, and we keep them apart because they mean different things: • What sells — built from orders placed across Zixo Agent users. This is evidence, after the fact. • What sellers are looking at — built from the products Zixo users open through the browser extension, and whether they went on to look for a supplier or, on a supplier page, send the product to Zixo. This runs ahead of the first signal and covers products nobody has listed yet. It is interest, not sales, and we never present it as sales. What this involves, and the limits that are enforced in our software rather than left to policy: • Counts only. The aggregation records how many units a term sold, or how many times it was looked at, and how many separate sellers were behind that. It does not record which seller sold or looked at what. • No buyer data whatsoever. Buyer names, addresses, order numbers and prices paid are not read by this process. • A minimum of three separate sellers. A term with fewer is dropped from the dataset completely, rather than shown with a masked or estimated figure — one seller's sales, or one seller's research, are that seller's business. • That minimum is applied to each figure separately. A product several people viewed but only one person tried to source will not report the sourcing. • A rolling 90-day window, rebuilt each night rather than accumulated, so nothing lingers after it stops being true. Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): improving the product research we provide to all users. We have weighed this against your interests, which is why the safeguards above exist. You may opt out at any time in Settings → Data Management. One switch covers both signals: your orders are excluded before the dataset is built, and your extension activity is not recorded at all — neither is filtered out of the display afterwards. Opting out does not limit any feature available to you.
8. Your Rights (GDPR)
As a UK/EU user, you have the right to: • Access your personal data • Correct inaccurate data • Delete your account and data (in the mobile app: More → Delete account) • Export your data • Object to processing • Withdraw consent at any time To exercise these rights, email hello@zixoagent.com
9. Cookies
Zixo Agent uses minimal cookies: • Essential cookies: authentication session (required) • No advertising cookies • No tracking cookies You can clear cookies at any time in your browser settings.
10. Data Retention and Deletion
Account data is retained while your account is active and for up to 30 days after deletion. The record of products you opened through the browser extension (section 6) is deleted 90 days after it is made. Only the aggregated, anonymous counts described in section 7 remain after that, and those are rebuilt each night rather than accumulated. Buyer personal data from a marketplace order — the buyer's name, delivery address and contact details — is kept only while it is needed to ship and support that order, and is deleted 30 days after dispatch. The order itself is not deleted: the sale price, order reference, date and tracking remain, because we are required to keep that financial record for six years. After the deletion we know the order happened and where the parcel went; we no longer know who bought it. Shopify stores: when you install Zixo Agent on a Shopify store, we keep the store's domain, name, currency and the access token Shopify issues, plus the orders for products you listed through Zixo (the buyer's name, delivery address and phone number, used only to fulfil and track them). We do not read your Shopify customer list. If you uninstall the app, the connection and its token are deleted at once and any Shopify-billed plan ends. 48 hours later, when Shopify asks us to erase the store's data, the buyer's identity is removed from all of that store's orders. When a Shopify buyer asks for their data to be erased, it is removed from their orders as soon as Shopify tells us; when they ask for a copy, we email you, the store owner, everything Zixo holds about them so that you can answer within 30 days. Settings → Clear All Data removes your business data from this browser and from our database. To delete your account entirely — login details, orders, suppliers, listings, settings and billing records — open the Zixo mobile app and go to More → Delete account. You will be asked for your password to confirm. Deletion is immediate and permanent, any active subscription is cancelled first, and it cannot be undone. If a supplier order has been paid for but not yet shipped, deletion is held until it ships, because your record is the only link between that spend and the buyer waiting for it. You can also email hello@zixoagent.com and we will complete deletion within 30 days as required by UK GDPR.
11. Children
Zixo Agent is not intended for users under 18. We do not knowingly collect data from children.
12. Changes
We may update this policy occasionally. We will notify registered users of material changes by email to hello@zixoagent.com.
13. Contact
Data Controller: Zixo Homes Ltd Email: hello@zixoagent.com Address: Boston Commercial Centre Limited, William Garfit Walk, 116 High Street, Boston, PE21 8TG, UK For GDPR complaints, you may also contact the Information Commissioner's Office (ICO) at ico.org.uk