Privacy Policy
XAgentStore — XGenTra Inc.
Effective Date: May 30, 2026
Last Updated: October 23, 2026
1. Introduction
XGenTra Inc. ("XGenTra," "we," "us," or "our") operates the XAgentStore marketplace at xgentra.com. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.
This Privacy Policy describes how we handle your personal information. By using the Service, you acknowledge that you have read and understood this policy. Where applicable law requires it, we will obtain your active consent before processing your personal information for purposes beyond those necessary to provide the Service (such as marketing communications, targeted advertising, or sensitive data processing). If you do not agree to this Privacy Policy, please do not use the Service.
Company Information
| Field | Detail |
|---|---|
| Legal name | XGenTra Inc. |
| State of incorporation | Delaware, United States |
| EIN | 37-2232749 |
| [email protected] | |
| Website | https://xgentra.com |
| Address | 131 Continental Dr, Suite 305, Newark, DE 19713, US |
2. Information We Collect
2.1 Information You Provide Directly
| Category | Examples |
|---|---|
| Account information | Email address, display name, profile photo |
| Payment information | Billing address, payment method details (processed by Stripe — we do not store raw card numbers) |
| Maker information | Payout account details for revenue settlement |
| Communications | Messages to customer support, feedback |
| Content | .xagt files and descriptions you upload as a Maker |
| Maker application | What you write when applying to become a Maker (what you can do, the xagt you want to make) |
2.2 Information Collected Automatically
| Category | Examples |
|---|---|
| Usage data | Pages visited, features used, search queries, purchase history |
| Device & log data | IP address, browser type, operating system, referrer URL |
| Cookies & tracking | Session tokens, preference cookies, analytics identifiers |
2.3 Information from Third Parties
- Clerk (Authentication): When you sign in, Clerk provides us with your verified email address and a unique user identifier. Clerk's privacy practices are at https://clerk.com/legal/privacy.
- Stripe (Payments): Provides transaction confirmations and billing data. We do not receive or store full payment card numbers.
- AI Service Providers: When using AI-assisted features (e.g., xagt Builder), your inputs may be processed by Anthropic (Claude API) or Google (Gemini API), subject to their respective privacy policies.
2.4 Records Created to Operate and Protect the Service
- Moderation records: account status (active, restricted, or suspended) and its reason; actions taken on accounts, listings, and purchases (including refunds issued by XGenTra and per-purchase access settings); the administrator who took each action; timestamps; and whether you acknowledged the related notice.
- Rejoin records: when an account is deleted, a keyed hash (HMAC) of its email address, not the address itself, together with the deletion date and the date from which re-registration is allowed (Terms of Service Section 3.6). The address cannot be recovered from the hash; we can only check whether an address entered later matches it.
- Distribution seals: when a file leaves the Service (for example, when you download a purchased file or your own build, or when a file is delivered through a share link), we embed in the file an encrypted record of its issuance, including the receiving account or link and the time of issue. Only XGenTra can read the recipient from the seal.
- Upload fingerprints: hashes (SHA-256) of the files you upload, used to detect re-uploads of removed content and duplicate listings.
- File verification: files you upload to our file verification page are checked and are not stored.
- Leak reports: if you report a file, we keep your account, the file's hash, where you found the file, and your note. The reported file itself is not stored.
- Verification history: when a sealed file is verified, we record a keyed hash of the IP address, the account (if signed in), the file's hash, the result, and the related product, purchase, or share link.
- Deletion requests: if you request deletion while your account is restricted or suspended, we record the date received, the due date, the status, and how the request was handled.
3. How We Use Your Information
| Purpose | Legal Basis (GDPR) |
|---|---|
| Account creation and management | Contract performance |
| Processing purchases and payouts | Contract performance |
| Sending transactional emails (receipts, alerts) | Contract performance |
| Providing customer support | Legitimate interest |
| Improving the Service (analytics) | Consent (only if you opt in to analytics cookies — see Section 5) |
| Fraud prevention and security | Legitimate interest |
| Enforcing our Terms and protecting the Service (account and listing moderation, rejoin restriction, detecting re-uploaded or leaked content, handling appeals and deletion requests) | Legitimate interest; Contract performance |
| Reviewing maker applications and showing the result | Contract performance |
| Sending marketing communications (opt-in only) | Consent |
| Complying with legal obligations | Legal obligation |
Access to account information in our administration tools, including email addresses, is limited to authorized staff who need it for support and moderation, and such access is logged.
4. Sub-processors and Infrastructure
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare | CDN, DDoS protection, edge network; routing of email sent to our support addresses into our customer support system | Global (US-based) |
| Cloudflare R2 | File storage (.xagt files; attachments of emails sent to our support addresses) | US / Asia-Pacific |
| Railway | Backend application hosting; hosting of our self-managed customer support system, which stores support conversations (your name, email address and the content of your messages) | US |
| Clerk | Authentication | US |
| Stripe | Payment processing | US |
| Resend | Delivery of our email replies to your support inquiries and of system emails from the support system (sent through Amazon Web Services' email infrastructure) | US (sending infrastructure in Japan) |
| Anthropic | Claude API (AI features) | US |
| Gemini API (AI features), Google Analytics (usage statistics — only with consent), Google Workspace (our company email, including receipt and archiving of email sent to our support addresses) | US |
All sub-processors are contractually required to maintain appropriate data protection standards.
5. Cookies and Tracking Technologies
| Type | Purpose | Duration |
|---|---|---|
| Essential cookies | Session management, authentication | Session |
| Consent cookie | Storing the choice you make in Cookie settings | 1 year |
| Preference cookies | Language, UI settings | 1 year |
| Analytics cookies | Aggregate usage statistics (Google Analytics) | 90 days |
| Marketing cookies | Targeted advertising — not currently used | N/A |
You can change your cookie preferences directly on this site, in Cookie settings. Choose from the consent banner shown at the bottom of the screen on your first visit, or reopen it later from [Cookie settings] at the bottom of this page or in the footer of the home page. Browser-level controls remain available as well. Disabling essential cookies may impair Service functionality.
Analytics cookies are set only if you opt in. Before you opt in, the analytics script is not loaded onto the page at all. The consent cookie that remembers your choice is treated as essential and is stored without opt-in.
Do Not Track / Global Privacy Control: We recognize browser-based Do Not Track (DNT) signals and Global Privacy Control (GPC) signals. When a valid GPC signal is detected, we treat it as an opt-out of the sale or sharing of personal information to the extent required by applicable law. Note that some third-party analytics and advertising partners operating on the Service may independently collect data across sites; please refer to their respective privacy policies for their DNT/GPC practices.
6. Data Sharing and Disclosure
We do not sell your personal information. We may share your information in the following circumstances:
- Service Providers: With sub-processors listed in Section 4, solely to operate the Service.
- Makers: If you purchase a
.xagtfile, the Maker may receive your country/region and purchase date for fraud prevention — not your name or email unless you choose to share them. When a Maker verifies a copy of their own file, the Maker may also see the purchase date and whether the purchase was refunded, and, for a copy delivered through the Maker's own share link, the time of access and the device type, but never the Buyer's identity. - File verification results: Anyone may check a file on our file verification page. The result shows whether the file is genuine and unaltered. Signed-in users may also see whether the copy was issued to them or to another account. The identity of the person to whom a copy was issued is shown only to that person and to XGenTra administrators, and information about listings that are not public is not shown to others. Visitors who are not signed in see only whether the file is genuine, not genuine, or cannot be confirmed.
- Legal Requirements: When required by applicable law, court order, or governmental authority.
- Business Transfers: In connection with a merger, acquisition, or sale of assets, with advance notice to you.
- Safety: To protect the rights, property, or safety of XGenTra, our users, or the public.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion + 30 days (except the records listed below) |
| Maker application records | Application content, rejection reasons, and internal notes: deleted with account data (account deletion + 30 days). That an application was made, its result, and its dates are kept with the account record. |
| Transaction records | 7 years (tax/legal compliance) |
| Usage logs | 90 days |
| Download logs | 12 months (IP address and device information are deleted after 12 months; download time, watermark code and other records attached to a transaction follow the transaction-record period above) |
| Link access records (IP address, device information) | 12 months (afterwards only non-identifying daily totals remain) |
| Purchase and download processing records (including the buyer identifier) | 90 days after processing completes |
| Administrator audit records (setting-change and permission-grant history, including the operator identifier) | 5 years |
| Support communications | 3 years |
Deleted .xagt files (other than store listings) | 30 days (then permanently removed) |
| Deleted store listings and their files | Listings deleted by the Maker that have no purchases: permanently removed 30 days after deletion, unless restored or retained for an administrative action. Listings that have purchases: kept to provide Buyers' access and to handle disputes, until permanently removed by XGenTra. |
| Rejoin records (keyed hash of email address) | Until the rejoin period ends (currently 180 days after account deletion) or is ended early, then deleted within 7 days |
| Moderation records | While the action remains in effect, and for 3 years after it ends |
| Deletion request records | 3 years |
| Upload fingerprints | While the listing exists. After a listing is permanently removed, its fingerprints are kept for up to 730 days and are used during that period to block re-uploads only if the listing was removed for rights infringement, illegal content, or spam; they can be released earlier on appeal. |
| Verification history | 90 days |
| Leak reports | 2 years after the report is handled |
Distribution seals embedded in files that have already left the Service cannot be removed by us. The records needed to identify the recipient of a seal are kept for the periods shown above for transaction records and download logs.
8. Your Rights
8.1 All Users
Regardless of your location, you may:
- Access: Request a copy of personal data we hold about you.
- Correction: Request correction of inaccurate data.
- Deletion: Request deletion of your account and associated data (subject to legal retention requirements). If your account is restricted or suspended, you cannot delete it yourself, but you can request deletion by email as described in Terms of Service Section 3.4.
- Opt-out of marketing: Unsubscribe via the link in any marketing email or by emailing [email protected].
8.2 EEA / UK Users (GDPR)
In addition to the above:
- Data Portability: Receive your data in a structured, machine-readable format.
- Restriction: Request restriction of processing in certain circumstances.
- Objection: Object to processing based on legitimate interest.
- Withdraw Consent: Withdraw any consent at any time.
- Lodge a Complaint: With your local supervisory authority (e.g., your national Data Protection Authority).
8.3 California Users (CCPA)
California residents have the right to:
- Know what personal information is collected and how it is used.
- Delete personal information (subject to exceptions).
- Opt out of the "sale" or "sharing" of personal information. (We do not sell personal information.)
- Non-discrimination for exercising privacy rights.
To exercise CCPA rights, email [email protected] with the subject line "CCPA Request."
8.4 Korean Users (PIPA — 개인정보보호법)
In accordance with Korea's Personal Information Protection Act:
- You have the right to access, correct, delete, and suspend processing of your personal information.
- We will process your request within 10 business days.
- Contact: [email protected] with the subject "PIPA Request."
8.5 Japanese Users (APPI — 個人情報保護法)
In accordance with Japan's Act on the Protection of Personal Information:
- You have the right to request disclosure, correction, addition, deletion, suspension of use, and suspension of third-party provision of your personal information.
- We will respond promptly without undue delay (typically within 2 weeks).
- Contact: [email protected] with the subject "APPI Request."
8.6 Delaware Users (Delaware Personal Data Privacy Act — DPDPA)
Delaware residents have the right to:
- Access / Confirmation: Confirm whether we process your personal data and obtain a copy.
- Correction: Correct inaccuracies in your personal data.
- Deletion: Request deletion of personal data you have provided or that we have collected about you.
- Data Portability: Obtain your data in a portable and, to the extent technically feasible, readily usable format.
- Category Disclosure: Know the categories of third parties with whom we share your personal data.
- Opt-Out of Sale / Targeted Advertising / Profiling: Opt out of the sale of personal data, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects.
- Appeal: If we decline to act on your request, you may appeal that decision by emailing [email protected] with the subject "DPDPA Appeal." We will respond within 60 days. If your appeal is denied, you may contact the Delaware Department of Justice at https://attorneygeneral.delaware.gov.
To exercise DPDPA rights, email [email protected] with the subject "DPDPA Request."
9. Exercising Your Rights
- Email: [email protected] with subject "Privacy Request — [Request Type]"
- Response Time: Within 30 days (up to 45 days for complex requests).
- Identity Verification: We may ask you to verify your identity before processing your request.
10. Data Security
We implement industry-standard security measures including:
- TLS encryption for data in transit.
- AES-256 encryption at rest for sensitive stored data.
- Access controls and least-privilege principles.
- Regular security audits and vulnerability assessments.
No method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
Security Breach Notification: In the event of a breach of security involving your personal information, we will notify affected individuals without undue delay and, where required by law, within the timeframes mandated by applicable law (e.g., within 60 days under Delaware law). If a breach affects 500 or more Delaware residents, we will also notify the Delaware Attorney General. Notification will be provided by email or, if email is unavailable, by other reasonable means.
11. Children's Privacy
The Service is not intended for users under the age of 18. We do not knowingly collect personal information from minors under 18. If we become aware of such collection, we will delete it promptly.
12. International Data Transfers
XGenTra is incorporated in Delaware, USA. Your data may be transferred to and processed in the United States, which may have different data protection laws than your country.
- EEA/UK: Transfers outside the EEA/UK are conducted under Standard Contractual Clauses (SCCs) or other approved mechanisms.
- Korea: Cross-border transfers to the US are disclosed in accordance with PIPA requirements.
- Japan: Cross-border transfers to the US are conducted with your consent or under equivalent protection measures as required by APPI.
13. Changes to This Policy
We will notify you of material changes by email or prominent notice on the Service at least 30 days before the new policy takes effect. The "Last Updated" date at the top reflects the most recent revision.
However, changes that are needed to introduce new features or services take effect when they are posted; the 30-day notice above applies to other material changes.
14. Data Protection Officer / Privacy Contact
XGenTra Inc.
DPO Email: [email protected]
General: [email protected]
Website: https://xgentra.com
131 Continental Dr, Suite 305, Newark, DE 19713, US
Appendix: Revision History
Per Section 14, the revision indicated by the Last Updated date is recorded below.
| Date | Changes |
|---|---|
| 2026-10-23 | Revised for the introduction of maker applications. (1) Section 2.1 — maker application row added. (2) Section 3 — purpose row for reviewing maker applications and showing the result. (3) Section 7 — retention of maker application records. Administrator notifications about applications contain no personal data, and no new sub-processor is added. |
| 2026-10-15 | Revised for account status, moderation, rejoin restriction, and file verification. (1) Section 2.4 added — moderation records, rejoin records (keyed email hash), distribution seals, upload fingerprints, file verification, leak reports. (2) Section 3 — purpose row for enforcing the Terms and protecting the Service, and a note on logged administrator access to account information. (3) Section 6 — what Makers and other users see when verifying a file. (4) Section 7 — account data row clarified; rows added for deleted store listings, rejoin records, moderation records, upload fingerprints, verification history, and leak reports. (5) Section 8.1 — deletion requests while an account is restricted or suspended. (6) Section 7 — download-log IP addresses and device information are deleted after 12 months; link access records are retained for 12 months, after which only daily aggregates remain; purchase and download processing records are retained for 90 days; administrator audit records are retained for 5 years. |
| 2026-10-14 | Revised for the introduction of our customer support system for email sent to our support addresses (support@, contact@, dpo@, legal@ and their aliases). Section 4 — Resend added as a sub-processor for delivering our support replies; the purposes of Cloudflare (email routing), Cloudflare R2 (support email attachments), Railway (hosting of the support system) and Google (Google Workspace company email) were expanded. No new categories of personal data are collected; support communications remain subject to the retention period in Section 7. |
| 2026-09-10 | Revised for the introduction of the cookie consent gate. (1) Section 3 — legal basis for improving the Service (analytics) changed from Legitimate interest to Consent. (2) Section 4 — Google Analytics added to Google's processing purposes in the sub-processor table. (3) Section 5 — added the in-site Cookie settings control, added the consent cookie entry, corrected marketing cookies to "not currently used", and stated that analytics cookies are set only on opt-in. These changes narrow the scope of processing and add user control. |
| 2026-05-30 | Initial effective version |
This Privacy Policy is the authoritative English version. In the event of any conflict between a translated version and this English version, this English version shall prevail.
Data Protection Officer: [email protected] | XGenTra Inc.