Privacy Policy

Resource URI: xekta://docs/privacy-policy · Public copy: https://www.xekta.com/legal/privacy

Version 2026-10-10 · Effective 10 October 2026

This policy explains what Aumere, Inc., doing business as XEKTA ("XEKTA", "we"), collects when you use XEKTA as a buyer or as a shop, where it goes, how long it stays, and what you can ask us to do with it. It is written to be read, not skimmed; it is short because we collect little.

1. What we collect, and why

When you sign in. XEKTA identifies you through an OAuth sign-in handled by WorkOS. If you choose to sign in with Google, Google confirms who you are to WorkOS. We receive an identifier for your account and the email address and name your sign-in provider shares. We use them to know who is calling and to reach you about your orders or your shop.

When you are a buyer.

• Phone number. Collected when you set up your buyer account; shared with the shop together with your order so they can reach you about it (for example if an item is out of stock). Not used for marketing. We confirm the number is yours by texting it a one-time code through Prelude; Prelude generates and checks the code, and XEKTA keeps only the fact that the number was confirmed and when. The code usually arrives as a text message (SMS); if a text cannot be delivered, Prelude may send it through another messaging channel such as RCS or WhatsApp. To stop abuse the IP address the request came from is sent to Prelude with the number, and we also keep, for a short time, how many codes were requested for your account, your number and your IP address.
• Pickup context. A home address if you save one on your account, so shops near you come first when your agent does not say where you are. Nothing is delivered to it. When your agent tells XEKTA where you are for a search, that location is used for that search and is saved on the cart it leads to, so the approval box or page can show how far the shop is. XEKTA also keeps the last location you gave — only the last one, never a history — for at most 3 hours, so a cart your agent opens later can use it, and then deletes it. Your account page (Home address) shows it and lets you delete it at once. It is not your saved home address and shops never see it. To turn a street address into map coordinates XEKTA sends the address — and only the address — to the U.S. Census Bureau's public geocoding service. XEKTA does not guess your location from your IP address; if your agent sends coordinates, they are used the same way as an address you gave.
• Address suggestions. While you type an address on your account pages, the text you have typed so far is sent through XEKTA's server to Google (Places API) to suggest matching U.S. addresses, and the one you pick is looked up there to fill in the fields. If you press Use my current location, your browser asks your permission first; only then are your device's coordinates, rounded to about a meter, sent through XEKTA's server to Google (Geocoding API) to find the nearest street address, which fills in the fields for you to check. XEKTA sends Google nothing that identifies you or your account, does not store what you type, the suggestions or those coordinates, and does not write them to its logs; only the address you save is kept, as described above. Shops use the same suggestions for their own address.
• Your card — but not your card number. Cards are saved on a page hosted by Stripe. XEKTA stores only Stripe's identifiers for your customer record and payment method. Card numbers, expiry dates and security codes never reach XEKTA's servers. When you place an order, Stripe copies your saved card to the shop's own Stripe account so the shop can charge it as the seller (see section 3).
• Carts and orders. What you put in a cart, what you ordered, from which shop, for how much, the sales tax, the order's status, your pickup code, and the record of your approval. For an item sold by weight, also the amount you asked for (a count or a weight), its estimated and "up to" price, and the weight the shop entered when it weighed it. For a restaurant order, also the menu options you chose for each item, with their names and prices as they were when you chose them, any note you wrote for an item, and the tip you chose. Item notes you write are shared with the restaurant to prepare your order and are kept as long as the order record.

When you are a shop.

• Business profile. Business and legal name, tax ID if you give one, support email and phone, business and pickup addresses, opening hours, whether the shop is a market or a restaurant (and, for a restaurant, its usual prep time and any extra time it adds when busy), and the sales-tax rate XEKTA records for your shop's address. That address is sent to the U.S. Census Bureau's public geocoding service, the same one described under Pickup context above. The same Census lookup also finds the shop's local meals-tax jurisdiction, which XEKTA stores and an XEKTA operator confirms; from the switch to Stripe Tax calculation it is used to calculate meals tax, and prepared food is sold only once it is confirmed.
• Payments. Your Stripe connected-account identifier and the status of its card-payment and payout capabilities. Bank details live at Stripe, not at XEKTA.
• Catalogue. The products and offers you list, including their free text, and, for a restaurant, its menu option groups, options and their prices. Free text is treated as data, never as instructions to an agent.
• Orders. Everything about orders placed with you: the items (with any options and the buyer's item notes), amounts including any tip, and status, and the buyer's name and phone number. Not the buyer's pickup code — XEKTA never shows it to you.
• Messaging and till connections, if you use them. For Telegram, the chat identifier of each chat you connect; for WhatsApp, the phone number of each person you connect; for Square, an encrypted access token and the catalogue (including the weight unit an item is sold by and, for a restaurant, its modifier lists — the menu options and their prices), stock and location data XEKTA reads with it, and the identifier of the copy of each XEKTA order placed in that shop's Square; for Clover, an encrypted access token and refresh token, and the items, prices, stock and option groups XEKTA reads with them.

Operational records — both sides. When a tool call made by an agent fails, we record which tool, when, the error class, and the identifiers of the cart or order it touched. We keep these for reliability: to fix what broke and to see which instructions agents get wrong. Calls that succeed are not recorded in our database; at most they are counted in product analytics (below). We also keep a record of each notification XEKTA sends (which event, which channel, whether it was delivered), and a history of what happened to each order and who did it, which is part of the order record. If an agent sends us a feedback note, we keep that note. None of these contain card data.

Acceptance record. When you accept these terms or the Privacy Policy (and, for a shop, the Merchant Agreement), we record which document and version you accepted, when, the IP address the acceptance came from, and your browser's user-agent string. This exists only as proof that the acceptance happened, and we keep it for as long as your account exists. If you delete your account while orders you placed are still on record, we keep which document and version you accepted and when, without the IP address or user-agent string, for as long as those orders are kept (section 4) — it shows the terms they were placed under.

Product analytics. To learn how many people reach XEKTA, how far they get, and which countries and cities they use it from, we send a small, fixed set of events to PostHog: you signed in for the first time, you chose a buyer or shop role, you accepted these documents, your agent completed sign-in, listed the tools, called a tool, placed an order, or completed a pickup. Each event carries the time it happened, a one-way salted hash of your sign-in identifier (never the identifier itself), whether it came from this website or from your agent's connection, and — depending on the event — the role you chose, the name of the tool called, whether the call succeeded, how many tools were listed, and, for a tool call, the name and version of the app your agent runs in, as that app reports them. Each of these events also carries the IP address the request came from, for one purpose: PostHog resolves it to a country and city and discards the address without storing it. When a tool call made by your agent fails, we also send PostHog an error event. It carries the error code and class, whether the error came from the tool or from the connection and whether it can be retried, the name of the tool, and the name and version of your agent's app, together with the same hash and time as above and no IP address. It never carries your messages, the call's arguments, the error's explanation text, or any identifiers. Nothing else goes to PostHog. No order contents, amounts, order or cart identifiers, names, phone numbers, addresses, card data or pickup codes are sent, and the list of fields that may be sent is written into the code as an allow-list rather than a list of exclusions, so a new field is never included by accident. These events are sent from XEKTA's server, not from your browser. What our web pages collect in your browser is described in section 1a.

1a. Cookies and analytics

• The XEKTA account site — where you sign in, accept these documents and manage your account or shop — sets these strictly necessary cookies of its own: a session cookie that keeps you signed in (it lapses after 30 minutes; on the order pages it is renewed while you use them, but never beyond 12 hours after you signed in), and short-lived cookies (10 to 15 minutes) that carry a sign-in or a confirmation from one page to the next. They are not used for analytics or advertising. If you agree to analytics (see We ask first below), the account site also runs PostHog analytics in your browser: which pages you open and what you click, with all text on the page and every form field masked, joined to the same salted hash as the events in section 1. It records no session replays or heatmaps. Pages whose address carries a one-time link or a sign-in code do not load it.
• The public website (www.xekta.com), if you agree to analytics, runs PostHog analytics in your browser, to count visits and see which pages are read: page views, clicks, heatmaps and session replays. In replays, what you type into a form is masked, and the waitlist form's fields are never captured.
• We ask first. Neither site loads analytics until you say yes. A banner asks whether we may measure visits, with Accept and Decline; nothing is loaded and nothing is sent to PostHog from your browser until you accept, in the banner or with the switch below. Decline, or no answer, means no analytics. A browser that sends a Global Privacy Control or Do Not Track signal is treated as having declined, and is not shown the banner. To change your choice later, use Cookie settings at the bottom of either site's pages where analytics can run, or the switch at https://www.xekta.com/legal/privacy#analytics-opt-out (the Changing your choice section below). Your choice is kept in a cookie on xekta.com that the public website and the account site share, so it applies to both. This choice covers what our web pages run in your browser; the events described under Product analytics in section 1 are sent from XEKTA's server and are not covered by it.
• How the analytics work on both sites. Page addresses are cleaned before they are sent: identifiers and one-time codes in the path are replaced, and query parameters are dropped apart from stripe, a short status word our payment pages use. A session replay on the public website records the page address with only these query parameters: stripe and card (short status words our payment and card pages use) and campaign tags whose names start with utm_, such as utm_source; if the address carries any other query parameter, that visit is not recorded. On the account site, page titles are not sent. Once you have agreed, PostHog keeps an identifier for your browser in a cookie and in your browser's local storage, shared across xekta.com and its subdomains, and your browser's requests to PostHog carry your IP address and browser details.
• No advertising. We do not use advertising pixels or advertising cookies, and we do not build profiles to sell.
• Fonts and scripts. Our pages load fonts from Google Fonts, and the website loads a script library from jsDelivr. Your browser fetches these directly, so those services receive your IP address and browser details.

Changing your choice

The switch above shows your choice for the analytics described in this section and lets you change it, in this browser, for both www.xekta.com and the account site — the same choice the banner and Cookie settings make. Your choice is kept in a cookie named xekta_analytics_opt_out on xekta.com for 400 days; until you make one, nothing is loaded. If your browser sends Do Not Track or Global Privacy Control, the analytics stay off and the switch says so. This page never loads PostHog. If you do not see the switch, your browser is not running our scripts, and without them the analytics cannot run either.

2. Where it lives

Each of these handles data under its own terms and security programme. We do not sell data to any of them or to anyone else. Your AI provider is not working for XEKTA: it is an independent service you chose, and what it does with what your agent sees is governed by its own policy, not this one. Telegram, Meta and Google are likewise independent platforms that a shop or you choose to use.

3. Who sees what

• The shop sees what it needs to prepare and hand over your order: the items, quantities and amounts (for a restaurant, with the options you chose, your item notes and your tip), the order's status, your name as your sign-in provider shares it, and your phone number. The shop does not see your pickup code. You read it out at the counter; the shop types it in and XEKTA checks it. XEKTA does not give the shop your address or your email address.
• Your card, on the shop's side. The shop never sees your full card number. But because the shop is the seller and the charge is made on the shop's own Stripe account, a copy of your card is made there for each order, and the shop's Stripe dashboard shows the card brand, last four digits and expiry date.
• The buyer sees the shop's name, pickup address, opening hours and the items and prices the shop listed.
• Your agent sees what the tools return to it, including your pickup code. Your agent is yours; what it does with that information is governed by whoever runs it, not by this policy.
• XEKTA operators can read order and account records to run the service, approve shops, and handle disputes and cancellations. An operator's cancellation is recorded in the order's history.
• Nobody else, except when the law requires it or to protect the service, its users or the public from fraud or harm.

3a. If the business changes hands

If Aumere, Inc. is acquired, merged, reorganised, or sells the XEKTA business, the information described here transfers with it. The buyer of the business is bound by this policy for the data it receives until it asks you to accept a new one. We will say so on this page and, for account holders, by email before the transfer takes effect where the law requires it. This is a transfer of a business, not a sale of your data: we still do not sell personal information, and this does not change that.

4. How long

• Orders, payments, refunds, disputes — kept for as long as tax and card-network rules require, which is generally seven years from the transaction. This includes the order's history and, for a cart that became an order, the cart and the record of your approval, and the record of which documents you had accepted.
• Pickup codes — the readable code is deleted within two days after the order closes (collected, cancelled, expired, charged as a no-show or refunded). If the order is disputed, the readable code is kept until the dispute ends and the order closes. A one-way hash of it stays with the order record; it cannot be turned back into the code.
• Carts that never became an order — deleted 30 days after they were last used. A cart that an error record points to is kept until that error record is deleted (below), then deleted.
• Stock reservations — stop holding stock once the order is collected or cancelled, or once their short expiry passes. The reservation line itself (which product, how many) stays with the order record.
• The last location you gave — 3 hours at most, then deleted.
• Operational records — records of failed tool calls, of notifications and of feedback notes from agents are deleted one year after they were made. The one exception is the record that a commission notice was sent to a shop, which is kept as proof of that notice.
• Phone confirmation requests — the record of each one-time code we asked Prelude to send (your account, the number and the IP address) is deleted one day after it was made.
• Sign-in hand-offs between your agent and our web pages — deleted after 30 days.
• Accounts — until you delete them (below).

5. Deleting your data

Shops delete their account by writing to info@xekta.com from the email address on the account; there is no delete button today. We confirm with you before anything is removed. Deletion removes the catalogue, saved carts, opening hours and settings, any Telegram, WhatsApp or till connection, the Stripe connection link, API keys and the login, and it removes the owner's name, email address and phone number from the account; the record of which documents the owner accepted and when stays, without the IP address or user-agent string. Past orders, refunds, chargebacks, transfers and disputes are kept because tax and card-network rules require it; they keep the business name as it was, but the link back to the deleted account is severed. Deletion is refused while any order is still open. What goes and what stays is also set out at https://www.xekta.com/legal/delete-account and in section 9 of the Merchant Agreement.

Buyers can ask us to delete their account and saved cards by writing to info@xekta.com from the email address on the account. This is done by hand, following a written procedure, after we confirm with you, and completed within 30 days. We remove your name, email address, phone number and default address, the email address saved with your cart approvals and the masked address an approval was sent to; close your sign-in so it cannot reopen the account; delete the notification, error and feedback records about you, your carts that never became orders together with their approval records, and your Stripe customer record with the cards saved on it; and remove the IP address and user-agent string from your acceptance records. Records of completed orders are kept for the period in section 4, no longer tied to your name, email address or phone number; with them stay the record that you approved each of those carts and the record of which documents you had accepted and when. The copies of your card that were made on shops' Stripe accounts for past orders are part of those shops' payment records and stay there.

6. Security

Card data never touches XEKTA. Access tokens identify you without carrying your role — the server looks that up itself, so a token cannot be edited into a different identity. All traffic is encrypted in transit. Your pickup code is shown only to you; XEKTA keeps a one-way hash to check it at the counter, and deletes the readable code after the order closes.

7. Your rights

If you live in California, you have the right to know what personal information we hold about you, to ask for it to be deleted, and not to be treated differently for exercising those rights. We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of. Residents of other places with similar laws have the same rights with us. Write to info@xekta.com; we answer within 45 days.

8. Children

XEKTA is for adults. We do not knowingly collect data from anyone under 18, and we delete it when we learn of it.

9. Changes

Each version carries a date, like the one at the top. When this policy changes in a way that matters, you will be asked to accept the new version on a XEKTA web page while signed in to your account; your agent can give you the link but cannot accept for you. Until a buyer accepts, they cannot place new orders; a shop is taken to the new version on its dashboard. Orders already in progress continue.

Version history: the 2026-10-10 version says that, for a shop that connects Square, XEKTA puts each of its orders into that shop's Square — the order number, the buyer's first name, the items with their options and the buyer's item notes, and the amounts — so the shop's till and kitchen show it. Never the buyer's phone number, email address or pickup code. Until this version, XEKTA only read from Square.

The 2026-10-09 version changes nothing in this Policy; it carries the version number of a Merchant Agreement change about card processing fees.

The 2026-10-08 change moves the one-time code that confirms a buyer's phone number from Twilio to Prelude. Section 1 now says the code usually arrives as a text message (SMS) and that, if a text cannot be delivered, Prelude may send it through another messaging channel such as RCS or WhatsApp. It also says the IP address the request came from is sent to Prelude with your number, to stop abuse; section 2 lists Prelude in place of Twilio, and section 4 says the request records are those sent to Prelude. This version also carries the Clover till connection described in section 1, whose version bump had been held back.

The 2026-10-04 change adds Address suggestions under Pickup context in section 1: while you type an address on your account pages, the text you've typed and the suggestion you pick are sent through XEKTA's server to Google (Places API) to suggest and fill in U.S. addresses. If you press Use my current location and your browser's permission prompt allows it, your device's coordinates, rounded to about a meter, are sent through XEKTA's server to Google (Geocoding API) to find the nearest street address. Nothing that identifies you is sent to Google, and XEKTA doesn't store or log what you type, the suggestions or the coordinates. It removes the statement that XEKTA never asks your device for its location, and adds Google (Maps Platform) to the table in section 2. Shops use the same suggestions for their own address.

The 2026-10-03 change rewrites section 1a: both XEKTA websites now ask before running analytics. A banner offers Accept or Decline, nothing loads until you accept, a browser sending Global Privacy Control or Do Not Track counts as a decline and sees no banner, and Cookie settings or the switch on this page changes the choice; the earlier text described the analytics as on unless you switched them off. It also adds, in section 1, that for a restaurant order XEKTA keeps the menu options you chose, your item notes and your tip, that item notes are shared with the restaurant and kept as long as the order record, and what a restaurant's profile, catalogue and Square connection add; and, in sections 2 and 3, that the shop and its Telegram or WhatsApp order messages carry those options and notes.

The 2026-09-29 change adds to Stripe's row in the table in section 2 what is sent to Stripe to calculate sales tax once a shop is moved to Stripe Tax calculation: the shop's pickup address and each item's amount, quantity, tax class and product identifier — not your address, and no order number, because XEKTA does not record the sale as a tax transaction on the shop's Stripe account — and the sales tax registrations and tax settings a shop enters on its Tax page. It also adds, in section 1, that the same Census lookup that finds nearby shops for a buyer also finds a shop's local meals-tax jurisdiction, which XEKTA stores and an XEKTA operator confirms; from the switch to Stripe Tax calculation it is used to calculate meals tax, and prepared food is sold only once it is confirmed. It broadens the U.S. Census Bureau Geocoder's row in section 2 to say so. An earlier draft, 2026-09-28.3, was never published; its changes are included here. The same version adds, in section 1, that for an item sold by weight XEKTA keeps the amount you asked for, its estimated and "up to" price and the weight the shop entered, and that the Square catalogue data includes the weight unit an item is sold by; and, in Resend's row in section 2, the email that gives you the final total of such an order when it is ready, and an update if that total changes. The 2026-09-28.2 change rewrites Pickup context in section 1 — how a saved home address and a location your agent gives are used to find nearby shops, and that the last location you gave is kept for at most 3 hours and how to delete it sooner — adds the U.S. Census Bureau Geocoder to the table in section 2, and adds that 3-hour limit to section 4. It replaces 2026-09-28 and 2026-09-28.1, which were published with the location text but without the 2026-09-27.2 corrections described below, so anyone who accepted either is asked to accept again. The 2026-09-28.1 change added, in Pickup context in section 1 and in section 4, that the last location you gave is kept for at most 3 hours and how to delete it sooner. The 2026-09-10 change adds the Product analytics paragraph in section 1 and PostHog to the table in section 2. The 2026-09-08 version number change was the Merchant Agreement's acceptance clause (shops now accept orders automatically at checkout); nothing in this Privacy Policy changed then. Nothing in this policy changed in 2026-09-13, 2026-09-13.1 or 2026-09-13.2 either — XEKTA's three documents share one version number, and those three moved it: the Terms of Service twice (a dearer-replacement clause, then the cancellation rule) and the Merchant Agreement once. Nothing in this policy changed in 2026-09-13.3 or 2026-09-22. The 2026-09-20 version added a second paragraph on shop deletion to section 5, pointing to the delete account page.

The 2026-09-27.2 version corrects statements that did not match how XEKTA works. It also says where each service keeps data only as far as we have checked it (section 2). The shop does not see your pickup code (sections 3 and 6 said it did). A copy of your card is made on the shop's Stripe account, where the shop sees its brand, last four digits and expiry (section 3 said the shop did not see your card). Only failed tool calls are recorded, not every call (section 1). The sales-tax rate is recorded by XEKTA, not set by the shop (section 1). Section 2 now lists every service that handles your data, including Telegram, Meta, Square, Google, Resend's full use, the shop's Stripe account and your own AI provider. Section 4 now matches what XEKTA actually deletes and when; the deletions it describes are now carried out by a daily job. Shops can no longer delete their account through an agent; section 5 says how to do it. Section 1a on cookies and analytics is new. Section 1 now says that a failed tool call sends an error event to PostHog, what it carries, and that tool-call events carry the name and version of your agent's app. Section 1 now also says how your phone number is confirmed (a one-time code texted through Twilio) and the short-lived count of code requests kept to stop abuse, section 2 lists Twilio, and section 4 says those requests are deleted after one day. This version replaces 2026-09-27, which was published in two different forms: one carried the corrections above, the other only this policy's text on confirming a phone number. 2026-09-27.2 is the one text that carries both, so anyone who accepted 2026-09-27 is asked to accept again.

10. Contact

Aumere, Inc. (XEKTA) · info@xekta.com · https://www.xekta.com