Privacy policy

By using the Site, including the XBAY Store storefront and the digital purchase transfer page, the user confirms that they have read this Policy.

The Operator processes personal data in good faith and only to the extent necessary for the stated purposes.

Depending on the Site features used, the Operator may process the following categories of data:

• the email address of the Microsoft account (the Buyer’s main account and, where needed, the Issued account);
• order identifiers on the marketplace, on the XBAY Store storefront, and in XBAY’s internal system, and identifiers of order items and digital products;
• information about payment of an Order on the storefront (payment status, payment identifiers at the payment partner, including payment via SBP);
• technical tokens and session data obtained through Microsoft OAuth authorization, needed to provide the Transfer Service and/or to deliver a storefront purchase (including refresh tokens and Microsoft service identifiers);
• information about the status of the purchase transfer / storefront order fulfillment, eligibility check results, and technical operation logs;
• cookie data and similar browser session identifiers;
• IP address, browser and device information — in server security and debugging logs.

Personal data is processed for the following purposes:

• sale and delivery of digital content through the XBAY Store storefront (performance of the public offer);
• providing the service of transferring a digital purchase to the main Microsoft account;
• accepting payment through a payment partner (including SBP by QR code) and confirming the payment status;
• identifying the order and preventing unauthorized access to order / transfer pages;
• interacting with Microsoft APIs and, where needed, the marketplace API to fulfill the order;
• ensuring security, preventing abuse, and investigating incidents;
• complying with legal requirements and responding to user requests.

Processing is based on the personal data subject’s consent (including when authorizing through Microsoft, placing a storefront order, and starting a transfer), performance of a contract (the public offer for the sale of digital content and/or the purchase transfer offer), and the Operator’s legitimate interests in keeping the Site secure.

To provide the Transfer Service and to deliver storefront purchases, the Operator transmits the necessary minimum of data to Microsoft Corporation (and affiliated Xbox / Microsoft Store services) through official APIs. Processing on Microsoft’s side is governed by Microsoft’s policies.

When an Order is paid on the storefront, the payment is processed by the Seller’s payment partner (including via SBP); the Operator receives service information about the payment status to the extent needed to fulfill the Order.

If the purchase was placed on Yandex Market, order identifiers may be matched with marketplace data to the extent needed to support the buyer.

The Operator does not sell personal data and does not transfer it to third parties for marketing purposes.

Data may be disclosed to government authorities only as required by law.

When the user contacts Microsoft services, personal data may be processed on servers outside the Russian Federation. By using Microsoft authorization and the Transfer Service, the user agrees to such cross-border transfer to the extent necessary to provide the Service.

Transfer session data and OAuth tokens are stored no longer than necessary to complete the transfer, to make retries within a reasonable time, and to resolve disputes, after which they are deleted or anonymized.

Technical operation logs and support requests may be stored for up to 3 (three) years, unless a longer period is required by law.

The Operator applies organizational and technical measures to protect personal data: access restriction, encrypted connections (HTTPS), storage of secrets in a protected environment, and separation of administrator rights.

The user may request information about the processing of their personal data, its correction, blocking, or deletion, and may withdraw consent by sending a request to the Operator’s email address.

Withdrawal of consent may make it impossible to continue providing the Transfer Service. The Operator may continue processing without consent where other lawful grounds exist.

The Site uses necessary cookies to maintain the authorization session, protect against request forgery, and operate the transfer page. Disabling cookies in the browser may make the Transfer Service unavailable.

The Operator may update the Policy. A new edition takes effect when it is published on the Site, unless the text states otherwise. We recommend checking the current version from time to time.

ИП Маджидов Андрей Махаевич

INN 744723950655, OGRNIP 325745600068645

Email for personal data matters: privacy@xbay.store

Site: https://xbay.store