01The short version
Your data is yours, and so is your customers' data. We use it only to run the work you ask us to do. We never sell it, never use your store or shopper data to compete with you or to build products for anyone else, and you can take your data and leave whenever you like.
- We never sell your data or your customers' data, and we do not share it for advertising.
- We use it only for you: to make, store, ship and track your products and to run the workspaces you switch on.
- Strong protection: integration credentials sealed with AES-256-GCM, every client's records isolated at the database level, and AI-assistant keys hashed, scoped and logged.
- No ad trackers: the site uses only the cookies it needs to work.
- You stay in control: see, correct, export or delete your data by writing to us.
02Who we are and what this covers
Kexlo ("Kexlo", "we", "us") is an American-led company operating in China. We design, source and manufacture products for ecommerce brands, store their inventory, fulfill and ship their orders worldwide with Neutral Tracking, and offer them an optional free platform with software and integrations, plus AI employees (free for fair use), to run it all.
Kexlo is the trading name of 珠海横琴延祥供应链管理有限公司 (Zhuhai Hengqin Yanxiang Supply Chain Management Co., Ltd.), Unified Social Credit Code 91440003MAEJRLYHXA, registered at 横琴粤澳深度合作区三塘村50号第四层 (Floor 4, No. 50 Santang Village, Hengqin Guangdong-Macao In-Depth Cooperation Zone, Zhuhai, Guangdong, China). That company is responsible for (the controller of) the personal data this policy describes.
Kexlo is not a middleman. Your contract is with Kexlo, and we provide these services directly: product design, in-house sourcing, GTIN/barcode, FDA and VAT registrations, the client platform and its six workspaces, the AI employees, and fulfillment. For manufacturing, Kexlo directs operations at the factory for you, and you are always free to use your own manufacturer instead.
This policy covers our websites, kexlo.io and the client platform at app.kexlo.io, and their public tools (the shipping calculator and the Explore preview), our physical services (design, sourcing, manufacturing, quality checks, storage, fulfillment, shipping and tracking), and the client platform (its six workspaces, the integrations you connect, AI employees, the Kexlo MCP for Claude and ChatGPT, the tracking API and the Kexlo for Windows desktop app).
Where a written agreement with a client says something different about that client's data, the agreement prevails.
03Your data, your customers' data
For your account, we are responsible for the data we collect to serve you: website visitors, people who contact us, and the owners and staff who hold logins.
For your store, you are in charge. When a shopper buys from your store, you control their data and we process it only on your instructions: to fulfill, ship, track and support that order and to run the workspaces you switched on. We do not use it for anything else.
Bought from a store that uses Kexlo? Contact that store about your privacy rights. If you write to us instead, we will pass your request to the store and help it answer.
04What we collect
What you give us
- Account
- Name, company, email, phone or WhatsApp number, role, permissions and staff login codes. Passwords are held by our sign-in service and are never readable by us.
- Products
- Ideas, designs, files, photos, samples, specifications, quantities, target markets and the quotations you approve.
- Billing
- Account credit, recharge requests, transfer references, invoices and your working currency. We do not store payment card numbers.
- Messages
- What you send us by email, WhatsApp or the support centre, and notes from calls.
- Onboarding
- The business profile you submit when you apply, such as store address, sales channels and contacts.
What your store and tools send us
- Orders
- Order numbers, items, and the shopper's name, address, email and phone needed for delivery.
- Shipping
- Parcel contents and declared values for customs, weights, tracking numbers, delivery status and returns.
- Integrations you connect
- For example Shopify orders, payouts and disputes; Meta Ads results (read only); Mercury transactions (read only); Loop Subscriptions records; your support mailbox such as Gmail; 17TRACK tracking history.
- Support and chargebacks
- Customer emails handled by AI Customer Support and the evidence ACR assembles for disputes.
What is collected automatically
- Security logs
- IP address, browser and device type, pages requested, times, errors and sign-in events.
- Activity
- Actions taken in the platform, staff login activity and every action an MCP key performs, kept as an audit record.
- Preferences
- Settings such as language, theme and display currency.
The shipping calculator needs no account or name; it uses only the details you type in to return an estimate. The Explore preview is a static demo: it makes no server requests, sets no cookies and stores nothing you type.
05How we use it
We use data only to serve you well. Where the GDPR or UK GDPR applies, the legal basis is shown for each purpose.
- Doing the work you ask for
- Sourcing, production, storage, fulfillment, shipping, tracking, support and the platform features you use. Basis: contract.
- Handling your shoppers' orders
- Only on your instructions, under our agreement with you. Basis: your own lawful basis as the store.
- Keeping accounts safe
- Signing you in, preventing fraud and abuse, enforcing our Terms of Use and keeping audit records. Basis: legitimate interests and legal obligations.
- Billing and records
- Balances, invoices, reconciliation, tax and accounting. Basis: contract and legal obligation.
- Talking to you
- Answering questions, service notices and account updates. Marketing email only with consent where the law requires it, and you can opt out any time. Basis: contract, legitimate interests or consent.
- Making Kexlo better for you
- Fixing faults and improving features. Basis: legitimate interests.
- Following the law
- Customs declarations, import and export rules, and lawful requests. Basis: legal obligation.
Our promises
- We never sell your data or your customers' data, and we never share it for cross-context behavioural advertising.
- We never use your store or shopper data to compete with you, or to build products or services for anyone else.
- We never make decisions with legal or similarly significant effects about you by automated means alone.
06AI employees and the Kexlo MCP
AI employees answer customer emails, assemble chargeback evidence, book accounting entries and help run fulfillment, around the clock. They follow the rules and permissions you set, and people at Kexlo are on standby, including weekends and holidays, for anything that needs a human.
- AI features see only the data the task needs, from the workspaces and integrations you switched on.
- We choose AI providers and settings that protect your data, and we use them only to run your work.
- You can change or switch off any AI employee at any time. AI can make mistakes, so review what goes out in your name.
The Kexlo MCP lets you connect your own AI assistant, such as Claude or ChatGPT, to your account. You create each key, choose exactly what it may do, and can revoke it at any time. Keys are stored only as SHA-256 hashes, and every action a key performs is logged. Data your assistant reads is also covered by that assistant provider's own terms.
08International transfers
We operate in China, close to where products are made and shipped, and our providers run systems in several countries, so data may be processed in the United States, China and elsewhere. Shipping a parcel abroad means sharing the recipient's details with the delivery and customs services along the route.
When we transfer personal data out of the EEA, the UK or Switzerland, we use the safeguards the law provides, such as the European Commission's Standard Contractual Clauses and the UK addendum, or a permitted exception such as the transfer being necessary to perform a contract. Where Chinese law applies, we follow its rules for cross-border transfers.
09How long we keep it
Only as long as it is needed for the purpose it was collected for. After that we delete it or anonymise it, unless the law requires us to keep it longer.
- Account data while your account is open, then as long as needed to settle balances and close it out.
- Order, shipping and customs records as long as needed for delivery, returns and disputes, and for the periods tax, customs and accounting laws require.
- Your shoppers' data for the length of our agreement, then deleted or returned on your instruction.
- Integration data until you disconnect the integration or close the account; disconnecting stops new data from being read.
- Shopify store data: when you uninstall the Kexlo Shopify app, the store's connection and its shoppers' personal data are deleted within 30 days (sooner when Shopify sends its store erasure request, 48 hours after the uninstall), unless you reinstall the app before then. A shopper's erasure request passed on by Shopify is carried out within 30 days, and a shopper's data request is answered by giving the store an export of what we hold about that shopper within 30 days.
- What tax and customs law requires us to keep after an erasure: order numbers and dates, the destination country and region, the items, quantities and amounts, our charges and tracking numbers. Names, street addresses, postcodes, phone numbers, emails and messages are removed.
- Security and audit logs as long as needed to protect the service and look into incidents.
10How we protect it
- Sealed credentials: the tokens and passwords you give us to connect integrations and mailboxes are encrypted with AES-256-GCM before they are stored.
- Per-client isolation: database row-level security keeps each client's records readable only by that client's own logins.
- Scoped AI-assistant keys: MCP keys are stored as SHA-256 hashes, can do only what you allow, and every action they take is logged.
- Least privilege: staff logins see only what their role allows, and changes made from an owner view are recorded in an audit trail.
- Encrypted connections (HTTPS) between your browser and the site.
No system can be perfectly secure, but we work hard to keep yours safe. If a breach ever affects your personal data, we will tell you and the authorities as the law requires. If you think your account has been compromised, tell us straight away.
11Your control and your rights
You can ask us for a copy of your data, have it corrected or deleted, and close your account whenever you want. Many workspaces already let you download your records as files, and on request we provide an export of your account data so you can take it with you. You can opt out of marketing email using the link in any message.
EEA, UK and Switzerland
Under the GDPR and UK GDPR you can access, correct and erase your data, restrict or object to processing (including direct marketing), receive your data in a portable form, and withdraw consent at any time. You can also complain to your data protection authority, though we would love the chance to fix it first.
California
Under the CCPA, as amended by the CPRA, you can know, access, correct and delete your personal information, opt out of its sale or sharing, and limit the use of sensitive information. We do not sell or share personal information, we use sensitive information (such as login credentials) only to provide the service, and we will never treat you differently for using these rights. An authorised agent may act for you; we may ask both of you to verify the request.
Everywhere else
Other US states and countries, including China's Personal Information Protection Law, give similar rights, and we honour them as your local law requires.
Making a request
Email 24fulfillr@24f.site, from your account's address where possible. We will verify it is you and reply within one month (GDPR) or 45 days (CCPA), or sooner where we can. Requests about a store's shopper data go to that store, which decides on them.
13Children
Kexlo is a business service and is not meant for children. We do not knowingly collect data from anyone under 16; if you think a child has given us data, tell us and we will delete it.
14Fair use of the site
Our Terms of Use set out how the site and platform may be used. In short: no scraping or automated harvesting of data, no bypassing rate limits or other protections, and no reverse engineering, cloning or using the service or its outputs to build a competing service. Search engines may index our public pages as robots.txt allows, and we block abusive traffic.
15Changes to this policy
When our services or the law change, we update this policy and the effective date at the top. For material changes, clients get notice by email or in the platform before they take effect.
16Contact us
Questions, requests or complaints about privacy: 24fulfillr@24f.site, or use the contact page.