Privacy Policy
Last updated: 11 October 2026
1. Who We Are
Xpact is operated by XPNNTL LTD, a private limited company registered in England and Wales under company number 17493975, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom ("Xpact", "we", "us", or "our").
XPNNTL LTD is the controller of the personal data described in this policy. It is registered with the UK Information Commissioner's Office (ICO) under registration number C2050711.
Privacy contact: support@xpact.app
Our representative in the European Union
Under Article 27 of the EU General Data Protection Regulation ("GDPR"), our representative in the European Union is:
Dinara Muradova
Sandstrasse 154, 50127 Bergheim, Germany
di.muradova17@gmail.com
You may contact our representative instead of us about anything in this policy.
We have not appointed a data protection officer. Please send privacy questions and requests to support@xpact.app.
2. What This Policy Covers
This policy applies when you use the Xpact bot or the Xpact mini app in Telegram, visit xpact.app, use the Xpact dashboard, send feedback, or contact us.
Xpact shows lots published by auction houses and other auction operators, and links each one to its source. We do not run auctions, and we do not process bids or payments for auction items.
3. Personal Data We Process
Your Telegram account
You use Xpact with your Telegram account. When you start the bot or open the mini app, Telegram passes us your Telegram user ID, your first name and Telegram username, and your Telegram language. We store:
- your Telegram user ID and the chat ID we use to message you;
- a display name made of your first name and username;
- your language and the account settings you choose;
- when your account was created and last updated; and
- which version of our Terms you accepted and when, if you accepted them in the mini app or the dashboard.
We do not receive your phone number, your Telegram contacts, or your messages in other chats. We do not store your last name or profile photo.
If you open the bot through a link with a code, for example from our Telegram channel, we store that code to understand which links bring people to Xpact.
Dashboard accounts with an email address
The Xpact dashboard is by invitation. If we invite you, we store:
- your email address;
- your password, stored only as a hash, never as the password itself; and
- the invitation and password-reset links we send you by email. Each link works once and for 7 days, and we store only a hash of it.
You can connect Telegram to your dashboard account. The dashboard gives you a one-time code that works for 10 minutes, and the mini app sends it back with your Telegram sign-in. Your Telegram account and your dashboard account then become one account. We store only a hash of the code.
Required Telegram channel
After the first 30 lots the bot shows you, you need to be a member of our Telegram channel @xpact_official to go on using the bot. We keep a count of the lots the bot has shown you. Once you pass 30, the bot asks Telegram whether you are a member of the channel. Telegram also tells the bot when people join or leave the channel. We do not store whether you are a member: the bot remembers a yes for up to 10 minutes, then asks Telegram again.
Telegram account age check
New Telegram accounts are often used for spam and abuse. Telegram does not tell us when an account was created, so we estimate it from the Telegram user ID. We record each Telegram user ID we see and the day we first saw it. We keep them for as long as we run this check, and they are not deleted when you delete your account. If we estimate that an account is less than 7 days old, it cannot use Xpact unless we let it in, and we record that decision. If you think we got this wrong, email support@xpact.app and a person will review it.
Your feed, favourites, and reminders
To run the service, we process:
- the countries, categories, filters, sorting, and search text you choose for your feed;
- lots you save to favourites and the lots you have already seen, saved, or hidden in the feed;
- your reminder settings, and a record of the reminders we send; and
- lots you open at their source, and the filters you use, so we can understand which features and sources are useful.
Activity sessions
When you sign in, we record a session with its start and end time, your IP address, and your device and app information (user agent). While you use Xpact, the app sends a short activity signal about once a minute, so we can see how long you actively use the service.
- In the Telegram mini app this always happens. The session ID is kept only in the app's memory and ends when you close it; nothing is stored on your device for this. We rely on our legitimate interest in operating, securing, and improving the service, and you can object at any time (see section 9).
- On the website this happens only if you allow Analytics in the cookie banner.
We delete activity sessions and signals 90 days after a session was last used.
Product analytics
We use PostHog, in its EU data region, to understand how Xpact is used: pages visited, features used (such as search, filters, favourites, and links to auction sources), your IP address, and your device and browser information.
- On the website, full measurement, including a random browser identifier and, once you sign in, your Xpact account number, happens only if you allow Analytics. Without that consent we count page views and feature use anonymously, without storing anything on your device or recognising you from one visit to the next.
- In the mini app, PostHog runs without storing anything on your device and without identifying your account.
PostHog never receives your name, Telegram username, or email address. Accounts of Xpact staff are not measured.
Location
If you choose Near me, your browser or Telegram asks for permission to share your location. We use the coordinates, rounded to about 10 metres, and the distance you pick to find lots nearby and to show the name of the area. Your device keeps the location, its name, and the distance for up to 7 days so you do not have to share it again (see the Cookie Policy). Location is optional; you can choose a city instead.
Feedback and support
If you send feedback or contact us, we process your email address, your message, its type, your account ID if you are signed in, your IP address, and a reference number. Feedback is forwarded to our team by email.
Auction listings
Lots shown on Xpact are published by auction operators. They may include the names of sellers, auctioneers, or other people where the operator has published them. We process this information to show lots and link to their source. If you appear in a listing and believe the information is wrong or should not be shown, email support@xpact.app with the Xpact link and the original link.
Technical and security data
When you use Xpact, our servers and providers process technical data needed to deliver and protect the service: IP address, time of requests, pages and API routes requested, browser and device information, and error, security, and rate-limit information.
4. Where Our Data Comes From
We receive personal data:
- from you, when you use the bot, the mini app, or the website, or contact us;
- from Telegram, when you start the bot, open the mini app, or sign in with Telegram;
- automatically from your device and your use of Xpact; and
- from auction operators, for the information published in their listings.
5. Why We Process Data and Our Legal Bases
Under the UK GDPR and the EU GDPR, we rely on these legal bases:
| Purpose | Main data | Legal basis |
|---|---|---|
| Create and run your account | Telegram ID, display name, language, settings | Performance of our contract with you |
| Run dashboard accounts with an email address, and connect them to Telegram | Email address, password hash, invitation and password-reset links, connection codes | Performance of our contract with you |
| Check that you are a member of our Telegram channel | Telegram ID, count of lots shown, channel membership | Performance of our contract with you: membership is a condition of free access to the bot |
| Check the age of Telegram accounts | Telegram ID, the day we first saw it, estimated account age | Our legitimate interest in preventing spam, fake, and abusive accounts |
| Provide the feed, favourites, search, and lot pages | Account ID, feed settings, favourites, feed history | Performance of our contract with you |
| Send reminders and service messages in Telegram | Telegram chat ID, reminder settings, favourites | Performance of our contract with you |
| Provide Near me | Coordinates, distance, area name | Your request to use the feature, and your consent to share your location |
| Record activity sessions in the mini app | Session times, activity signals, IP address, user agent | Our legitimate interest in operating, securing, and improving Xpact |
| Record activity sessions on the website | Session times, activity signals, IP address, user agent | Your consent (Analytics) |
| Product analytics with full measurement on the website | Pages, features, browser identifier, IP address, user agent, account number | Your consent (Analytics) |
| Anonymous counting on the website and in the mini app | Page views and feature use, without identifying you | Our legitimate interest in understanding how Xpact is used |
| Understand which links bring people to Xpact | The start code in the link you opened | Our legitimate interest in understanding how people find Xpact |
| Record which version of the Terms you accepted | Terms version and time | Performance of our contract and our legitimate interest in being able to show acceptance |
| Answer feedback and support requests | Email, message, account ID, IP address | Our legitimate interest in answering you and improving Xpact, or our contract with you |
| Show auction listings | Information published by auction operators | Our legitimate interest in providing an auction search service |
| Deliver and secure the service | IP address, request, error, and security logs | Our legitimate interest in running a secure and reliable service |
| Establish, exercise, or defend legal claims | Relevant account, message, and log data | Our legitimate interest |
| Comply with the law | Data required by a valid legal request | Legal obligation |
Where we rely on consent, you can withdraw it at any time; this does not affect processing that took place before you withdrew it.
6. Who Receives Data
We share data only as needed for the purposes above:
| Recipient | What they do and the data involved |
|---|---|
| Telegram | Delivers the bot's messages and runs the mini app inside Telegram. Telegram processes your account and messages under its own privacy policy as an independent controller. |
| Vercel Inc. | Hosts the website, the dashboard, and the mini app, and processes request data such as IP address and browser information. |
| Hetzner Online GmbH | Hosts our main database in Germany. |
| Google Cloud | Runs the services that collect and update lots, our search index, and the storage that serves lot images, in Germany (europe-west3). |
| PostHog, Inc. | Product analytics in its EU data region, as described in section 3. |
| CartoDB Inc. (CARTO) | Supplies map styles and tiles. CARTO receives your IP address, browser information, and the map area requested when a map loads. |
| Plus Five Five, Inc. (Resend) | Delivers emails from Xpact, such as forwarded feedback and invitation and password-reset emails, including the address, the message, and delivery data. |
| Cloudflare, Inc. | Provides DNS for xpact.app. It answers the lookup of our address and does not receive your use of the site. |
| Auction operators and their image hosts | When you open a lot at its source, the operator's website receives ordinary connection data such as your IP address and browser information. |
| Professional advisers and authorities | Only where reasonably necessary to obtain advice, protect rights, or comply with a valid legal requirement. |
We have data processing terms with our service providers where the law requires them. We do not sell personal data, and we do not share it for advertising.
7. International Transfers
Our main database and our servers are in Germany. We are established in the United Kingdom. The UK recognises the European Economic Area as providing adequate protection for personal data.
Some providers, including Vercel, PostHog, CARTO, Google, Resend, Cloudflare, and Telegram, and their subprocessors, may process data in other countries, including the United States. Where the UK GDPR or the EU GDPR applies, we rely on an adequacy decision or the UK extension to the EU-US Data Privacy Framework where available, or on the EU Standard Contractual Clauses with the UK addendum, or the UK International Data Transfer Agreement.
Email support@xpact.app for information about the safeguard for a particular transfer.
8. How Long We Keep Data
| Data | How long we keep it |
|---|---|
| Account, settings, favourites, feed settings and history | Until you delete your account |
| Activity sessions and signals, including IP address and device information | 90 days after the session was last used |
| Product analytics events (PostHog) | 12 months |
| Links you opened at their source, filter use, and reminder records | 12 months, or until you delete your account if sooner |
| Feedback and support messages | 12 months after we have dealt with them |
| Terms acceptance record | For the life of your account, then as long as needed to show acceptance if a claim arises |
| Invitation and password-reset links | A link works for 7 days or until used; the hash of it is kept until you delete your account |
| Telegram connection codes | A code works for 10 minutes or until used; the hash of it is kept until you delete your account |
| Telegram user IDs, the day we first saw them, and decisions to let an account in | For as long as we run the account age check; they are not deleted when you delete your account |
| Count of lots the bot has shown you | Until you delete your account |
| Security and server logs | Up to 30 days |
| Database backups | Up to 30 days before they are overwritten |
| Location on your device | Up to 7 days |
| Sign-in token in the mini app | Until you close the mini app |
| Sign-in token on the website | 24 hours |
When you delete your account, we delete your favourites, feed settings and history, reminders, links to your Telegram account, and your email address and password, and we anonymise the rest of your account record within 30 days. We may keep a minimal record where the law requires it, to show which Terms you accepted if a claim arises, or to prevent serious abuse. Data may remain in backups until they are overwritten.
9. Your Rights
Under the UK GDPR and the EU GDPR, you have the right to:
- be informed about how we use your data;
- access your data and get a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use your data;
- receive data you gave us in a portable format;
- object to processing based on our legitimate interests, including activity sessions in the mini app;
- withdraw consent at any time; and
- complain to a data protection authority.
To delete your account, send /delete to the Xpact bot and confirm, or email support@xpact.app. To change cookie choices on the website, use Cookie settings in the footer. To stop reminders, change them in the bot's settings or send /pause. To stop sharing location, change the permission in your browser or Telegram.
For any other request, email support@xpact.app from the address you want us to reply to and tell us your Telegram username or Xpact account details so we can find your data. We may ask for a little more information to confirm the request is yours. We reply within one month, as the law requires.
You can complain to the UK Information Commissioner's Office (ico.org.uk). If you are in the EU, you can complain to the data protection authority in the country where you live or work, or where you think the problem happened. We would be grateful for the chance to resolve your concern first, but you do not have to contact us before complaining.
10. Children
Xpact is not for people under 18. We do not knowingly provide accounts to children. If you believe a child has given us personal data, contact support@xpact.app and we will delete it where appropriate.
11. Automated Decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The order and matching of lots in your feed are service features and do not decide anything about your rights.
The one automated refusal is the Telegram account age check in section 3: if we estimate that your Telegram account is less than 7 days old, Xpact refuses it automatically. Email support@xpact.app and a person will review the decision.
12. Security
We protect personal data with measures suited to an early-stage online service, including encrypted connections, access controls, signed sign-in tokens, rate limits, monitoring, backups, and limited access for staff. No online service is completely secure, so please keep your Telegram account and devices secure.
13. Other Websites
Xpact links to auction operators and other websites. Their privacy practices are governed by their own policies; please read them before you register, bid, or share information there.
14. Changes to This Policy
We may update this policy when Xpact, our providers, or the law change. The current version and its "last updated" date are always on xpact.app. If a change materially affects how we use your data, we will also tell you through the Xpact bot or on the website, and where new consent is needed, we will ask for it before the new processing starts.
15. Contact
XPNNTL LTD (trading as Xpact)
128 City Road, London, EC1V 2NX, United Kingdom
Email: support@xpact.app