Legal

Privacy Policy

Xelo Media World LTD · Last updated: 15 June 2026 · Effective: 15 June 2026

This Privacy Policy explains how Xelo Media World LTD ("Xelo", "we", "us") collects, uses, and protects your personal data when you use the Xelo platform at brokers.xelo.media and related services. We are committed to GDPR compliance and protecting your rights as a data subject.

1. Data Controller

Xelo Media World LTD
Email: hello@xelo.media

As data controller we determine the purposes and means of processing your personal data. For data protection enquiries contact us at the email above.

2. Data We Collect

We collect the following categories of personal data:

Account data: Name, email address, professional role, agency name.
Property data: Property photos, addresses, and listing descriptions you upload.
Agent media: Your headshot photo and voice recording (if you use the AI avatar feature), used solely to generate your personal broker intro.
Usage data: Pages visited, features used, video generation logs, timestamps.
Payment data: Billing address and VAT number. Card details are processed by Stripe and never stored by us.
Communications: Emails and support messages you send to us.
Technical data: IP address, browser type, device identifiers, referring URL.

3. Purpose and Legal Basis (GDPR Art. 6)

Contract performance (Art. 6.1.b): Processing your account data, property uploads, and generating videos — necessary to deliver the Service.
Legitimate interests (Art. 6.1.f): Usage analytics to improve the platform, fraud prevention, security monitoring.
Legal obligation (Art. 6.1.c): Retaining billing records as required by EU accounting law.
Consent (Art. 6.1.a): Marketing emails — you may withdraw consent at any time.

4. Special Category Data

Your headshot and voice recording are biometric-adjacent data processed under Art. 9.2.a (explicit consent) solely to create your AI avatar. You may delete this data at any time from your account settings, which immediately disables the avatar feature.

5. How We Use Your Data

To create and manage your account
To generate property videos and AI-written descriptions
To publish your listings to Xelo Market (paying subscribers only)
To process payments and issue invoices
To send transactional emails (video ready, payment confirmation)
To send product updates and feature announcements (opt-out any time)
To detect and prevent fraud and abuse
To comply with legal obligations

6. Data Retention

Account data: Retained for the duration of your subscription plus 30 days after cancellation.
Property photos and videos: Retained for 90 days after generation, then permanently deleted unless you save them to your account.
Agent media (headshot, voice): Retained until you delete it or close your account.
Billing records: Retained for 7 years as required by EU accounting regulations.
Usage logs: Retained for 12 months then anonymised.

7. Your Rights Under GDPR

Users may exercise certain rights regarding their Data processed by the Owner. In particular, Users have the right to do the following, to the extent permitted by law:

Withdraw consent (Art. 7)

Withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right of Access (Art. 15)

Learn if Data is being processed, obtain disclosure regarding certain aspects of processing, and receive a copy of the Data undergoing processing.

Right to Rectification (Art. 16)

Verify the accuracy of your Data and ask for it to be updated or corrected.

Right to Erasure (Art. 17)

Obtain erasure of your Data from the Owner ("right to be forgotten"), subject to applicable exceptions.

Right to Restrict (Art. 18)

Restrict the processing of your Data. The Owner will not process it for any purpose other than storing it.

Right to Portability (Art. 20)

Receive your Data in a structured, commonly used, machine-readable format and, if technically feasible, have it transmitted to another controller.

Right to Object (Art. 21)

Object to processing carried out for legitimate interests or for direct marketing. For direct marketing you may object at any time, free of charge, without justification.

Lodge a complaint

Bring a claim before your competent data protection authority. For Estonia: aki.ee.

How to exercise these rights: Any requests to exercise User rights can be directed to the Owner through the contact details provided in this document. Such requests are free of charge and will be answered by the Owner as early as possible and always within one month, providing Users with the information required by law. Any rectification or erasure of Personal Data or restriction of processing will be communicated by the Owner to each recipient to whom the Personal Data has been disclosed, unless this proves impossible or involves disproportionate effort.

8. Third-Party Processors

We share your data only with trusted processors acting on our behalf under data processing agreements:

Stripe — Payment processing (USA, EU–US Data Privacy Framework)
Supabase — Database hosting (EU region)
Cloudflare — CDN and storage (EU region where possible)
Google — Street View and Aerial View APIs (property address only, no personal data)
Anthropic — AI text generation (property descriptions only, no personal data)
ElevenLabs — Voice cloning (your voice recording, processed under consent)
HeyGen — AI avatar generation (your headshot, processed under consent)

We do not sell your data to third parties. We do not use your data for advertising profiling.

9. Cookies

We use the following cookies:

Essential cookies: Session management and security. Cannot be disabled.
Analytics cookies: Anonymous usage statistics to improve the platform. You may opt out.
Font cookies: Google Fonts loads fonts from Google's servers, which may set a cookie. No personal data is shared.

10. International Transfers

Some processors (Stripe, Anthropic, ElevenLabs, HeyGen) are based in the United States. Transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, or by the EU–US Data Privacy Framework where applicable.

11. Children

The Service is not directed to individuals under 18. We do not knowingly collect data from minors. If you believe we have inadvertently collected such data, contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated by email at least 14 days before taking effect. The current version is always available at brokers.xelo.media/privacy.

13. Definitions and Legal References

Personal Data (or Data) — Any information that directly, indirectly, or in connection with other information — including a personal identification number — allows for the identification or identifiability of a natural person.

Usage Data — Information collected automatically through this Application, which can include: IP addresses or domain names of computers used by Users, URI addresses, time of the request, method used to submit the request, size of the file received in response, numerical code indicating server status, country of origin, browser and operating system features, time details per visit, path followed within the Application, and other parameters about the device operating system and/or the User's IT environment.

User — The individual using this Application who, unless otherwise specified, coincides with the Data Subject.

Data Subject — The natural person to whom the Personal Data refers.

Data Processor (or Processor) — The natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller, as described in this privacy policy.

Data Controller (or Owner) — The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including the security measures concerning the operation and use of this Application.

European Union (or EU) — Unless otherwise specified, all references made within this document to the European Union include all current member states to the European Union and the European Economic Area.

This Application — The means by which the Personal Data of the User is collected and processed: brokers.xelo.media and associated services.

14. Contact

For any privacy-related questions or to exercise your rights:
Xelo Media World LTD
Email: hello@xelo.media
Website: xelo.media
We will respond to all requests within one month as required by GDPR Art. 12.