Privacy Policy

1. Introduction

XAPI China ("we", "us", "our") provides an unofficial REST API for accessing publicly available used car listing data from che168.com. This Privacy Policy explains what personal data we collect when you use our website and API services, why we collect it, and how we handle it.

2. Data we collect

• Account information. When you sign up we collect your name, email address and a hashed password. We never store passwords in plain text.
• Billing information. Paid subscriptions are processed by our payment provider. We do not receive or store your full card or bank details. We only receive a confirmation of payment, the plan purchased and a transaction reference.
• API usage data. We log API requests made with your API key (endpoint, timestamp, request volume and originating IP address) to enforce plan limits, secure the service and improve reliability.
• Technical data. Standard server logs including IP address, browser type and pages visited on our website.

3. How we use your data

• To create and manage your account and API keys.
• To process subscription payments and manage billing.
• To enforce rate limits and plan quotas.
• To respond to support requests.
• To detect abuse, fraud or security incidents.
• To send essential service communications (e.g. password resets, billing notices).

We do not sell your personal data, and we do not use it for third-party advertising.

4. Third-party services

We share data only with service providers necessary to operate XAPI China: our payment processor (Creem.io, acting as merchant of record) for handling subscriptions, and our hosting and infrastructure providers for running the website, API and database. Each provider processes data only as needed to deliver their service.

5. Data retention

We keep your account data for as long as your account is active. API usage and billing records may be retained for accounting, security, and legal requirements. Deleting your account revokes API access, stops subscription renewal, and removes your sign-in. Contact support to request removal of any retained personal data.

6. Cookies

We use only essential cookies required to keep you signed in and to secure your session. We do not use advertising or cross-site tracking cookies.

7. Your rights

You may access, correct or delete your personal data at any time from your account settings, or by contacting us. Depending on your jurisdiction (including under the GDPR if you are in the EU/EEA), you may also have the right to data portability, to restrict processing and to lodge a complaint with a supervisory authority.

8. Security

We protect your data using industry-standard measures including encrypted connections (HTTPS/TLS), hashed passwords and access controls. No method of transmission or storage is 100% secure, but we work to protect your information appropriately.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated "Last updated" date. Continued use of the service after changes take effect constitutes acceptance of the revised policy.

10. Contact

For any privacy questions or requests, contact us at [email protected].