Privacy Policy

Last updated: October 30, 2026

This panel (kicla.com) is Kicla, the multichannel panel for products, orders and shipping, and it manages accounts, purchases and license keys for the WordPress plugin Kicla – eBay Sync for WooCommerce, developed and operated by BullXen (Italian VAT number 04472980160). This policy explains what data we collect through this panel and through the plugin installed on your site, and how we handle it.

Data controller

BullXen — VAT number 04472980160. For any request regarding your personal data: [email protected].

Data we collect

• Panel account — if you register to purchase or manage a license: name, email, password (stored as a hash, never in plain text).
• Collaborators — if the owner of an account invites you as a partner or staff: the name they gave you, your email (they may give it to email you the invitation), your password (stored as a hash, never in plain text) and when you last used the panel. The owner sees them and can remove your access: then they are deleted, as when the account is closed.
• Daily plugin check-in (Free plan) — if you use the plugin without a license, once a day your site sends us only its domain name and plugin/WordPress/WooCommerce version numbers, so we can see which sites run the free version. No license key (you don't have one), no product, order or customer data.
• Daily plugin check-in (active Pro license) — your license key and domain, to confirm the license is still valid (also on activation/deactivation). If the license is active, we additionally receive usage data for support and analytics: your eBay listing counts by status, number of connected eBay accounts, plugin/WordPress/WooCommerce version numbers, the date of your last successful eBay sync, and — for orders placed since the last check — each order's ID, date, total amount and currency. Never your end customers' names, emails, addresses or other personal data, on either the Free or Pro plan.
• Support requests — the form opened by the plugin (Settings → Support) sends your domain, your email, the message you write, and plugin/WordPress/WooCommerce version numbers, so we can reply by email.
• Products and orders from the channels you connect (Kicla panel) — from your WooCommerce store (including the eBay orders the plugin brings into the store) and from the Vinted and Wallapop sale emails you forward to your Kicla address: products (title, code, prices, stock, photos, warehouse location) and orders (number, date, amounts, status, items sold).
• Your customers' data — about the people who buy from you we keep only name, email, phone number and shipping address, taken from the order (shipping address, or billing address when there's none) or from the sale email (for eBay, the email is the "relay" address eBay forwards to the buyer; for Vinted, name, address and email from the buyer's details in the sale email; for Wallapop, only the username), plus what you add or correct yourself on an order. They are only there to show them to you in the panel, to ship, to invoice and to contact the buyer. We don't use them for anything else and we don't share them with anyone. For this data you are the controller: BullXen processes it on your behalf, as a processor (art. 28 GDPR).
• Forwarded sale emails — from the Vinted and Wallapop emails that reach your Kicla address we read the order details; of the email itself we keep only the sender, subject and outcome of the last 20, not the text. The exception is a sale email that didn't become an order (Kicla couldn't read it, it looked like a duplicate, or the channel wasn't connected yet): its text, with the buyer's details, stays for at most 30 days, so you can try again from Sync, then it's deleted.
• Payments — handled entirely by Stripe (see below): we never see or store your card details.
• Minimal technical data — IP address and user agent in security logs (e.g. login attempts), to spot abuse or errors.

We don't collect anything else: no tracking or analytics cookies in the panel (the public pages of the site use Google Analytics only if you accept, see below), no browsing-behavior profiling, and nothing about your store's customers beyond what is written above: addresses, notes and payments stay between your store, eBay and you.

Third-party services we use

• Stripe — processes Pro payments and subscriptions (checkout, renewal, billing, EU VAT via Stripe Tax). Receives the payment and billing data it needs, per Stripe's own privacy policy.
• Google — if you sign in or sign up with Google, Google confirms the name and email of your Google account to us: we never receive your Google password, under Google's privacy policy.
• Google Analytics — only on the public pages of the site (home, plugin page, privacy and terms: never in the panel) and only if you click "Accept" in the cookie bar: it counts visits and which pages are viewed, with Google cookies (_ga) that last up to 2 years, so we can improve the site. If you decline, nothing is loaded. Data is processed by Google under Google's privacy policy. Change your choice
• Cloudflare — sits in front of the panel (protection and speed) and routes the sale emails you forward to your Kicla address: pages and emails pass through its servers, under Cloudflare's privacy policy.
• Brevo — sends your account emails (address confirmation, new password) and collaborators' invitations: it receives your email, the link to send you and, for an invitation, your name and the account's, under Brevo's privacy policy.
• DeepSeek — if you use "From photos (AI)" in Products, the photos you take go to DeepSeek, which looks at them and writes the draft listing: it receives only the photos, no other data about you or your customers. DeepSeek processes data in China, under its privacy policy: photograph the item, not people or labels with addresses. Photos stay in Kicla as long as the product does; unused ones are deleted after two days.
• eBay — if you connect an eBay account from the plugin on your own site, that OAuth connection and the data the plugin exchanges with eBay to publish/sync your listings are described in the plugin's own readme.txt, not by this panel: this panel is not involved in connecting your eBay account.

None of these services receives your data for advertising or profiling purposes.

Where data is stored and how we protect it

Data lives on a private server (VPS) operated by BullXen, in a database we own — not on generic third-party cloud services. Always encrypted connections (HTTPS/TLS), passwords stored only as hashes, database access limited to the application process and the data controller, regular rotated backups.

How long we keep data

For as long as your account or license stays active. If you delete your account, or write to us asking for deletion, the corresponding data is removed from our systems (except what we're required to keep for legal reasons, e.g. accounting/tax records on payments). Check-ins from Free-only domains that never held a license can also be removed on simple request, since they're not tied to an account. Products and orders, with your customers' data, stay for as long as the channel they come from is connected: disconnecting it, or closing your account, removes them from the panel.

Your rights (GDPR)

As a resident of the European Union (or otherwise protected by EU Regulation 2016/679), you have the right to:

• Access — obtain a copy of the personal data we process about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your account or the data concerning you.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — withdraw any previously given consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights (or for any question) write to [email protected]. We reply within 30 days.

Changes to this policy

Any substantial change to how we process your data will be communicated by email, in addition to updating the date at the top of this page. Continuing to use the panel or the plugin after an update counts as acknowledgment of the changes.