Privacy at XEMACH
Updated 31 October 2026. Shanghai Xemach Machinery Equipment Co., Ltd. operates XEMACH and the XEMACH Account Center, which provides shared sign-in for xemach.com and XCMG Hub at xcmghub.com. This notice covers the XEMACH website and the shared account service used by both websites. Contact us at info@xemach.com about your personal information.
Google sign-in: information we access
Google sign-in is optional. When you choose it and authorize our app, we request only the openid, email and profile permissions. Google returns a unique account identifier, your name, email address and email-verification status, together with authentication information used to validate the sign-in. We store the identifier, name, email address and account creation time to recognize your membership. We do not store or display a Google profile photo, even if Google includes one in the basic profile response.
We do not receive your Google password. We do not request access to Gmail messages, contacts, Google Drive files, calendars or the ability to send email on your behalf. Google authorization codes and tokens are processed to verify the sign-in; we do not keep Google access or refresh tokens as part of your member record or use them to access other Google services.
How we use Google and membership information
We use Google identity information to authenticate you, create or recognize your account, display your name and email in your account, and connect your sign-in across XEMACH and XCMG Hub. You may also provide or update your name, company name, country or region and WhatsApp number. Authorized administrators use this information to review membership applications, provide account support and manage access permissions. Membership status, approval decisions, permission changes and related audit records are also stored.
Signing in with Google does not subscribe you to marketing or automatically approve business access. New memberships begin pending review. Pending members can edit their own personal details; access to business records and member prices requires separate approval. A company name in your profile does not by itself grant access to that company's records. Existing username-and-password accounts remain available; linking Google to an existing account requires signing in to that account first.
What the two websites share
The account center is hosted on xemach.com. When you sign in from XCMG Hub, your browser visits the account center and returns to xcmghub.com. The websites exchange a short-lived authorization code through an authenticated server connection. XCMG Hub can receive your shared member identifier, name, email address, Google-connection indicator, membership level, review status or rejection note, and access permissions so it can display your account and enforce access decisions.
Each website maintains its own first-party session cookie. XCMG Hub stores its login state and session credentials in a separate database; it does not directly access the XEMACH customer database or receive your Google password or Google tokens. Signing out through the shared account controls revokes the shared session, although another open tab may show the previous screen until it refreshes or checks the session again.
Storage, security and access to data
We store shared identities, membership profiles and review history in Cloudflare D1, separately from XEMACH business records and XCMG Hub session storage. Cloudflare also provides the Workers and Pages infrastructure that processes account requests. HTTPS protects data in transit, and server-side access controls restrict private records to authorized users and administrators. Password accounts use password hashes, not stored plaintext passwords. Session cookies are marked Secure and HttpOnly in production.
For account security, we process request metadata, hashed IP-based identifiers, login times, limited browser information, rate-limit records and audit events. These security records are separate from public website analytics. Cloudflare and Google may process network and service data under their own privacy notices. Our team operates in China, and our service providers operate internationally, so information may be processed outside your country.
Sharing and limits on use
Google-derived identity data is used for the sign-in and account functions described here. We do not sell it, use it for targeted advertising, share it with advertising networks, or use it to train general-purpose artificial intelligence models. Access is limited to the shared websites, authorized personnel handling accounts and support, and service providers operating this service. We may also disclose information when required by applicable law or necessary to address fraud, abuse or security incidents. Google identity information is not joined to public browsing analytics.
Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its applicable Limited Use requirements. Google sign-in itself is also governed by Google's privacy policy.
Google API Services User Data Policy · Google Privacy Policy · Cloudflare Privacy Policy
Retention, account deletion and your choices
We retain account profiles and membership review records while the account is maintained and as needed to provide service, resolve disputes, protect account security and meet applicable record-keeping obligations. Profiles are not automatically deleted when you sign out or remove Google's authorization. Login attempts expire after a short period, and shared sessions expire after no more than eight hours; expired state is removed by scheduled or periodic cleanup. Backups and business or audit records may remain where needed for recovery, security or legal obligations.
You can edit the personal fields available in your dashboard. To request access to, correction of, or deletion of your shared account and Google-derived data, email info@xemach.com from your registered address and identify the account. We may verify your identity before acting. A shared-account deletion request covers its identity and profile on both websites; we will explain any records that must be retained and why. Account deletion is handled by our team, not an automatic dashboard button.
You can stop future Google authorization by removing XEMACH in your Google Account's third-party connections settings. This does not automatically delete information already held by XEMACH or end an existing website session: sign out of the websites as well, and contact us if you want your account deleted. If Google is your only sign-in method, removing access may prevent you from signing in again until you authorize it again or contact support. Public equipment pages can be browsed without an account.
Manage your Google third-party connections · Contact XEMACH about your data
Enquiries and customer accounts
We use the details you send us to respond to enquiries and manage customer accounts, equipment, orders, shipments and service requests. The enquiry form prepares a message for your email or WhatsApp app; clicking a button does not by itself send that message. Private account pages are excluded from our website analytics.
Website measurements
We measure public page visits, visit times, approximate country, device and browser category, language, referring website, campaign labels, active browsing time and enquiry-button clicks to understand and improve the website. Our own script sends these measurements to xemach.com and stores them in Cloudflare D1. Detailed measurements are retained for 90 days and reports are restricted to administrators.
The analytics script uses a random session identifier in this tab's session storage, renewed after 30 minutes of inactivity. It does not use analytics cookies, fingerprinting or cross-site identifiers. Analytics records do not contain raw IP addresses, full browser identifiers, form contents, messages or account details. Referrals retain only the website hostname; page query strings and fragments are excluded. Enquiry clicks indicate interest, not messages sent.
Your browser choices
Our analytics respects Do Not Track and Global Privacy Control browser signals. Browser blocking or disabled JavaScript can also prevent collection. We do not attempt to bypass these choices.
Hosting, security and external services
Cloudflare provides hosting, delivery and security, including Turnstile on sign-in. Network requests necessarily include an IP address and browser information; security processing is separate from our website analytics. Sign-in uses essential session cookies, and display preferences may be stored in your browser. Cloudflare Web Analytics' browser beacon is disabled. Email, WhatsApp and other linked services have their own privacy notices.
Contact and updates
For questions about your information or to request access, correction or deletion, contact info@xemach.com. We will update this page when our practices change.