Your sources. Your credentials. Your device.

What stays on your device

Content-provider credentials, playlist addresses and optional third-party metadata service credentials or API tokens are not accepted by XULU’s subscription API. The player stores those source settings locally on the television. They may be sent directly from your device to the provider you chose when needed to load content or metadata. Local storage still depends on the security of your device, account and home network.

What the platform processes

Device labels and platform, subscription and payment references, reseller username and account status, and auditable credit transactions. Authentication tokens and temporary activation codes are stored as hashes. Short-lived, keyed rate-limit identifiers help prevent abuse; IP addresses are not device identity.

External services

Payment, managed sign-in, hosting, support and security providers process information needed for their functions under their own terms. Content and metadata requests go to providers selected by the user. XULU does not control their collection, accuracy, availability, quotas or security. This is not a claim of zero data collection or zero risk.

Security and your choices

We use access controls, hashing, signed short-lived device entitlements and limited retention designed to protect platform data. No system is completely secure. Keep television access, local setup codes and third-party credentials private. Subject to applicable law, you may request access, correction or deletion of platform personal data; some transaction, fraud-prevention and legal records may need to be retained.

Purpose and legal basis

We process platform data to provide activation and subscriptions, secure accounts, prevent abuse, support customers, keep transaction records and meet legal duties. Depending on the applicable law, this processing is based on performing our contract, legitimate interests in operating and protecting the service, legal obligations, or consent where consent is required. The public website may use essential storage needed for security and session operation; optional analytics or marketing technologies require the choice required by applicable law.

International processing and complaints

Service providers may process data in countries different from yours. Where required, we use contractual or other lawful safeguards for those transfers. You may contact us to exercise applicable privacy rights or object to certain processing. You may also complain to the data-protection authority available under your local law.

Children

XULU subscriptions and reseller accounts are intended for adults able to enter a binding agreement. The service is not directed to children and we do not knowingly request children’s personal information. A parent or guardian is responsible for household use and content-source access.

Retention and contact

Activation and device records are kept while a subscription is active and for up to 24 months afterwards for support, fraud prevention and dispute handling. Payment and transaction references, audit records and records required for tax or legal compliance may be kept for up to seven years. Temporary activation, management and rate-limit records expire automatically. Support correspondence is normally kept for up to 24 months. Records may be retained longer when required by law, an unresolved dispute or security investigation, and are then deleted or anonymised when no longer needed.

Privacy requests: xulu@soulid.co

Effective 16 September 2026. Operator: XULU, operated under the Soulid.co brand. Support: xulu@soulid.co.