Privacy policy
1. Who this applies to
This policy applies to visitors to our website, trial users, paying customers, and individuals whose personal data we process in connection with the Service (for example account holders and, where applicable, individuals whose details appear in an organization’s account).
2. Data we collect
2.1 You provide
- Account data: name, email address, password (stored securely), organization name, and similar registration fields.
- Support & communications: content of emails or messages you send us.
- Payment metadata: billing handled by our payment provider; we may receive limited identifiers and subscription status, not full card numbers.
2.2 Automatically
- Technical & usage data: IP address, browser type, approximate location, timestamps, and product usage events needed to operate and secure the Service.
- Cookies & similar technologies: our marketing site may use analytics (e.g. Google Analytics) as described in your browser settings and any cookie banner we deploy.
2.3 From organizations using the Service
Customers may upload personal data about third parties (clients, owners, tenants). We process that data only on their instructions as described in our GDPR materials and any data processing terms.
3. Purposes & legal bases (UK GDPR)
- Providing the Service — contract (Article 6(1)(b)).
- Security, abuse prevention, and legal compliance — legitimate interests (Article 6(1)(f)) and legal obligation (Article 6(1)(c)) where applicable.
- Marketing communications — consent or legitimate interests, as appropriate; you may opt out of non-essential communications.
- Analytics on the public website — consent or legitimate interests, depending on configuration and jurisdiction.
4. Sharing & subprocessors
We use trusted service providers (hosting, email delivery, payments, analytics) who process data on our instructions. We may disclose information if required by law or to protect rights and safety. A list of key categories of subprocessors is available on request and summarized on our GDPR page.
5. International transfers
Data may be processed in the United Kingdom, the European Economic Area, and other countries where providers operate. Where we transfer personal data outside the UK/EEA, we use appropriate safeguards (e.g. UK IDTA / EU Standard Contractual Clauses) where required.
6. Retention
We retain personal data only as long as needed for the purposes above, including legal, tax, and dispute resolution. Account data is typically retained for the life of the account and a limited period afterwards unless law requires longer retention.
7. Security
We implement technical and organisational measures appropriate to the risk (encryption in transit, access controls, separation of environments). No method of transmission over the Internet is completely secure.
8. Your rights
Under UK GDPR / EU GDPR (where applicable), you may have rights to access, rectify, erase, restrict, or object to processing, and to data portability. You may lodge a complaint with the ICO (UK) or your local supervisory authority. To exercise rights, contact us via Contact. Account holders may also manage some data through the portal.
9. Children
The Service is not directed at children. We do not knowingly collect personal data from children without appropriate consent.
10. Changes
We may update this policy; the “Last updated” date will change. Material changes may be communicated by email or in-product notice.
11. Contact
Data protection enquiries: Contact us. You may also write to Xegen Ltd at your registered correspondence address on file with Companies House.