Privacy Policy

1. Overview

We care about privacy. We do not sell your personal data. We only use your information to operate the xengo service.

We do not sell your information to third parties, and we do not use your contact details for anything beyond providing the service directly to you.

2. What We Collect

We collect data when you create an account, use xengo, interact with shortened URLs or QR codes, contact support, authenticate via Single Sign-On, engage with our marketing, or add sub-users to your workspace.

We process timestamps, IP addresses, geolocation, device specifications, browser information and cookies. For shared workspace members we process names, email addresses, login timestamps, permissions and access logs.

3. How We Use Your Data

We use the information we collect to deliver the platform, manage accounts, send notifications, prevent fraud, improve the experience, authenticate users and provide customer support.

We also rely on legitimate interests including security audits, legal compliance, usage analysis and service optimisation.

4. Purposes and Legal Bases (UK GDPR)

For each purpose we process personal data under one of the lawful bases in Article 6 UK GDPR:

• Providing the service (accounts, links, QR codes, billing) — performance of a contract (Art. 6(1)(b)).
• Security, fraud prevention and abuse monitoring — legitimate interests (Art. 6(1)(f)).
• Analytics and advertising measurement (Google Analytics, Microsoft Clarity, ad-click attribution) — your consent (Art. 6(1)(a)), collected via the cookie banner for UK/EU visitors; you can withdraw it at any time (see Cookies below).
• Marketing emails — your consent, with a working unsubscribe link in every message.
• Tax, accounting and legal obligations — legal obligation (Art. 6(1)(c)).

5. Sharing Your Data

We do not sell your personal data. We share data with vendors under contract, analytics services, cloud hosting providers, legal authorities where required, professional advisors, other users when you intentionally share content, and within the Synvu Limited group of companies.

6. Cookies and Device Data

We use cookies and device data for authentication, link-activity monitoring, usage analysis and feature testing. The specific tools and cookies we use are:

• Essential cookies — sign-in sessions and your cookie choice itself (xengo_consent). These are required for the site to work and do not track you.
• Google Analytics 4 (Google LLC) — aggregate usage statistics. Google collects and receives data where these cookies run; see the Google Privacy Policy. Until you consent, Google tags run in cookieless “consent mode” and set no cookies.
• Microsoft Clarity (Microsoft Corporation) — anonymised session analysis such as scroll depth and heatmaps. Microsoft collects and receives data where Clarity runs; see the Microsoft Privacy Statement.
• Advertising attribution — a first-party cookie (xengo_attr, 90 days) stores the click identifier from an ad you arrived through (for example Google Ads gclid or Microsoft Advertising msclkid) plus campaign UTM labels, so that if you later start a trial we can tell the advertising platform that its ad worked. We report the conversion event only — we do not share your name, email or account contents with ad platforms. No personal or sensitive data is passed to any tag in URLs or parameters.

Consent. If you are visiting from the UK or EU, none of the analytics or advertising cookies above are set until you choose “Accept all” on the cookie banner. Elsewhere they are on by default and you can switch them off with “Essential only”. You can change your choice at any time via cookie preferences.

7. Storage and Retention

We retain personal data for as long as necessary to deliver the service, resolve disputes and meet legal obligations. Audit logs may be retained for up to three years, and billing records for as long as the law requires. Anonymised data may be retained indefinitely.

8. Security Measures

We implement encryption, role-based access controls, audit logging and vulnerability assessments. However, no method of transmission or storage is 100% secure.

9. Children’s Privacy

xengo is not designed for users under thirteen years old, and we do not knowingly collect personal data from children.

10. Your Rights and Choices

Under UK GDPR (Articles 15–21) you can access, correct, delete, restrict the processing of, port, or object to the use of your personal data. To make a request, contact us at contact@xengo.io — we respond within one month.

Where processing is based on consent you can withdraw it at any time (Art. 7(3)): use the cookie preferences banner for analytics and advertising cookies, or the unsubscribe link in any marketing email. Withdrawing consent does not affect processing that happened before you withdrew it.

If you are unhappy with how we handle your data you have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

11. Changes to This Policy

We may update this Privacy Policy from time to time and will notify you of any significant changes.

12. Legal Disclaimers

xengo disclaims warranties and liability for service interruptions, for content distributed through the platform, and for the privacy practices of third-party linked sites. You are responsible for your own legal compliance.