Article 1. What Information Do We Collect

What Information Do We Collect

Information you provide directly

We collect personal information you choose to provide when you create an account, contact support, use the Services, make a purchase, or interact with platform features.

This may include:

• first and last name
• email address
• username and account credentials
• profile image
• phone number, if provided
• date of birth
• gender
• address information
• company or business information, where relevant
• support messages, tickets, or other submissions
• user-generated content you upload or publish through the Services

Information collected during login and account use

When you use the platform, we may collect technical and security-related information such as:

• IP address
• device and browser information
• account activity and login events
• approximate and precise location data used for account security and fraud prevention
• timestamps and usage logs

Social login information

If you sign in with Google, we may receive profile information made available by Google, such as your name, email address, profile picture, and other profile data you authorize Google to share.

Payment and billing information

Payments are processed through Stripe. We do not store full payment card details on our own servers. We may store billing-related data such as subscription status, payment references, invoices, and limited transaction metadata needed for accounting, support, and fraud prevention.

Information shared through XWMS clients

When you log in to a third-party client using XWMS, we may share limited profile data with that client based on the scopes granted and the fact that you actively used XWMS to access that client.

Information we do not intentionally collect

We do not intentionally collect biometric data, education records, or audio/video recordings as part of the normal operation of the Services.

Article 2. How Do We Process Your Information

How Do We Process Your Information

We process personal information to operate, secure, and improve the Services.

Main purposes include:

Account creation and authentication

We use your data to register accounts, verify logins, manage profiles, and keep access secure.

Service delivery

We process your information to provide APIs, dashboards, shops, contracts, invoicing, support tooling, and related platform features.

Security and fraud prevention

We use account, device, IP, and location-related data to detect suspicious activity, protect accounts, and investigate misuse.

Payment and billing operations

We process billing and subscription data to handle recurring payments, invoices, renewals, failed payments, and account status changes.

Support and communication

We use your information to respond to support requests, service issues, legal notices, and policy updates.

In limited cases, emails sent by or on behalf of XWMS may include basic delivery or engagement measurement technology to help us confirm delivery, reliability, or message performance.

Client integrations

Where you intentionally sign in to a client through XWMS, we process and disclose limited account data so that client can authenticate you and use the scopes that apply.

Analytics and service improvement

We use analytics and operational logs to improve stability, performance, reliability, and user experience.

Future features

If we introduce new features in the future, including AI-related functionality, we may process additional data where a valid legal basis exists and after updating this Privacy Notice when required.

Article 3. What Legal Bases Do We Rely On To Process Your Information

What Legal Bases Do We Rely On To Process Your Information

Where privacy law requires a legal basis, XWMS relies on one or more of the following:

Performance of a contract

We process your information when necessary to create and manage your account, provide the Services, process subscriptions, and fulfill our obligations to you.

Legitimate interests

We process information where necessary for legitimate business interests such as:

• securing accounts and systems
• preventing fraud and abuse
• improving platform performance and reliability
• maintaining logs and internal administration
• supporting client authentication and integration flows

Consent

Where required, we rely on your consent for specific processing activities, such as certain optional features or non-essential cookies.

Legal obligations

We process information where required for tax, accounting, legal compliance, law-enforcement cooperation, or the protection of legal rights.

Vital interests

In limited cases, we may process information to protect the safety or vital interests of a person.

Article 4. When And With Whom Do We Share Your Personal Information

When And With Whom Do We Share Your Personal Information

We share personal information only where necessary for the operation of the Services, legal compliance, or features you intentionally use.

Service providers

We may share data with providers that help us operate the platform, such as:

• hosting and infrastructure providers
• payment providers such as Stripe
• analytics providers such as Google Analytics
• email and communications providers
• professional advisors where necessary

These parties receive only the data reasonably required for their role.

XWMS clients

If you actively log in to a third-party client using XWMS, that client may receive data based on the scopes available and granted for that flow.

Typical data shared with clients includes:

• name
• email address
• profile picture

Depending on the client's verification status and authorized scopes, additional data such as address data or location-related data may also be shared. Current scope names include:

• user_information
• adress_data
• user_info_extended

A client does not receive this data merely because it exists in XWMS. The user must have actively logged in to that client using XWMS.

Legal and business disclosures

We may disclose information where required by law, to protect rights or safety, or in connection with a merger, acquisition, or asset transfer.

Article 5. What Is Our Stance On Third-party Websites

What Is Our Stance On Third-party Websites

The Services may link to third-party websites, tools, documentation pages, checkout pages, or external services.

Those third parties operate under their own terms and privacy practices. XWMS is not responsible for the content, availability, or privacy practices of websites or services we do not control.

If you choose to interact with third-party services, you should review their own privacy documentation carefully.

Article 6. Do We Use Cookies And Other Tracking Technologies

Do We Use Cookies And Other Tracking Technologies

Yes. XWMS uses cookies and similar technologies for platform operation, language preferences, security, and analytics.

At present, this mainly includes:

• necessary cookies for authentication and session handling
• preference cookies such as language settings
• analytics technologies, including Google Analytics

We do not currently use marketing cookies, retargeting pixels, social media advertising cookies, device fingerprinting, or session-recording tools as part of normal platform operation.

For more detail, please review our Cookie Policy.

Article 7. Do We Offer Artificial Intelligence-based Products

Do We Offer Artificial Intelligence-based Products

At this time, XWMS does not actively offer AI-based products or AI-powered platform features.

If AI-based features are introduced in the future, we will update this Privacy Notice before or when those features are launched, including a description of what data is processed and for what purpose.

Article 8. How Do We Handle Your Social Logins

How Do We Handle Your Social Logins

XWMS currently supports social login through Google.

When you use Google login, we may receive profile data that Google makes available under the permissions you approve. This can include your name, email address, profile picture, and other basic profile information.

We use this information to authenticate you, create or link your XWMS account, and support related sign-in functionality.

We do not control Google's own handling of your information. You should review Google's privacy documentation for more details.

Article 9. Is Your Information Transferred Internationally

Is Your Information Transferred Internationally

The Services are currently hosted in Germany, and backups are also maintained in Germany.

We aim to keep personal data processing within the European Union wherever reasonably possible. If we use a provider outside the EEA in the future, we will rely on appropriate safeguards where required by law.

If you use the Services from outside the EU, your information may still be processed in the EU as part of normal platform operation.

Article 10. How Long Do We Keep Your Information

How Long Do We Keep Your Information

We generally keep account-related information for as long as your account remains active, unless you ask us to delete or anonymize it sooner.

If you request deletion, we may remove or irreversibly anonymize personal data where possible. However, some records may need to be retained for legal, accounting, fraud-prevention, or security reasons.

Examples of data that may be retained longer include:

• invoices
• payment records
• records required for tax or accounting obligations
• security logs where retention is reasonably necessary

Backup copies may also continue to exist for a limited period until they are overwritten in the normal backup cycle.

Article 11. How Do We Keep Your Information Safe

How Do We Keep Your Information Safe

We use reasonable technical and organizational measures to protect personal information.

These measures may include:

• encrypted connections
• access controls and least-privilege permissions
• account security checks
• monitoring for suspicious activity
• backup and recovery procedures

No platform can guarantee absolute security. You should also help protect your account by using strong credentials, safeguarding your login methods, and notifying us promptly if you suspect unauthorized access.

Article 12. What Are Your Privacy Rights

What Are Your Privacy Rights

Depending on your location and the laws that apply, you may have rights such as:

• the right to access your personal information
• the right to correct inaccurate information
• the right to request deletion or anonymization
• the right to object to or restrict certain processing
• the right to request data portability where applicable
• the right to withdraw consent where processing is based on consent

You can exercise relevant rights by contacting us through the channels provided on the platform or through the contact details made available by XWMS.

XWMS does not currently send marketing emails as part of normal platform operation, but service-related emails and legal notices may still be sent where necessary.

Article 13. Controls For Do-not-track Features

Controls For Do-not-track Features

Some browsers offer a Do Not Track (DNT) setting. At present, there is no consistent industry standard for how DNT signals must be handled.

For that reason, XWMS does not currently respond to DNT signals in a uniform way.

XWMS also does not currently support Global Privacy Control (GPC) as an automated browser-based preference signal.

Article 14. Do United States Residents Have Specific Privacy Rights

Do United States Residents Have Specific Privacy Rights

If you live in a U.S. state with an applicable privacy law, you may have rights to access, correct, delete, or obtain details about the personal information we process about you.

Categories of personal information collected in the past 12 months

| Category | Examples | Collected? | | --- | --- | --- | | A. Identifiers | Name, email, IP address, account name, address | YES | | B. Customer records data | Contact and billing details | YES | | C. Protected characteristics | Age and gender where provided | YES | | D. Commercial information | Subscription, invoice, and payment-related records | YES | | E. Biometric information | Fingerprints, voiceprints, facial templates | NO | | F. Internet or network activity | Log data, usage data, account activity | YES | | G. Geolocation data | Approximate and precise location used for security | YES | | H. Audio, visual, or sensory data | Audio or video recordings | NO | | I. Professional information | Company or business details where provided | YES | | J. Education information | Student or education records | NO | | K. Inferences | Marketing or behavioral profiles | NO | | L. Sensitive personal information | Precise geolocation and certain account-related security data | YES |

Selling and targeted advertising

XWMS does not currently sell personal information and does not currently use targeted advertising cookies or marketing profiling as part of normal platform operation.

Exercising your rights

Where applicable, you may contact us to submit a rights request. We may need to verify your identity before responding.

Article 15. Do Other Regions Have Specific Privacy Rights

Do Other Regions Have Specific Privacy Rights

Depending on where you live, you may have additional rights under local privacy law.

Australia and New Zealand

Users in Australia and New Zealand may have rights to access and correct personal information and to complain to the relevant privacy authority.

South Africa

Users in South Africa may have rights under POPIA and related laws, including rights of access, correction, and complaint.

If local law grants you specific privacy rights, you may contact us to exercise those rights and we will assess the request under the laws that apply.

Article 16. Do We Make Updates To This Notice

Do We Make Updates To This Notice

Yes. We may update this Privacy Notice from time to time to reflect changes in the law, the platform, or our data handling practices.

When updates are made, the revised version will be published on the Privacy Policy page. Material changes may also be communicated through dashboard notifications or email where appropriate.

Article 17. How Can You Review, Update, Or Delete The Data We Collect From You

How Can You Review, Update, Or Delete The Data We Collect From You

You may request access to your data, correction of inaccurate information, or deletion/anonymization of your account-related information.

Where available, you may also update part of your information through your account settings.

If you request deletion, XWMS may anonymize identifying information rather than fully erase every underlying record. This is because some records, such as invoice and payment records, may need to be retained for legal or accounting purposes.

If you want to submit a request, please contact us through the contact options made available by XWMS.

Article 18. Data We Do Not Collect

Data We Do Not Collect

As part of normal platform operation, XWMS does not intentionally collect the following categories of data:

• biometric templates or biometric identifiers
• audio recordings or video recordings for platform monitoring
• education records
• device fingerprinting data
• marketing or advertising profiles based on cross-site tracking

If this changes in the future, the Privacy Notice will be updated before or when those changes take effect, where required by law.