Privacy Policy

Xalgorix Labs is the data controller for personal data processed via the Service. Contact our DPO at privacy@xalgorix.com.

Account data: email, name, hashed password (or Google OAuth identifier), company.

Billing data: plan, credit balance, invoices. Card data is handled by our payment processor (Dodo Payments) — we never see or store it.

Scan data: target URLs, scan configurations, findings, and evidence you generate.

Usage logs: IP address, user agent, timestamps. Kept 30 days for security and abuse prevention.

To provide and improve the Service, bill you, secure the platform, and meet legal obligations. Legal bases under GDPR: contract (most processing), legitimate interest (security, abuse prevention), and consent (optional marketing only).

All customer data is stored in EU regions (primary: Frankfurt; backup: Dublin). We do not transfer personal data outside the EU/UK except through Standard Contractual Clauses with named sub-processors.

Account & billing: lifetime of account + 7 years (tax law).

Scan data & findings: lifetime of account, deletable on demand.

Logs: 30 days.

After account closure: 30-day grace window, then permanent deletion.

Only the sub-processors we publish: Cloudflare (edge + storage, EU), Supabase (managed Postgres + authentication, EU), Dodo Payments (billing), and Resend (transactional email). Full current list at /security. We do not sell personal data.

Under GDPR you have the right to access, rectify, erase, port, restrict, and object to processing of your personal data, and to lodge a complaint with your supervisory authority. Email privacy@xalgorix.com — we respond within 30 days. To exercise access, correction, or erasure you can also email us; self-serve export and account deletion are being rolled out in-app.

If you are in India, Xalgorix Labs processes your personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023. We give notice of what we collect and why at or before collection, and process it on the basis of your consent or another legitimate use permitted by the Act.

Withdraw consent. You can withdraw consent at any time — as easily as you gave it — by emailing privacy@xalgorix.com. Withdrawal does not affect processing already carried out and may limit features that depend on the data.

Your DPDP rights. Access a summary of your personal data and its processing; correction, completion, and updating; erasure; grievance redressal; and the right to nominate another individual to exercise your rights in the event of your death or incapacity.

Breach notification. In the event of a personal data breach, we will notify the Data Protection Board of India and affected data principals as required by the Act.

For DPDP grievances or any question about how we handle your personal data, contact our Grievance Officer — Xalgorix Labs, grievance@xalgorix.com. We acknowledge grievances promptly and work to resolve them within the timelines prescribed under Indian law.

We use strictly necessary cookies only (authentication, CSRF, preferences). No tracking, no advertising cookies. Details in our Cookie Policy.

The Service is not directed to children. Under India's DPDP Act a child is anyone under 18; we do not knowingly process a child's personal data without verifiable consent from a parent or lawful guardian, and we never track or target advertising at children. Elsewhere we apply the local minimum age (16 in the EU). If you believe a child has provided us data, contact privacy@xalgorix.com and we will delete it.

We post material updates on this page and notify account holders by email at least 30 days before they take effect.