Privacy Policy

1. Information We Collect

• • Email address (when provided by user)
• • IP address
• • Usage data and analytics, including page views, click events, and session duration
• • Session recordings for product improvement
• • Technical data, such as browser type, device, and operating system

2. How We Collect Data

• • Through cookies, local storage, and similar technologies
• • Via analytics tools like PostHog
• • Through direct input from users during sign-up or interaction with forms

3. Legal Basis for Processing (GDPR/UK GDPR)

We rely on the following lawful bases:

• • Consent – for sending marketing communications
• • Legitimate interests – for product improvement and analytics
• • Performance of a contract – when processing data to deliver the service

4. Use of Data

We use the data to:

• • Provide and maintain the xlmonkey service
• • Improve and personalize user experience
• • Monitor system performance
• • Communicate occasional updates and marketing (opt-out available)
• • Fulfill legal or regulatory obligations

5. Use of Cookies

We use cookies to:

• • Authenticate users
• • Analyze usage behavior
• • Store preferences and session state

You may disable cookies via your browser settings, but some features may not function properly.

6. Subprocessors and Data Sharing

We use the following third-party services (subprocessors):

• • Vercel – Hosting and deployment
• • Supabase – Data storage and backend
• • PostHog – Product analytics and session recording

These subprocessors may access personal data only as necessary and are bound by confidentiality and data protection obligations.

7. Data Storage and Security

• • Data is stored in secure, access-controlled environments
• • Encryption is used both in transit and at rest
• • Audit logs track access to sensitive systems

8. International Data Transfers

Where data is transferred outside the UK or EEA, we rely on mechanisms such as standard contractual clauses (SCCs) to ensure equivalent protection.

9. Your Rights (GDPR/CCPA)

You may:

• • Request access to your data
• • Correct inaccurate data
• • Request deletion of your data
• • Object to or restrict processing
• • Withdraw consent at any time
• • Lodge a complaint with a supervisory authority

Contact us at contact@xlmonkey.com to exercise these rights.

10. Data Retention

We retain personal data as long as your account remains active, and for up to 12 months after deactivation unless legally required otherwise.

11. Children's Privacy

Our service is not directed to individuals under 13. If you believe a child has provided personal data without parental consent, please contact us.

12. Data Breach Notification

In the event of a data breach, we will notify affected users and regulatory bodies as required by law within 72 hours of becoming aware.

13. Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated via the platform or email.