Privacy Policy

1. Who we are (controller)

Xenqor Systems LLC
1209 Mountain Road Pl NE, Ste N
Albuquerque, NM 87110, USA
Privacy & support: [email protected]
Billing: [email protected]

For customers in the EEA/UK, Xenqor is the controller of account and website personal data described below, unless we process data solely on your instructions as a processor (see Section 4).

2. Information we collect

• Account data: name, work email, company name, password hashes, user IDs, role/seat information, preferences, and security settings (such as 2FA status).
• Billing & payment data: billing email, company billing details, subscription plan, invoices, tax identifiers where provided, and payment status. When Stripe Checkout is enabled, card numbers and sensitive payment credentials are collected and processed by Stripe; we receive tokens, last4/brand (when available), and transaction metadata—not full PAN/CVC on our servers. Until then, paid invoices may be handled offline with billing@.
• Service & usage data: API keys (stored hashed or masked where applicable), request logs, credit usage, rate-limit metrics, webhook endpoints, channel configurations (email/Slack/Discord/Telegram identifiers you connect; SMS when enabled), delivery receipts, and error diagnostics.
• Customer Content: alert payloads and metadata you submit. You control what you send; avoid unnecessary personal data in messages.
• Technical data: IP address, approximate location derived from IP, browser/device type, referring URLs, and security logs (including login and audit events).
• Communications: support tickets, contact forms, and email correspondence.
• Cookies & similar tech: essential cookies for authentication, security, and preferences (such as theme). We do not currently use third-party advertising or analytics cookies. See our Cookie notice.

3. How we use information

• Provide, operate, secure, and improve the Services
• Authenticate users, protect accounts, and prevent abuse/fraud
• Process subscriptions, renewals, invoices, refunds, and tax documentation (via Stripe when card billing is enabled)
• Deliver alerts to destinations you configure
• Provide customer support and service notices
• Send product or billing communications (you may opt out of non-essential marketing)
• Comply with law, enforce Terms, and respond to lawful requests

4. Customer Content and processor role

When you use Xenqor to send alerts that may include personal data about your end users or systems, you are typically the controller of that Customer Content, and Xenqor acts as a processor/service provider to host and deliver it according to your configuration and our Terms. You are responsible for having a lawful basis to submit such data and for configuring destinations appropriately.

5. Legal bases (GDPR / UK GDPR)

Where GDPR applies, we rely on: (a) performance of a contract; (b) legitimate interests in running a secure B2B SaaS (balanced against your rights); (c) consent where required (e.g., certain cookies or marketing); and (d) legal obligations (tax, accounting, compliance).

6. Sharing and subprocessors

We do not sell personal information for money. We share information with service providers that help us operate the business under contractual confidentiality and data-protection terms, including:

• Stripe — payment processing, invoicing, fraud tools (Stripe Privacy Policy)
• Cloud hosting, CDN, email delivery, SMS/telecom providers (when SMS is enabled)
• Error monitoring, analytics, and customer support tooling
• Professional advisors (legal, accounting) under confidentiality
• Authorities when required by law or to protect rights and safety

Business transfers: if we are involved in a merger, acquisition, or asset sale, personal information may be transferred under appropriate protections.

7. International transfers

We are based in the United States. Personal information may be processed in the U.S. and other countries where we or our providers operate. Where required, we use appropriate safeguards (such as Standard Contractual Clauses or equivalent mechanisms).

8. Retention

We retain account and billing records for as long as your account is active and as needed for tax, accounting, dispute resolution, and legal compliance. Operational logs and delivery records are retained for a limited period for security, debugging, and auditability, then deleted or anonymized. Stripe may retain payment records under its own retention policies and legal obligations.

9. Security

We use administrative, technical, and organizational measures designed to protect personal information, including TLS in transit, access controls, password hashing, optional 2FA, and monitoring. No method of transmission or storage is 100% secure. You are responsible for protecting API keys and destination credentials.

10. Your rights

EEA/UK (GDPR): You may request access, correction, deletion, restriction, portability, or object to certain processing, and withdraw consent where processing is consent-based. You may lodge a complaint with a supervisory authority.

California (CCPA/CPRA): You may request to know, delete, or correct personal information, and to opt out of “sale” or “sharing” as defined by law. We do not sell personal information for monetary consideration. We do not knowingly sell or share personal information of consumers under 16.

To exercise rights, email [email protected]. We may need to verify your identity. Authorized agents may submit requests where permitted by law.

11. Cookies and preferences

We use essential cookies for login/session security and preferences (for example theme). We do not currently set third-party analytics or advertising cookies. Details are in our Cookie notice. You can control cookies through browser settings; disabling essential cookies may break parts of the site.

12. Children’s privacy

The Services are for business and professional users and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child provided data, contact us to delete it.

13. Do Not Track

Some browsers send “Do Not Track” signals. There is no uniform standard for responding; we currently do not alter practices solely based on DNT signals beyond what this Policy describes.

14. Changes

We may update this Privacy Policy. The “Last updated” date will reflect revisions. Material changes will be posted on this page and, where appropriate, communicated by email or in-product notice.

15. Contact

Privacy questions or requests:
Xenqor Systems LLC
1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA
[email protected]