This Privacy Policy explains how Xtend One ("we", "our", or "us") collects, uses, stores, and shares information when you use our platform at xtend.one and associated services. Please read it carefully.

If you are a business using Xtend One to build workflows or serve your own customers, you are the Data Controller for your end users' data. Xtend One acts as your Data Processor. You are responsible for ensuring your use of the platform complies with applicable laws.

1. Who We Are

Company	Xtend One
Website	www.xtend.one
Contact	hello@xtend.one
Role	Data Processor (for customer business data); Data Controller (for account & billing data)

2. Information We Collect

2.1 Account & Registration Data

Name and email address
Password (stored in hashed form: never in plain text)
Organization name and billing details

2.2 Usage & Platform Data

Actions taken within the platform (e.g., workflow creation, integrations configured)
Log data: IP addresses, browser type, timestamps, pages visited
Device and session information

2.3 Customer Business Data

Data you upload, connect, or process through Xtend One (e.g., contacts, emails, workflow inputs)
This data belongs to you. We process it solely to operate the platform on your behalf

2.4 Communications

Emails or messages you send to our support team
Responses to surveys or feedback forms (if any)

3. How We Use Your Information

We use the information we collect for the following purposes:

To provide, operate, and maintain the Xtend One platform
To authenticate your identity and manage your account
To process transactions and manage billing
To send product updates, security alerts, and support communications
To monitor platform health, detect abuse, and ensure security
To comply with legal obligations

We do not use your data to train machine learning models, build advertising profiles, or sell insights to third parties.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases:

Contract Performance	Processing necessary to provide the services you have signed up for
Legitimate Interests	Platform security, fraud prevention, and service improvement
Legal Obligation	Compliance with applicable laws and regulatory requirements
Consent	Where we ask for your consent (e.g., marketing emails): you may withdraw at any time

5. Data Sharing & Subprocessors

We do not sell your data. We share data only in the following limited circumstances:

5.1 Infrastructure Subprocessors

Amazon Web Services (AWS): cloud hosting and data storage (US-East and Singapore regions)
Microsoft Clarity: website behavioural analytics (session replays, heatmaps); loaded only with cookie consent
Google Analytics 4 (GA4): website traffic and usage analytics; loaded only with cookie consent

5.2 Future Subprocessors

As the platform grows, we may add payment processors, communication providers, and monitoring tools. We will update this policy and notify customers of material changes.

5.3 Legal Disclosures

We may disclose data if required by law, court order, or to protect the rights and safety of Xtend One and its users
We will notify you of such requests where legally permitted

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data is subject to a different privacy policy

6. Data Retention

Account Data	Retained for the duration of your active account
Business Data	Retained as long as your account is active; deleted on account termination
Backups	Automated daily backups; backup data is purged on a rolling schedule
Deletion on Request	Hard deletion performed upon verified request: see Section 8

7. Data Security

All data in transit is encrypted using TLS/SSL
Sensitive credentials (e.g., email configurations) are encrypted at the application level
Access to customer data is restricted to authorized personnel only, and only under exceptional circumstances
We maintain internal monitoring and logging systems to detect anomalies

Transparency: We do not currently enforce full platform-wide encryption at rest across all data layers. Infrastructure-level encryption depends on AWS configuration. We are actively working toward broader coverage.

8. Your Data Rights

Depending on your location, you may have the following rights regarding your personal data:

Access	Request a copy of the personal data we hold about you
Correction	Request correction of inaccurate or incomplete data
Deletion	Request erasure of your personal data ("right to be forgotten")
Portability	Request your data in a structured, machine-readable format
Objection	Object to processing based on legitimate interests
Restriction	Request that we limit how we process your data
Withdraw Consent	Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at: hello@xtend.one

We will respond within 30 days. We may ask you to verify your identity before processing your request.

9. Cookies & Tracking

Xtend One uses cookies and similar technologies to:

Maintain your login session
Remember your preferences
Monitor platform performance and usage

9.1 Analytics: Microsoft Clarity

We use Microsoft Clarity, a behavioural analytics tool, to understand how visitors interact with our marketing website (xtend.one). Clarity may record session replays, heatmaps, and aggregated usage data. This data is used solely to improve the website experience and is not used for advertising targeting.

Clarity is only loaded after you provide cookie consent. If you deny consent, Clarity will not be activated. You can withdraw consent at any time by clearing your browser's local storage for this site.

For more information on how Microsoft handles this data, see the Microsoft Privacy Statement.

9.2 Analytics: Google Analytics 4

We use Google Analytics 4 (GA4) to understand how visitors interact with our marketing website (xtend.one). GA4 collects aggregated usage data including page views, session duration, and traffic sources. This data is used solely to improve the website experience and is not used for advertising targeting.

GA4 is only loaded after you provide cookie consent. If you deny consent, GA4 will not be activated. You can withdraw consent at any time by clearing your browser's local storage for this site.

For more information on how Google handles this data, see the Google Privacy Policy.

9.3 Other Cookies

We do not use third-party advertising cookies or behavioural tracking for ad targeting.

You can control cookies through your browser settings. Disabling certain cookies may affect platform functionality.

10. International Data Transfers

Your data may be stored and processed in the United States (US-East) or Singapore, where our AWS infrastructure is located. By using Xtend One, you consent to this transfer.

For EEA/UK users, we ensure appropriate safeguards are in place in accordance with applicable data protection laws.

11. Children's Privacy

Xtend One is a business-to-business platform and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately at hello@xtend.one.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the "Last Updated" date at the top of this document
Notify account holders via email for significant changes
Post the updated policy on our website

Continued use of the platform after changes take effect constitutes your acceptance of the updated policy.

13. Contact Us

Privacy & Data Requests	hello@xtend.one
Website	www.xtend.one
Response Time	Within 2 business days for general queries; 30 days for formal data rights requests