Privacy Policy

Information you give us

• Account: your name and email address when you create an account, through our sign-in provider, Clerk.
• Your workspace: the vendors you add, your notice obligations, any document you upload to find them (the document is discarded after reading; we keep only the clauses you confirm and a hash of the file), and your alert settings.
• People you invite: the email addresses of colleagues you invite to your workspace.
• Billing: handled by Stripe. Card details go directly to Stripe; we never see or store card numbers.
• Messages and sign-ups: what you send through the contact form, a vendor-record claim or correction, a resource request, and your email address if you subscribe to the Redline newsletter.

Information from your use of the Service

• Sub-processor scan: the website address you enter, how many vendors on it we watch, and a keyed one-way hash of your IP address used to limit abuse. The hash is deleted the first time anyone runs a scan after it is a day old.
• Page counts: a first-party count of how often each page is opened, stored as a page address, a date and a number, with no identifier, IP address or cookie attached.
• Rate limits: when you use the contact, vendor-claim, correction, newsletter, resource or report forms, or open a page that is counted, we store your IP address with a request count to limit abuse. Entries older than a day are deleted periodically.
• Analytics and logs: anonymous, cookieless page-view counts from Vercel Web Analytics, page-load performance measurements from Vercel Speed Insights, and the basic request logs our hosting provider keeps for security and debugging.

Business contact information for outreach

We read the sub-processor lists, data processing agreements and trust pages that companies publish. We may find the work email address of a person at such a company, from public sources or through Hunter, and send a short email about Xither. Every such email has a one-click opt-out, and an address that opts out is not emailed again.

The public record

The pages we watch are vendors’ published company documents. Where one names an individual, such as a privacy contact, we keep the page as the vendor published it.

• to provide the Service: run your workspace, send alerts, reports and invitations, and process payments;
• to answer your messages and handle vendor-record claims and corrections;
• to send the Redline newsletter if you subscribed;
• to send outreach emails as described above;
• to keep the Service secure and prevent spam and abuse; and
• to meet legal, tax and accounting obligations.

We do not sell personal information, and we do not use your data to train AI models.

• Contract: providing the Service you signed up for.
• Legitimate interests: security, abuse prevention, and outreach emails to business contacts about a service relevant to their role, with an opt-out in every message.
• Consent: the Redline newsletter.
• Legal obligation: tax and accounting records.

These providers process personal data only to provide their service to us:

• Vercel: hosting, cookieless analytics and Speed Insights
• Turso: database
• GitHub: daily database backups, stored as GitHub Actions artifacts and deleted after 90 days
• Clerk: sign-in
• Stripe: payments
• Resend: email delivery
• Smartlead: outreach email
• Hunter: business contact discovery
• Google reCAPTCHA: spam protection on our forms

We may also disclose information when the law requires it, to protect the rights or safety of Xither or others, or to a successor in a merger or sale of the business, with notice to you.

• Account and workspace data: while your account is open, and for 90 days after a subscription ends. Most of it is a list of vendors and their public pages rather than personal information.
• Sub-processor scan IP hashes: deleted the first time anyone runs a scan after the hash is a day old; the address scanned and the count of vendors matched remain.
• Rate-limit entries: deleted periodically once they are more than a day old.
• Database backups: 90 days.
• Outreach contacts: until the address opts out or we stop contacting the company; an opted-out address is kept only on a do-not-contact list.
• Newsletter: until you unsubscribe.
• Billing records: as long as tax law requires.

You can ask to see, correct, export or delete the personal information we hold about you, and you can object to outreach at any time with the link in any email. Residents of the EEA and UK can also restrict or object to processing and withdraw consent; California residents have the right to know and delete, and we do not sell or share personal information for advertising. We will not treat you differently for using these rights.

To make a request, use our contact form and choose “Legal, privacy or DMCA.” We answer within 30 days. If you are in the EEA or UK, you can also complain to your data protection authority.

Public pages set no advertising or tracking cookies. Our sign-in provider, Clerk, may set a strictly necessary cookie on any page, and signing in sets the cookies needed to keep you signed in. The Redline invitation keeps a note in your browser’s local storage of when it last appeared, which never leaves your device. See our Cookie Policy.

Data is encrypted in transit, access is limited to the people who need it, and workspace data is separated so one workspace cannot read another’s. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

Xither is based in the United States, and our providers process data in the United States and other countries. For transfers from the EEA or UK we rely on the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

The Service is for businesses and is not directed to anyone under 18.

We will change the date at the top of this page when we update this policy, and email account holders before a material change takes effect.

Privacy questions and requests: use our contact form and choose “Legal, privacy or DMCA.”