Privacy policy
Effective October 11, 2026 · Version 2026-10-11
Who is responsible
XER360 is responsible for the personal information it processes to provide this service. Privacy questions and requests can be sent to support@xer360.com.
Account and subscription information
We process your name, email, optional organization, country, account identifiers, trial dates and recorded terms acceptance to provide your account. Subscription records include Stripe customer and subscription identifiers, plan, status, renewal settings and paid-through dates. Supabase provides authentication and account storage. Stripe handles hosted payment entry; XER360 does not receive or store full card numbers or card security codes.
Schedules and reports
Schedule data is sent to our analysis server for temporary processing and results are returned to your browser. We do not persist uploaded XER files in the production analysis service. Temporary processing and browser memory are still data processing; this is not a claim that data never leaves your device. Downloads you save remain on your device under your control. Account and billing data may be stored and backed up separately from schedule processing. Upload only information you have authority to share and avoid unnecessary personal information in schedules.
Account emails
We use your account email to deliver confirmation, password-reset, security and billing messages and may send a reminder before your trial ends. Signup clearly describes these account-related communications. Accepting the terms does not opt you in to promotional campaigns. We record the terms version, acceptance time and trial-reminder notice version in your account metadata. Contact support@xer360.com about account communications or account closure.
Security and usage records
We record account-linked analysis-request counters to enforce rate limits and maintain availability. These counters are not a record of time spent on the website or the contents of uploaded schedules. Hosting and security systems may process IP addresses, request times, technical identifiers and diagnostic events for operation and abuse prevention. Authentication may use browser storage to keep your session signed in.
Visitor analytics
Cloudflare Web Analytics provides aggregate page-view, visit, referrer, device and performance information. Its analytics beacon does not use cookies or browser storage to track visitors. This does not mean the entire website is free of browser storage: authentication has separate session requirements. We do not send XER contents or custom account names or emails to the analytics integration.
Providers and international processing
DigitalOcean hosts the production service; Supabase supports accounts and database records; Stripe processes billing; Cloudflare provides visitor analytics. Providers process data needed for their functions under their own applicable arrangements. Some processing may occur outside your country. We do not promise that all information remains in Canada. We do not sell your uploaded schedules or account information.
Retention and your choices
Account, billing, usage and security records are retained as needed to operate the service, prevent abuse, resolve disputes and meet legal obligations. Deleting an account may not immediately remove information required for these purposes or retained in backups. Contact us to request access, correction, account deletion, or information about retention. We may verify your identity and explain any lawful limits. Contact us for information about the retention applicable to your records.
Privacy incidents and updates
We use access controls and protected server processing, but no system is risk-free. We will assess suspected privacy incidents and notify affected people or authorities where required by applicable law. Changes to this policy will carry an updated version; material changes will be communicated as required. The service is intended for professional users, not children.