Privacy Policy

Introduction

ExcelifyXML is committed to protecting the privacy of its users. This privacy policy explains how we collect, use and protect your personal data in accordance with the General Data Protection Regulation (GDPR).

Data Collected

We collect the following data:

• Identification data : name, first name, email address
• Connection data : IP address, browser type, pages visited
• Usage statistics : anonymous, cookieless audience measurement (Vercel Web Analytics): pages viewed, with the referring page, an approximate location (country, city), the operating system, browser and device type; and a few usage counters of the service, for instance the plan, the detected encoding of a file, the outcome of a preview, a transformation or a reconstruction, or the rounded size of a refused file. Visitors are recognized by an identifier computed from the request and discarded after 24 hours. Neither the content nor the name of your files is included, and these statistics are not linked to your account.
• Billing data : billing address (for any purchase: subscription or credit pack)

Uploaded Files

Use of Data

Your data is used to:

• Manage your user account
• Provide the file transformation service
• Send service-related communications
• Improve our service
• Comply with our legal obligations

Legal Basis

The processing of your data is based on the following legal bases, depending on the purpose:

• Performance of the contract (Art. 6.1.b GDPR): provision of the transformation service, account management, customer support
• Consent (Art. 6.1.a GDPR): error-tracking cookies (Sentry), marketing communications (if applicable)
• Legal obligation (Art. 6.1.c GDPR): retention of billing data, response to judicial requests
• Legitimate interest (Art. 6.1.f GDPR): service security, fraud prevention, service improvement (including anonymous, cookieless audience measurement), rate limiting

Sub-processors and Data Sharing

Your data may be shared with the following sub-processors:

• Clerk : for authentication (identification data)
• Stripe : for payment processing (billing data)
• Vercel : for hosting, processing XML files and anonymous audience measurement (basic server logs: IP, browser, pages visited; XML files are processed in memory — or, for large files, via a private encrypted transit space, for the time of the preview and the transformation, at the latest one hour after the upload — and never retained)
• Sentry : for error tracking (technical data: error logs, session replay only when an error occurs)
• Upstash : for rate limiting (technical data: request identifiers, IP addresses)
• Resend : for sending transactional emails (email address, email content)
• Neon : for database hosting (account data, billing data)

We never sell your data to third parties.

International Data Transfers

Some of our processors are US companies. Where data is transferred outside the European Union, such transfers are governed by Articles 44 to 49 of the GDPR (EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses):

• Clerk (authentication) — United States — EU-US Data Privacy Framework
• Stripe (payments) — United States — EU-US Data Privacy Framework
• Vercel (hosting) — United States — EU-US Data Privacy Framework
• Sentry (error tracking) — data hosted in the EU (Germany); US company, EU-US Data Privacy Framework as an additional safeguard
• Upstash (rate limiting) — data hosted in the EU (Ireland); US company, Standard Contractual Clauses as an additional safeguard
• Resend (transactional emails) — sending operated from the EU (Ireland); US company, Standard Contractual Clauses as an additional safeguard
• Neon (PostgreSQL database) — data hosted in the EU (Frankfurt); US company, Standard Contractual Clauses as an additional safeguard

You can obtain a copy of the appropriate safeguards by contacting us at privacy@excelifyxml.com.

Data Retention

• Account data : retained as long as your account is active
• Billing data : retained 10 years (legal obligation)
• Connection and log data : retained 12 months (legitimate interest for security and legal compliance)
• Usage statistics : anonymous, available for 12 months
• Uploaded files : no retention — neither the files nor their metadata (name, size, etc.), apart from the anonymous usage counters described above. Processed in memory then immediately deleted; above 4 MB, encrypted transit for the time of the preview and the transformation, at the latest one hour after the upload.

Your Rights

In accordance with GDPR, you have the following rights:

• Right to access your data
• Right to rectification
• Right to erasure ('right to be forgotten')
• Right to restriction of processing
• Right to data portability
• Right to object

For your rights of access, portability and erasure, you can act directly from your account: the "Download my data" and "Delete my account" buttons are available in your Settings.

To exercise these rights, contact us at: privacy@excelifyxml.com

You have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), 3 Place de Fontenoy - TSA 80715, 75334 PARIS CEDEX 07, www.cnil.fr

Automated Decision-Making

ExcelifyXML does not carry out any automated decision-making, including profiling, within the meaning of Article 22 of the GDPR, producing legal effects or significantly affecting users.

Security

We implement appropriate technical and organizational measures to protect your data:

• Data encryption in transit (HTTPS)
• Secure authentication via Clerk
• No file retention (ephemeral encrypted transit, deletion as soon as the transformation is done or abandoned, at the latest one hour after the upload)
• Restricted data access

Contact

For any questions about this policy or your personal data:

Email : privacy@excelifyxml.com