Privacy Policy

Introduction

ExcelifyXML is committed to protecting the privacy of its users. This privacy policy explains how we collect, use and protect your personal data in accordance with the General Data Protection Regulation (GDPR).

Data Collected

We collect the following data:

• Identification data : name, first name, email address
• Connection data : IP address, browser type, pages visited
• Billing data : billing address (if paid subscription)

Uploaded Files

Use of Data

Your data is used to:

• Manage your user account
• Provide the file transformation service
• Send service-related communications
• Improve our service
• Comply with our legal obligations

Legal Basis

The processing of your data is based on the following legal bases, depending on the purpose:

• Performance of the contract (Art. 6.1.b GDPR): provision of the transformation service, account management, customer support
• Consent (Art. 6.1.a GDPR): analytics cookies, marketing communications (if applicable)
• Legal obligation (Art. 6.1.c GDPR): retention of billing data, response to judicial requests
• Legitimate interest (Art. 6.1.f GDPR): service security, fraud prevention, service improvement, rate limiting

Sub-processors and Data Sharing

Your data may be shared with the following sub-processors:

• Clerk : for authentication (identification data)
• Stripe : for payment processing (billing data)
• Vercel : for hosting and processing XML files (basic server logs: IP, browser, pages visited; XML files are processed in memory — or, for large files, via a private encrypted transit space deleted right after processing — and never retained)
• Sentry : for error tracking (technical data: error logs, session replay only when an error occurs)
• Upstash : for rate limiting (technical data: request identifiers, IP addresses)
• Resend : for sending transactional emails (email address, email content)
• Neon : for database hosting (account data, billing data)

We never sell your data to third parties.

International Data Transfers

Some of our processors are US companies. Where data is transferred outside the European Union, such transfers are governed by Articles 44 to 49 of the GDPR (EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses):

• Clerk (authentication) — United States — EU-US Data Privacy Framework
• Stripe (payments) — United States — EU-US Data Privacy Framework
• Vercel (hosting) — United States — EU-US Data Privacy Framework
• Sentry (error tracking) — data hosted in the EU (Germany); US company, EU-US Data Privacy Framework as an additional safeguard
• Upstash (rate limiting) — data hosted in the EU (Ireland); US company, Standard Contractual Clauses as an additional safeguard
• Resend (transactional emails) — sending operated from the EU (Ireland); US company, Standard Contractual Clauses as an additional safeguard
• Neon (PostgreSQL database) — data hosted in the EU (Frankfurt); US company, Standard Contractual Clauses as an additional safeguard

You can obtain a copy of the appropriate safeguards by contacting us at privacy@excelifyxml.com.

Data Retention

• Account data : retained as long as your account is active
• Billing data : retained 10 years (legal obligation)
• Connection and log data : retained 12 months (legitimate interest for security and legal compliance)
• Uploaded files : no retention — neither the files nor their metadata (name, size, etc.). Processed in memory then immediately deleted.

Your Rights

In accordance with GDPR, you have the following rights:

• Right to access your data
• Right to rectification
• Right to erasure ('right to be forgotten')
• Right to restriction of processing
• Right to data portability
• Right to object

For your rights of access, portability and erasure, you can act directly from your account: the "Download my data" and "Delete my account" buttons are available in your Settings.

To exercise these rights, contact us at: privacy@excelifyxml.com

You have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), 3 Place de Fontenoy - TSA 80715, 75334 PARIS CEDEX 07, www.cnil.fr

Automated Decision-Making

ExcelifyXML does not carry out any automated decision-making, including profiling, within the meaning of Article 22 of the GDPR, producing legal effects or significantly affecting users.

Security

We implement appropriate technical and organizational measures to protect your data:

• Data encryption in transit (HTTPS)
• Secure authentication via Clerk
• No file retention (ephemeral encrypted transit, immediate deletion)
• Restricted data access

Contact

For any questions about this policy or your personal data:

Email : privacy@excelifyxml.com