Skip to main content
XOR

Privacy Policy

XOR Sciences ("XOR", "we", "us") respects your privacy. This policy explains what data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and applicable privacy laws.

Legal Basis for Processing

We process your personal data under GDPR Article 6 on the following bases:

  • Consent (Art. 6(1)(a)) - when you submit the contact form or subscribe to updates
  • Legitimate interest (Art. 6(1)(f)) - anonymized analytics to improve our website

Data We Collect

When you submit the contact form or subscribe, we collect your email address. If you email security@xor.tech, we receive your email address and the information you choose to include. We use a cookie-free page counter that stores nothing about you. If you accept cookies, we also use the session-replay, analytics and advertising services listed below. We do not use any visitor-identification or de-anonymisation service, and we do not attempt to work out who you are from your IP address. If you submit a form, we attach the address you gave us to your analytics session, so we can see which pages that enquiry followed.

Data Processors

We use the following third-party processors to operate this website:

  • Vercel Inc. (hosting, edge network) - US, with EU edge nodes
  • PostHog Inc. (product analytics) - EU data region (eu.i.posthog.com)
  • Plausible Analytics (website analytics) - EU, cookie-free, no personal data
  • Microsoft Clarity (heatmaps, session replay, rage click detection) - US, consent-required in EEA/UK
  • Google Analytics (page view and event tracking) - US, Google LLC
  • Google Ads (conversion measurement and remarketing, googleads.g.doubleclick.net) - US, Google LLC
  • Resend Inc. (transactional email) - US

Sub-processors that process customer-submitted data (e.g. Google Cloud, and LLM inference providers such as Anthropic, OpenAI, and Google Vertex AI) are governed by our Data Processing Agreement and listed in our Sub-processor Register, not this website policy.

How We Use Your Data

We use email addresses to answer enquiries, assess and coordinate security reports, and send product updates or benchmark reports when requested. We do not sell or share your personal data with third parties for marketing purposes.

Data Retention

Email addresses collected through the contact form or a subscription are retained for 12 months from collection, or until you request deletion, whichever is sooner. Anonymized analytics data is retained indefinitely.

Your Rights

Under GDPR, you have the right to:

  • Access your personal data and receive a copy
  • Rectify inaccurate personal data
  • Request deletion of your personal data
  • Export your data in a portable format
  • Withdraw consent at any time
  • Lodge a complaint with a supervisory authority

To exercise any of these rights, email privacy@xor.tech.

Cookie Policy

This site uses a cookie consent banner. You can accept or decline analytics cookies at any time. Your preference is stored in your browser's local storage.

Cookies and third-party scripts loaded when you accept. Each one is named here; none loads before you accept, and none loads after you decline:

  • Vercel Analytics - page view tracking, session-scoped, no personal data
  • Microsoft Clarity - heatmaps, session replay, rage/dead click detection
  • Google Analytics - page views, event tracking, audience insights
  • Google Ads - conversion measurement and remarketing
  • PostHog (eu.i.posthog.com) - product analytics, EU data region

Plausible Analytics runs without cookies and does not require consent. It collects no personal data.

To change your cookie preferences, clear your browser's local storage for xor.tech and reload the page.

Contact

Data Protection Officer: dpo@xor.tech

General privacy questions: privacy@xor.tech