Privacy Policy

This Privacy Policy explains how Xpera ("we", "us") handles personal information when you visit our website or use the Xpera platform (the "Service").

For account and website data, Xpera is the data controller. For personal information that may appear in workflow configuration your organization submits, we act as a processor on behalf of your organization.

• Account information: your email address, password (stored by our authentication provider as a hash, never in plain text), organization name and role.
• Workflow configuration: workflow and AI agent definitions you upload or connect. Before storing a definition we sanitize it: raw field values, parameter values, prompts and code bodies are not stored, URLs are reduced to scheme, host and path with token-like parts redacted, and detected credentials are recorded only by location and type, never by value. The original uploaded file is not stored.
• Integration credentials: the read-only API tokens or keys you provide to connect Make.com or n8n. They are encrypted (AES-256-GCM) before storage and are never shown back to you, logged, or shared.
• Billing information: Paddle, our Merchant of Record, collects your payment details, billing address and tax information. We do not receive or store your full card number.
• Usage and technical data: request logs with request identifiers, timestamps, routes and error codes, used for security and reliability. Our logs are designed not to contain workflow content or credentials.
• Communications: messages you send us, for example by email.

• to provide the Service: authenticate you, analyze your workflows, show findings and send alerts you configure;
• to process subscriptions and payments through Paddle;
• to secure the Service, prevent abuse and investigate incidents;
• to send service and account emails, such as email confirmation and password reset;
• to support you and respond to your requests;
• to comply with legal obligations.

We do not sell personal information, do not use it for third-party advertising, and do not use your workflow configuration to train AI models.

Where the GDPR or similar laws apply, we process personal information to perform our contract with you, for our legitimate interests in securing and improving the Service, to comply with legal obligations, and with your consent where required.

We share personal information only with service providers that help us run the Service, under agreements that require them to protect it:

• Supabase: authentication, database and file storage;
• our cloud hosting provider: running the application;
• Paddle: checkout, payments, invoicing, tax and subscription management, as Merchant of Record;
• Anthropic: only if your organization's admin enables real-model runs in the Security Testing Lab. Those runs send only synthetic test data and generic tool names, never your workflow content or credentials.

When you connect Make.com or n8n, we send requests to those platforms with your token to read configuration. We may also disclose information when required by law, to protect rights and safety, or as part of a merger or acquisition.

We use strictly necessary cookies to keep you signed in. We store your theme and sidebar preferences in your browser's local storage. Paddle's checkout script loads on our pricing page to process purchases and may set its own cookies, governed by Paddle's privacy policy. We do not use advertising or analytics trackers.

We keep account and organization data for as long as your account is active. Scan results and history are kept so you can compare scans over time. Disconnecting an integration deletes its stored credential. When you ask us to delete your account or organization, we delete the associated data within a reasonable period, except records we must keep for legal, tax or security reasons. Paddle retains billing records according to its own obligations.

We protect information with measures including encryption in transit, encrypted storage of integration credentials, row-level tenant isolation in our database, role-based access within organizations, and audit logs of changes. No method of transmission or storage is completely secure.

Our service providers may process information in countries other than yours. Where required, we rely on appropriate safeguards, such as Standard Contractual Clauses, for these transfers.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can also complain to your local data protection authority.

To exercise these rights, email [email protected]. If your data was submitted by your organization, we may refer your request to that organization.

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18.

We may update this Privacy Policy. If we make material changes, we will notify you by email or in the Service. The date at the top shows when it was last updated.

Questions about privacy can be sent to [email protected].