Xmadar · LEGAL CENTRE
Privacy Policy
Last updated: 18 October 2026 | Version 1.0
1. Who handles your data
Xmadar, United Kingdom, is responsible as controller for account administration, billing, our website and support. Contact [email protected] with “Privacy” in the subject or use your account support area. This notice covers visitors, customers and authorised business contacts. It does not replace a data processing agreement for customer-hosted data.
2. Data we receive
Depending on your interaction, we handle your name, business and contact details, account identifiers, order and invoice records, payment status and transaction references, support messages, service configuration and technical records such as IP address, device/browser information, access times and security events. Information comes from you, authorised account users, your use of the service and providers involved in delivering or securing it. Provide only information needed for your request.
3. Purposes and lawful grounds
We use account, order and service information to take steps at your request and perform our contract. We process legally required accounting and regulatory records to meet legal obligations. Our legitimate interests include protecting systems, preventing fraud, troubleshooting and administering business customer relationships, balanced against your rights. Where required, optional marketing and non-essential tracking rely on consent. If essential account or payment information is not provided, we may be unable to supply the requested service.
4. Customer content and processor role
For personal data hosted or managed solely on your documented instructions, you are normally the controller and Xmadar acts as processor. You must have a lawful basis, provide required notices and instruct us lawfully. Appropriate processing terms must cover purpose, duration, data categories, confidentiality, security, subprocessors, rights assistance and return/deletion. Contact support for the processing terms, providers and locations relevant to your service before submitting sensitive or regulated data. Requests about a customer’s own website should normally go to that customer.
5. Suppliers, payments and disclosure
Infrastructure and hosting providers, domain registrars, payment processors, communications, security and support suppliers may receive only information needed for their role. Some act as processors; others, such as a payment provider or registrar, may act as independent controllers under their own notices. We may disclose data to professional advisers or competent authorities where necessary and lawful, or in a business transfer with appropriate protections. Do not submit full card details or passwords in support tickets.
6. Licensing and connected AI tools
Where you activate Xmadar software, licensing may involve the activation code, domain, installation directory, addon version, connecting server IP and activation/verification times. When you connect AI tools or integrations, authorised tool requests may disclose the selected service information to the provider you choose. Check permissions and that provider’s privacy terms, limit access and avoid unnecessary confidential data. This notice does not authorise unrestricted access or the use of customer content to train AI.
7. International transfers
Service infrastructure or suppliers may be outside the United Kingdom. Where UK transfer restrictions apply, transfers require an applicable adequacy framework or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with any required assessment and supplementary measures. Ask support for the recipients, hosting locations and transfer safeguards applicable to your service. We do not promise that all data stays in the UK.
8. Retention and security
We retain account and service data while needed for the relationship and associated administration; billing records for applicable accounting and tax obligations; support and security records for proportionate troubleshooting, fraud prevention and claims handling. Retention is based on purpose, legal duties, dispute periods and the service’s agreed deletion/backup schedule. We delete or anonymise data when no longer needed, subject to lawful holds. Ask for the schedule relevant to your service. Appropriate organisational and technical measures are required, but absolute security is not guaranteed.
9. Cookies and communications
Necessary storage supports requested functions such as login, sessions and security. Optional tracking and marketing require consent where applicable; reading a policy or continuing to browse is not consent. Use “Cookie settings” where available and browser controls. You can unsubscribe from marketing or contact support; essential service, billing and security notices remain separate. See our Cookie Policy for categories and controls.
10. Your choices and rights
Subject to applicable law and the processing ground, you may request access, correction, erasure, restriction, portability or object, including to direct marketing. You may withdraw consent without affecting earlier lawful processing. We may request proportionate identity verification and explain lawful exceptions. We respond within applicable statutory time limits, normally one month for UK data rights requests, with lawful extensions explained when needed.
11. Complaints and updates
Contact [email protected] for privacy requests and complaints. You may also complain to the UK Information Commissioner at ico.org.uk/make-a-complaint or another competent authority. This notice does not state that we make solely automated decisions producing legal or similarly significant effects; any such feature requires specific information and safeguards before use. We date changes and provide additional notice of material changes where required.