Privacy Policy

[COMPANY NAME] (company number [COMPANY NUMBER], [REGISTERED ADDRESS]) is the controller for personal data we collect about you as an XPRE customer, visitor or Creator. Contact us about privacy at support@xpre.ai.

Where you deploy a Site and collect data from your own users, you are the controller of that data and we act as your processor. This policy covers our own processing; your users should be given your own privacy notice.

• Account data — name, email, password hash, two-factor secrets, roles, organisation details.
• Billing data — plan, invoices, payment status, billing address and tax identifiers. Card details go directly to our payment processor; we never see full card numbers.
• Domain registrant data — the name, address, email and phone number required by the registry to register a domain in your name.
• Build and Site data — module selections, branding, configuration, deployment history and logs.
• Creator and verification data — identity and business verification (KYC) information, payout details and tax status for people selling on the platform.
• Support and enquiry data — messages you send us and the context attached to them.
• AI prompts and outputs — the briefs and instructions you submit to the composer, build studio and support copilot, and the responses generated.
• Technical and usage data — IP address, device and browser information, pages viewed, feature usage, error reports and security logs.

• To provide the platform, deploy your Sites and register domains — performance of our contract with you.
• To take payment, issue invoices and manage subscriptions — performance of contract and legal obligation.
• To verify Creators and prevent fraud, abuse and money laundering — legal obligation and legitimate interests.
• To provide support and respond to enquiries — performance of contract and legitimate interests.
• To monitor security, availability and capacity, and to improve the product — legitimate interests.
• To send service messages about your account, billing and outages — performance of contract.
• To send marketing about XPRE — consent, or legitimate interests where you are an existing customer. You can opt out at any time.
• To meet accounting, tax, registry and other statutory duties — legal obligation.

We share personal data with service providers who process it on our instructions under written terms. Categories include:

• Payment processing and fraud screening.
• Cloud hosting, databases, storage and CDN delivery.
• Domain registration through an accredited registrar, and the relevant domain registry.
• Transactional and announcement email delivery.
• AI model providers processing prompts and generating output.
• Video, streaming and real-time communication infrastructure.
• Product analytics, error monitoring and security tooling.

We also disclose data where required by law, to enforce our terms, or as part of a merger, acquisition or asset sale (with notice to you). We do not sell personal data.

Registering a domain requires us to send your registrant details to the registrar and registry. Depending on the extension and applicable policy, some of those details may be published in WHOIS/RDAP or disclosed to third parties under ICANN or registry rules. This disclosure is required to register a domain and is outside our control. Where privacy or proxy services are available for an extension we will tell you at checkout.

Some providers operate outside the UK and EEA. Where personal data is transferred internationally we rely on an adequacy decision or on approved safeguards such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses, together with appropriate technical measures.

• Account data: for as long as your account is open, then up to 12 months after closure.
• Hosted Site data: available for export for 30 days after termination, then deleted.
• Billing and tax records: 6 years, as required by law.
• KYC and verification records: for the period required by anti-money-laundering rules.
• Support messages: up to 3 years.
• Security and access logs: typically 90 days, longer where an incident is under investigation.
• Domain registrant data: for the life of the registration and any statutory retention period afterwards.

Subject to local law, you can request access to your data, correction, deletion, restriction or objection to processing, portability, and withdrawal of consent where consent is the basis. You can also object to direct marketing at any time.

Exercise any of these by emailing support@xpre.ai. We respond within one month and may ask you to verify your identity. If you are unhappy with our response you can complain to your data protection authority; in the UK that is the Information Commissioner's Office.

• Essential cookies: sign-in sessions, security, load balancing and fraud prevention. These cannot be switched off.
• Preference storage: theme, currency, live/demo mode and draft builds held in your browser.
• Analytics: aggregate usage measurement to improve the product.

You can block or delete cookies in your browser, but essential cookies are required for the platform to work.

We use row-level access controls, encryption in transit, encrypted storage for sensitive credentials, role-based permissions and two-factor authentication for elevated accounts. No system is perfectly secure. If a personal data breach is likely to result in a risk to your rights we will notify the relevant supervisory authority within 72 hours and tell you without undue delay where the risk is high.

The platform is not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

We will post updates here with a new effective date and, where the change is material, notify you by email or in-app. Related documents: Terms & Conditions.