Privacy Policy
This policy explains what Xeo collects when you use it, why, who else sees it, and what you can ask us to do about it. It describes the product as it is built today. Where something is not yet automated, this page says so rather than implying otherwise.
Questions, requests, or complaints: tools@xerebo.com.
1. What we collect
Your account
| Data | Why we hold it |
|---|---|
| Email address | Identifies the account, receives verification and job-completion mail. |
| Password, hashed | Sign-in. Stored as a bcrypt hash — we never hold the password itself. |
| Google account id, name and email | Only if you sign in with Google, so we can match you to the same account next time. |
| The IP address you signed up from, with the time and version of the terms you accepted | Proof of consent. This is a record we keep so we can show when and to what you agreed. |
| Plan, trial dates, subscription status, Stripe customer id, referral code | Billing and access. |
| Push notification subscriptions | Only if you turn browser notifications on. |
Sites and content you point us at
- The domains you add, and the token and events that prove you verified them.
- Pages we crawl from those sites: URLs, headings, body text, metadata, images, and the raw HTML and CSS, plus everything derived from them — topic maps, page classifications, embeddings, drafts, and published output.
- Your site's header, footer and stylesheets, when you ask us to host your blog in your site's look.
- Pages we crawl from competitor sites we find for you through public search results. Those sites do not belong to you and their operators are not our users. We treat that content as publicly available material gathered for competitive analysis, and we honour
robots.txton any domain you have not verified as your own. - Anything you type into the product: business details, services, authors, prompts, and edits.
- Blog posts you publish through Xeo's hosted blog. These are stored by us and shown publicly on your own domain — that is their purpose.
Connected accounts
When you connect Google Search Console, Google Analytics, Google Business Profile, GitHub, WordPress.com, or Shopify, we store the access and refresh tokens that connection issues. Tokens are encrypted at rest with AES-256-GCM before they are written to the database, and disconnecting deletes them. We also store what the connection returns while you use it — for example the properties in your Search Console account, or the file tree of the repository you chose. What we do with Google data specifically is set out in section 3.
Your code and builds (GitHub)
Xeo connects to GitHub as a GitHub App. When you install it you choose which repositories it may access, and you can change that or uninstall it at any time from your GitHub settings. Within those repositories it can read and write code, open pull requests, and add and run GitHub Actions workflows. We use that to:
- read the files needed to generate pages, install your blog, or write the APIs you ask for;
- build your site on your own GitHub Actions: we push a temporary
xeo/check-…branch carrying a build workflow, read the build's log and results, and delete the branch afterwards. Your code is built on GitHub's machines, never on ours; - let our AI fix a failing build, or write blog APIs into your code, on its own
xeo/…branch; - merge into your live branch only after you confirm it in the product — or open a pull request where that branch is protected.
We keep the build logs and results, the changes the AI made and its working notes, and short notes the AI fixer writes about your project to do better next time (you can clear those from the product).
Content systems you connect
If you connect a content system — WordPress, Ghost, Strapi, Payload, Directus, Sanity, Contentful, a feed, or your own blog API — we store the address and the key or password you give us, encrypted at rest with AES-256-GCM, and keep a copy of your posts and categories so the Blog section is fast. Every change is written to your system first; the copy is refreshed from what it returns.
When our AI writes blog APIs into your code, we generate a random key for them. We keep the key encrypted; your code holds only a one-way fingerprint (SHA-256 hash) of it, so the key never appears in your repository.
What we do not collect
- No cookies. Xeo sets none. Your sign-in session is a token kept in your browser's local storage, which means it stays on your device and is not sent to us automatically the way a cookie would be.
- No third-party analytics or tracking. There is no Google Analytics, Segment, PostHog, Mixpanel, Hotjar, or advertising pixel in this product. We do not track you across other websites, and we do not sell or share personal information for advertising.
- No card details. Payment is handled on Stripe's own hosted checkout. Card numbers never reach our servers.
About that session token. It is held in your browser's local storage, along with a key used to encrypt data in transit between your browser and our API. Any script running on the page can read local storage, so treat the token like a password: sign out on shared machines, and do not paste browser-console snippets you were given by someone else.
2. Why we are allowed to use it
Depending on where you live, the legal bases we rely on are:
- Performance of a contract — running the account, crawling your sites, generating and deploying pages, hosting your blog, building and fixing your code, billing you.
- Consent — the terms and privacy acceptance at signup, connecting a third-party account, enabling push notifications, confirming a merge into your live branch, and crawling a domain you have verified in a way that overrides its
robots.txt. - Legitimate interests — keeping the service secure and working, preventing abuse, and competitive research on publicly available pages.
- Legal obligation — keeping billing records.
3. Google user data
You can connect Google services to Xeo, and sign in with Google. This section sets out exactly what each Google permission is used for. We ask for a permission only when you connect the service that needs it.
| Google service and permission | What we access and why |
|---|---|
Sign in with Googleopenid, email, profile | Your Google account id, name and email address — to create your account and sign you in. Nothing else. |
Google Search Consolewebmasters, siteverification | The list of your Search Console properties, and for the property of the site you connected, the clicks, impressions and average position of each page over the last 90 days — to decide which pages and links to work on first. We do not read the search queries. If the site you connected has no property yet, we add one for it and verify that you own it, on your behalf, at your request. We do not remove properties or change other settings. |
Google Analyticsanalytics.readonly, analytics.edit | The names of your Analytics accounts and properties and their web data streams — to find the property that measures the site you connected and its measurement id. If your site has none, we create a property with a web data stream at your request and give you its tracking code to install. We do not read your reports or visitor data, and we do not delete or change existing properties. |
Google Business Profilebusiness.manage | Read only: your business accounts and locations, including their listed services — to fill in your business profile and services during setup. Google offers only this one broad permission; we never post, edit, or delete anything in your Business Profile. |
- Storage. Tokens are encrypted at rest with AES-256-GCM. The data we read is stored with your site's records, for as long as section 6 describes, and is visible only to you and the people on your account.
- Sharing. Google user data is shared only with the providers in section 4, and only to run the features you use — for example, your search data may be included in a request to our AI provider when you ask for an analysis of your pages. We never sell it, never use it for advertising, and never give it to data brokers or information resellers.
- No model training. We do not use Google user data to develop, improve, or train artificial-intelligence or machine-learning models, ours or anyone else's.
- People. Nobody at Xerebo reads your Google data, except with your explicit permission (for example, when you ask for support with it), when it is needed for security or to investigate abuse, or when the law requires it.
- Control. Disconnect a Google service in the product to delete its tokens, and remove Xeo's access at any time at myaccount.google.com/permissions. To have the Google data we stored deleted, use section 7.
Xeo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Who else sees it
We do not sell your data. We share it only with the providers below, each of which processes it to deliver part of the service:
| Provider | What reaches them |
|---|---|
| Amazon Web Services | Hosts the service. Its AI models (Amazon Bedrock, in the United States) write and analyse content: page text and HTML, your business and service details, competitor page content, data from the Google services you connected, and — for building, fixing, and writing APIs — your repository's code and build logs are sent as prompts. Crawled HTML is stored in Amazon S3. |
| Microsoft Azure (Blob Storage) | Older crawled HTML, only while it is being moved to Amazon S3. |
| MongoDB | The database everything above is stored in. |
| Your identity when you sign in with Google; the account data of the Google services you connect (section 3); keyword research queries through Google Ads; public search queries. | |
| GitHub | What the GitHub App needs in the repositories you chose — reading code, writing xeo/… branches, running builds on your GitHub Actions, and merging when you confirm. |
| WordPress.com, Shopify, and content systems you connect | Only what that connection requires — reading your posts and publishing what you ask us to. |
| Stripe | Your email address and an internal account id, to create a customer and run checkout and subscriptions. |
| Search engines (IndexNow) | The public addresses of pages you publish, so they are recrawled sooner. |
| Our email provider (SMTP) | Your email address and the contents of verification and notification mail. |
| Your browser vendor's push service | Only if you enable notifications. Delivering a push message necessarily routes it through Google, Mozilla, or Apple, depending on your browser. |
We may also disclose data where the law requires it, or to protect our rights, users, or the security of the service. If the business is sold or merged, account data may transfer to the buyer; we will say so before that takes effect.
These providers operate globally, so your data may be processed outside the country you are in, including in the United States and the European Union.
5. AI processing
Xeo is built on large language models. Content from your sites, your business profile, competitor pages, the Google services you connect, and the repository files and build logs a task needs is sent to Amazon Bedrock to produce topic maps, page plans, drafts, code, and build fixes. Some features can instead run a model inside your own browser; that processing stays on your device. We do not use your content to train models. What the model provider does with prompt data is governed by its own terms, so those apply in addition to this policy.
Generated output is a machine's suggestion, not a checked fact. Review it before you publish or deploy it.
6. How long we keep it
Plainly: by default, until you ask us to delete it.
- Account records, sites, connections, billing and referral records — kept for as long as the account exists.
- Crawled pages and everything derived from them, data from connected services, hosted blog posts, build records and AI job history — kept indefinitely unless an expiry is configured for your deployment, or you use the in-product reset, which deletes your sites, their connections, their crawl data, and your job history.
- Connection tokens and keys — deleted when you disconnect.
- Short-lived items — email verification links expire after 24 hours, sign-in sessions after 7 days, refresh sessions after 30 days, temporary build branches are deleted once the build is read, and staged raw HTML is discarded once a page has been parsed.
7. Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, obtain a copy in a portable format, object to or restrict how we use it, and withdraw consent you previously gave. Withdrawing consent does not undo processing that already happened.
How deletion actually works today. There is no self-service "delete my account" button yet. Email tools@xerebo.com from your account address and we will erase your account and associated data — including data from Google services you connected — within 30 days, other than records we are required to keep for accounting. The same address handles access and export requests. We are telling you this rather than describing a button that does not exist.
You can disconnect any third-party account from inside the product at any time, and revoke our access from that provider's own settings. You can clear your sites and crawl data yourself using the reset in the product. If you are in the EEA or UK you also have the right to complain to your local data protection authority.
8. Security
Connection tokens, content-system keys, and the keys for APIs we write are encrypted at rest with AES-256-GCM. Passwords are stored as bcrypt hashes. Traffic is served over HTTPS with HSTS, and API responses are encrypted in transit with a per-session key. Your code is built on GitHub's machines, not ours. Access to production data is limited to people who need it.
No system is perfectly secure, and we cannot promise otherwise. If a breach affects your personal data we will notify you and any regulator we are required to tell, without undue delay.
9. Children
Xeo is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
10. Changes
We will update this page when the product changes what it does with your data. The date at the top always reflects the current version. If a change materially affects you we will tell you by email or in the product before it takes effect.