Privacy Policy
This policy explains what Xeo collects when you use it, why, who else sees it, and what you can ask us to do about it. It describes the product as it is built today. Where something is not yet automated, this page says so rather than implying otherwise.
Questions, requests, or complaints: tools@xerebo.com.
1. What we collect
Your account
| Data | Why we hold it |
|---|---|
| Email address | Identifies the account, receives verification and job-completion mail. |
| Password, hashed | Sign-in. Stored as a bcrypt hash — we never hold the password itself. |
| Google account id and display name | Only if you sign in with Google, so we can match you to the same account next time. |
| The IP address you signed up from, with the time and version of the terms you accepted | Proof of consent. This is a record we keep so we can show when and to what you agreed. |
| Plan, trial dates, subscription status, Stripe customer id, referral code | Billing and access. |
| Push notification subscriptions | Only if you turn browser notifications on. |
Sites and content you point us at
- The domains you add, and the token and events that prove you verified them.
- Pages we crawl from those sites: URLs, headings, body text, metadata, images, and the raw HTML and CSS, plus everything derived from them — topic maps, page classifications, embeddings, drafts, and published output.
- Pages we crawl from competitor sites we find for you through public search results. Those sites do not belong to you and their operators are not our users. We treat that content as publicly available material gathered for competitive analysis, and we honour
robots.txton any domain you have not verified as your own. - Anything you type into the product: business details, services, authors, prompts, and edits.
Connected accounts
When you connect Google Search Console, Google Analytics, Google Business Profile, GitHub, WordPress.com, or Shopify, we store the access and refresh tokens that connection issues. Tokens are encrypted at rest with AES-256-GCM before they are written to the database. We also store what the connection returns while you use it — for example the properties in your Search Console account, or the file tree of the repository you chose.
The GitHub connection is broad. GitHub's OAuth grants access at the scope level, and the scope we request (repo) covers read and write on your repositories, including private ones — not only the repository you pick. We only read the files needed to generate a page and only write to a xeo/… branch, but the permission itself is wider than that. If that is more than you want to grant, use the manual export instead of connecting GitHub, and revoke access at any time from your GitHub settings.
What we do not collect
- No cookies. Xeo sets none. Your sign-in session is a token kept in your browser's local storage, which means it stays on your device and is not sent to us automatically the way a cookie would be.
- No third-party analytics or tracking. There is no Google Analytics, Segment, PostHog, Mixpanel, Hotjar, or advertising pixel in this product. We do not track you across other websites, and we do not sell or share personal information for advertising.
- No card details. Payment is handled on Stripe's own hosted checkout. Card numbers never reach our servers.
About that session token. It is held in your browser's local storage, along with a key used to encrypt data in transit between your browser and our API. Any script running on the page can read local storage, so treat the token like a password: sign out on shared machines, and do not paste browser-console snippets you were given by someone else.
2. Why we are allowed to use it
Depending on where you live, the legal bases we rely on are:
- Performance of a contract — running the account, crawling your sites, generating and deploying pages, billing you.
- Consent — the terms and privacy acceptance at signup, connecting a third-party account, enabling push notifications, and crawling a domain you have verified in a way that overrides its
robots.txt. - Legitimate interests — keeping the service secure and working, preventing abuse, and competitive research on publicly available pages.
- Legal obligation — keeping billing records.
3. Who else sees it
We do not sell your data. We share it only with the providers below, each of which processes it to deliver part of the service:
| Provider | What reaches them |
|---|---|
| Microsoft Azure (AI Foundry, and optionally Blob Storage) | The AI models that write and analyse content. Page text and HTML, your business and service details, competitor page content, and the repository files selected for a deployment are sent as prompts. Bulk crawled HTML may also be stored in Azure Blob Storage. |
| Google (Gemini) | The same kind of content, only if you select Google as the model provider. |
| Google (sign-in, Search Console, Analytics, Business Profile, Ads keyword data, Search) | Your identity on sign-in; the account data of whichever Google services you connect; keyword and public search queries. |
| Stripe | Your email address and an internal account id, to create a customer and run checkout and subscriptions. |
| GitHub, WordPress.com, Shopify | Only what a connection you made requires — reading the files we need and publishing the pages you deploy. |
| MongoDB | The database everything above is stored in. |
| Our email provider (SMTP) | Your email address and the contents of verification and notification mail. |
| Your browser vendor's push service | Only if you enable notifications. Delivering a push message necessarily routes it through Google, Mozilla, or Apple, depending on your browser. |
We may also disclose data where the law requires it, or to protect our rights, users, or the security of the service. If the business is sold or merged, account data may transfer to the buyer; we will say so before that takes effect.
These providers operate globally, so your data may be processed outside the country you are in, including in the United States and the European Union.
4. AI processing
Xeo is built on large language models. Content from your sites, your business profile, competitor pages, and selected repository files is sent to the model provider named above to produce topic maps, page plans, drafts, and code. We do not use your content to train our own models. What a model provider does with prompt data is governed by that provider's own terms, so their policies apply in addition to this one.
Generated output is a machine's suggestion, not a checked fact. Review it before you publish it.
5. How long we keep it
Plainly: by default, until you ask us to delete it.
- Account records, sites, connections, billing and referral records — kept for as long as the account exists.
- Crawled pages and everything derived from them — kept indefinitely unless an expiry is configured for your deployment, or you use the in-product reset, which deletes your sites, their connections, their crawl data, and your job history.
- Short-lived items — email verification links expire after 24 hours, sign-in sessions after 7 days, refresh sessions after 30 days, and staged raw HTML is discarded once a page has been parsed.
6. Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, obtain a copy in a portable format, object to or restrict how we use it, and withdraw consent you previously gave. Withdrawing consent does not undo processing that already happened.
How deletion actually works today. There is no self-service "delete my account" button yet. Email tools@xerebo.com from your account address and we will erase your account and associated data within 30 days, other than records we are required to keep for accounting. The same address handles access and export requests. We are telling you this rather than describing a button that does not exist.
You can disconnect any third-party account from inside the product at any time, and revoke our access from that provider's own settings. You can clear your sites and crawl data yourself using the reset in the product. If you are in the EEA or UK you also have the right to complain to your local data protection authority.
7. Security
Connection tokens are encrypted at rest with AES-256-GCM. Passwords are stored as bcrypt hashes. Traffic is served over HTTPS with HSTS, and API responses are encrypted in transit with a per-session key. Access to production data is limited to people who need it.
No system is perfectly secure, and we cannot promise otherwise. If a breach affects your personal data we will notify you and any regulator we are required to tell, without undue delay.
8. Children
Xeo is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
9. Changes
We will update this page when the product changes what it does with your data. The date at the top always reflects the current version. If a change materially affects you we will tell you by email or in the product before it takes effect.