XOROX
Get started

Privacy Policy

Last updated: October 4, 2026

This Privacy Policy explains how XOROX collects, uses, and protects information when you use the XOROX application, visit the public XOROX website, or interact with us. It is written to reflect how XOROX actually works today. It is not legal advice, and it will be updated as the product changes.

1. Who operates XOROX

XOROX is operated by Devinvestory OÜ, an Estonian private limited company registered at Nurme tn 3, Rapla linn, Rapla vald, Rapla maakond, 79511, Estonia (registry code 14994085), acting as the data controller for personal information processed through the XOROX service and website.

2. Information you provide to us

When you create and use a XOROX account, you provide us with:

  • Account information — your name (optional), email address, and password, provided at signup.
  • Workspace and team information — workspace names, member email addresses you invite, and the role you assign them.
  • Project content — the projects, Rulesets, Specifications, and Tasks you create in XOROX, and the project credentials (API tokens) you generate to connect a project to a coding-agent integration.
  • Invitation information — if you invite someone to a workspace, their email address and the invitation's status.
  • Billing information — handled directly by Stripe on our behalf; see Section 6.
  • Support communications — anything you send us directly, such as a support request.

3. Technical and service information

To operate, secure, and troubleshoot XOROX, our infrastructure providers and application necessarily process standard technical information involved in handling web and API requests, such as IP address, request metadata, and timestamps. We do not currently commit to a specific logging or retention schedule for this information beyond what is reasonably necessary to run and secure the service — see Section 10.

4. Authentication and browser storage

XOROX does not set cookies. The XOROX application uses your browser's local storage (not cookies) to keep the product working the way you'd expect between visits:

  • Session / authentication — a session token that keeps you signed in.
  • Theme preference — your light/dark mode choice.
  • Workspace and project preferences — your last-selected workspace and recently opened projects, so navigating back to them is faster.
  • Invitation flow — a temporary record of a pending workspace invitation while you sign up or sign in to accept it.

This storage is first-party (set by XOROX itself, not a third party), stays on your device, and exists only to make the product function. None of it is used for advertising or for tracking you across other websites.

5. Cloudflare Web Analytics

The public XOROX website (xorox.eu, including its documentation) uses Cloudflare Web Analytics, a traffic-measurement feature of Cloudflare, our content-delivery and infrastructure provider, to understand aggregate website traffic — for example, which pages are visited and where visitors generally come from. According to Cloudflare's own published documentation, Cloudflare Web Analytics does not use cookies or similar client-side storage to collect these metrics. We use it only to understand overall public-site traffic, and not for advertising, cross-site tracking, or building profiles of individual visitors.

6. Stripe

XOROX uses Stripe to process subscription payments. When you subscribe, upgrade, or manage billing, you are redirected to a Stripe-hosted Checkout or Customer Portal page operated by Stripe. XOROX does not collect or store your payment card details on its own servers or frontend — that information is handled directly by Stripe. Stripe's processing of your payment information is governed by Stripe's own Privacy Policy.

7. Service providers

We use a small number of service providers to operate XOROX. Each processes data only as needed to:

  • Stripe — process subscription payments and manage billing.
  • Cloudflare — provide content delivery, DNS, edge routing, and (for the public website) Web Analytics.
  • Google Cloud — host the XOROX application and API.
  • Neon — host the XOROX database.
  • Resend — deliver transactional email, such as email verification, password reset, and workspace invitation emails.

8. Purposes of processing

We process personal information to:

  • provide and operate the XOROX service;
  • authenticate you and keep your account secure;
  • maintain your workspaces, projects, Rulesets, Specifications, and Tasks;
  • make that project context available to the coding-agent integrations you connect;
  • process subscriptions and billing, through Stripe;
  • secure, monitor, and troubleshoot the service;
  • understand aggregate traffic on our public website; and
  • communicate with you about your account or the service, including transactional email.

Where the EU/UK General Data Protection Regulation applies, we rely on the following legal bases, depending on the processing activity:

  • Performance of a contract — to provide the XOROX service you've signed up for, including account, workspace, project, and billing functionality.
  • Legitimate interests — to secure and improve the service, and to understand aggregate public-website traffic through Cloudflare Web Analytics.
  • Compliance with legal obligations — where we're required to retain or disclose information by law.
  • Consent — only where we specifically ask for it; XOROX does not currently rely on consent as the basis for Cloudflare Web Analytics.

10. Retention

XOROX does not currently have fixed, published retention periods for every category of data. We retain personal information for as long as reasonably necessary to provide the service and fulfill the purposes described in this policy, including any applicable legal, accounting, or security requirements, and for as long as your account or workspace remains active. We are working toward more specific retention commitments as the product matures.

11. Data sharing

We do not sell personal information. We share information only with the service providers listed in Section 7, each acting on our behalf to help operate XOROX, and where required by law.

12. International transfers

The infrastructure XOROX currently runs on — our application servers and primary database — is located in the European Union. Some of our service providers may process information outside the EU/EEA as part of their own global infrastructure; where that happens, we rely on the safeguards each provider makes available under its own data processing terms.

13. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict, or object to our processing of your personal information, and to receive a copy of it in a portable format. XOROX does not currently offer self-service account deletion in the product — to exercise any of these rights, including a deletion request, contact us at support@xorox.eu. You also have the right to lodge a complaint with the data protection supervisory authority in your country of residence, or, as Devinvestory OÜ is established in Estonia, with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

14. Security

We use reasonable technical and organizational measures intended to protect the information we process, such as encrypting data in transit and storing authentication credentials in hashed form rather than in plain text. No system can be guaranteed to be completely secure, and we cannot promise that information will never be accessed, disclosed, or lost as a result of a breach of these measures.

15. Changes to this Privacy Policy

We may update this Privacy Policy as XOROX evolves. If we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice.

16. Contact

Questions about this Privacy Policy, your personal information, or general support requests can be sent to support@xorox.eu.