Privacy policy

This is a translation for convenience; the German version prevails.

1. Controller

ESSOTEC, LLC, Robocha str. 52, 73000 Kherson, Ukraine
Email: [email protected]

This policy covers the websites xenaxio.com and xenrooms.com (XenRooms, a product of Xenaxio). Separate agreements, in particular a data processing agreement, apply to companies using the platform app.xenaxio.com.

2. In short

This website sets no cookies and loads no fonts or scripts from third parties. For anonymous visitor statistics we use the open-source tool Umami on our own server in Germany (section 4). No IP addresses are stored and no profiles are built across websites. Requests sent with the “Request access” form are stored in our customer management system at Salesforce (section 7).

3. Hosting and server log files

The website runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. When you visit, the server processes technically necessary data: IP address, date and time, page requested, referrer, browser identifier and status code. The purpose is secure and stable operation; the legal basis is Art. 6(1)(f) GDPR. Log files are deleted once they are no longer needed for this purpose.

4. Anonymous visitor statistics (Umami)

To understand how the website is used and to improve it, we use Umami (open source, run on our own server at Hetzner in Germany, nothing shared with third parties) to record: pages viewed and their order, the referrer (which website you came from) and campaign parameters in the address (utm_…), clicks on buttons and links (e.g. “Request a quote”, “Book a demo”, sign in, language switch), page load times, browser, operating system, device type, screen size and language, and the country and region derived from the IP address. The IP address itself is not stored. To count unique visits, an identifier is derived from the IP address, the browser identifier and a random value that changes monthly; it does not identify you and cannot be linked after a month. No cookies are set and nothing is stored on your device. If “Do Not Track” is enabled in your browser, nothing is recorded.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a website that meets visitors’ needs). You may object at any time (Art. 21 GDPR), e.g. by enabling “Do Not Track” or by writing to us. We delete the statistics once they are no longer needed for this purpose.

Usage statistics of the apps. We also use Umami to count the use of the web apps of Xenaxio (app.xenaxio.com, the companies’ portals and their own addresses) and XenRooms (xenrooms.app), including the public pages for booking, webinar registration and meetings. Recorded are only the area of the app without content, names or identifiers (e.g. “/mail”, not the folder or the email), events such as sign-in, sign-up, opening the AI assistant or joining a meeting, and the company (its portal name), the product, the plan, the role (user or admin) and whether the app is installed. A person’s name, email address or identifier is not recorded, and neither is the content of emails, files, calendars or chats. As above: no cookies, no stored IP address, “Do Not Track” is honoured. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in running and improving the apps).

5. Cloudflare

For delivery and protection against attacks we use Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Your IP address and request data pass through Cloudflare’s servers. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and fast website). Cloudflare is certified under the EU-US Data Privacy Framework; the EU Commission’s standard contractual clauses also apply.

6. Contacting us by email

When you write to us, we process your details to answer your request and prepare an offer (Art. 6(1)(b) GDPR). Emails are stored with our email provider Hosting Ukraine LTD, Kyiv, Ukraine, i.e. outside the EU; we ourselves are also based in Ukraine. We delete the data when it is no longer needed and no statutory retention periods apply.

7. Request form and customer management (Salesforce)

When you send a request with the “Request a quote” form or a short request, we process the details from the form – name, business email address, company and, if given, phone, country, city, number of mailboxes, team size, domain, preferred operation, topic and your message – and the page of this website you sent the form from (with any campaign parameters such as utm_source in its address) to answer your request and prepare an offer. The legal bases are Art. 6(1)(b) GDPR (pre-contractual steps at your request) and your consent under Art. 6(1)(a) GDPR, which you give by sending the form and may withdraw at any time with effect for the future.

The form is sent to our own server at Hetzner in Germany; your browser does not connect to any third party and no cookies are set. From there we pass the details to our customer management system Salesforce (Salesforce, Inc., Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA), which acts on our behalf, and send a copy by email to our mailbox (section 6). Salesforce is certified under the EU-US Data Privacy Framework; the EU Commission’s standard contractual clauses also apply. We delete the details once they are no longer needed for this purpose and no statutory retention periods apply.

The same applies when you book or request a meeting via “Book a demo”: the booking page runs on our platform at Hetzner in Germany; your details from the booking form – name, email address, company and, if given, phone and message – together with the chosen time and the page of this website you came from also go to Salesforce so that we can prepare the call.

7a. Live demo

The live demo at https://app.xenaxio.com/en/demo/ runs on our platform at Hetzner in Germany. You need no account and give no details; we set a session cookie that is technically required to sign you in to the demo. To limit abuse, we store a keyed hash (HMAC) of your IP address with the start time (at most five starts per hour) and delete it after two days. Everything you enter in the demo (emails, events, files, chat, questions to the AI assistant) stays in the sample company and is deleted when the demo ends; it ends 90 minutes after the start at the latest. Questions to the AI assistant are processed by Mistral AI (France) through its EU endpoint, as in Xenaxio Cloud. Video meetings and calls in the demo run on our own media server in Germany; picture and sound are only transmitted, never recorded. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in showing the product and protecting it from abuse). If you send your contact details when ending the demo, section 7 applies.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Write to [email protected]. You may also lodge a complaint with a data protection supervisory authority.