Privacy Policy

1. Information We Collect

We collect information that you provide to us directly, as well as information generated automatically through your use of the Service, including account details, profile content, and technical data such as IP address, browser type, device information, and access logs necessary to operate, secure, and maintain the Service.

2. Account Information

Upon registration, we store your email address, username, a hashed representation of your password (maintained via our authentication provider), and such profile fields as you elect to publish, including display name, biography, theme preferences, social links, and similar information.

3. Email Communications

We use your email address to provide important communications relating to your account, including verification emails, password resets, security notifications, purchase confirmations, and other service-related notices.

Where you have provided consent or where otherwise permitted by applicable law, we may also send you product updates, announcements, or promotional communications. You may opt out of marketing communications at any time using the unsubscribe instructions provided in those emails. Transactional and security-related communications may continue to be sent where necessary for the operation of the Service.

4. Uploaded Files

Avatars, banners, backgrounds, cursors, favicons, and badge icons uploaded by you or by an administrator are stored in object storage and, where used in connection with a public profile, may be accessible to the public. You should not upload documents containing sensitive personal information.

5. Cookies and Similar Technologies

We employ cookies or comparable storage mechanisms to maintain authentication sessions and to enable essential functionality of the Service. Disabling cookies may impair your ability to sign in.

6. Analytics

We may employ privacy-conscious analytics tools or hosting-provider metrics to evaluate traffic patterns and system reliability. We do not sell personal information, nor do we share personal information with third parties for cross-context behavioral advertising.

7. Data Storage

Information is stored through our infrastructure providers, including Supabase, which provides authentication, database, and storage services. Servers may be situated in jurisdictions selected by such providers, which may be located outside of your country of residence. Where information is transferred internationally, we rely on the safeguards made available by our infrastructure providers, which may include standard contractual clauses or equivalent mechanisms recognized under applicable data protection law. We retain information for as long as your account remains active and thereafter as required for security, legal, or operational purposes.

Compliance with Australian Privacy Law

Where applicable, XV handles personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs).

If you access the Service from outside Australia, you acknowledge that your information may be transferred to and processed in Australia or other jurisdictions in which our service providers operate.

8. Security

We implement measures consistent with industry practice, including encrypted transport via HTTPS, row-level security on database tables, and access controls governing administrative actions. No method of transmission or storage can be guaranteed to be entirely secure.

9. Data Breach Notification

While we implement reasonable technical, administrative, and organizational safeguards designed to protect personal information, no method of electronic transmission or storage can be guaranteed to be completely secure.

If we become aware of a security incident involving unauthorized access to personal information, we will investigate the incident promptly and, where required by applicable law, notify affected users and any relevant regulatory authorities within the timeframes prescribed by law.

10. Service Logs

To help operate, secure, and improve the Service, we automatically generate and retain logs relating to authentication events, account activity, API requests, security events, error reports, and general system performance. These logs are used to detect abuse, investigate security incidents, troubleshoot technical issues, and comply with legal obligations.

11. Third-Party Services

The Service relies on third-party providers to deliver certain functionality. These providers may process personal information in accordance with their own privacy policies.

Current providers include:

• Supabase, which provides authentication, database, and object storage services.
• Stripe, which securely processes payments for subscriptions and other purchases. XV does not receive or store your complete payment card details. Payment information is collected and processed directly by Stripe in accordance with Stripe's Privacy Policy.

We may integrate additional third-party service providers as the Service evolves.

12. Automated Systems

We may use automated systems to detect spam, fraud, abuse, security threats, or violations of our Terms of Service and Acceptable Use Policy. Where appropriate, actions taken by automated systems may be reviewed by a human.

13. Legal Basis for Processing

Where required by applicable law, we process your personal information on one or more of the following bases: (a) performance of the agreement between you and XV, including provision of the Service you request; (b) your consent, where applicable, such as with respect to certain cookies; (c) our legitimate interests in operating, securing, and improving the Service; and (d) compliance with our legal obligations.

14. Children's Privacy

The Service is not directed to, and is not intended for use by, children under the age of 13 (or the applicable minimum age of digital consent in your jurisdiction, if higher). We do not knowingly collect personal information from such individuals. If we become aware that we have collected personal information from a child in violation of this Policy, we will take reasonable steps to delete such information.

15. Your Rights

Depending on your jurisdiction, you may have rights under applicable data protection law, including the right to: access the personal information we hold about you; correct inaccurate information; request deletion of your information; object to or restrict certain processing; and, where applicable, receive a copy of your information in a portable format. Residents of certain jurisdictions, including California, may have additional rights under applicable state law, including the right to know the categories of personal information collected and the right to non-discrimination for exercising these rights. Requests may be directed to us using the contact information below. Please note that any content you elect to publish on a public profile is accessible to any person possessing the applicable link.

16. Data Deletion

You may request deletion of your account through your account settings. Deletion removes your profile and associated content from active systems, subject to residual copies retained in backups and any retention required by applicable law. Certain records, such as those relating to abuse reports, may be retained in anonymized or limited form.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Effective Date" above and, where appropriate, through additional notice on the Service. Your continued use of the Service following such updates constitutes your acknowledgment of the revised Policy.

18. Contact

Questions regarding this Privacy Policy, or requests to exercise your data protection rights, should be directed to:

contact@x-v.bio