Privacy Policy

This Privacy Policy explains how XiPlay ("we") handles personal data for the XiPlay Service, in line with applicable data-protection laws, including the GDPR where it applies.

1. Data we process

• Account data: name, email, company, and role.
• Device data: hardware MAC address, serial, model, firmware, IP address and last-seen time, used to license and manage your players.
• Billing data: handled by our payment processor; we do not store card numbers.
• Marketing leads: details you submit via our demo/contact form.

2. How we use it

To provide and secure the Service, license devices, process payments, provide support, and (with your consent) send product updates.

3. Cookies & analytics (consent-based)

We set no analytics cookie unless you opt in. On your first visit to this marketing website (xiplay.app) we ask whether you accept analytics. Until you accept, Google Analytics is not loaded at all; no script is downloaded and no cookie is written. Declining costs you nothing: every page works exactly the same.

If you accept, we use Google Analytics 4 to understand how visitors find and use the site: which pages are read, and which lead to a trial or demo request. It then sets first-party cookies (_ga, _ga_<id>) and processes your IP address (truncated), device and browser type, and the pages you view. Google acts as our processor for that data. We do not use analytics to profile you, and we run no advertising or ad-personalisation tags.

Withdrawing consent is as easy as giving it: choose Cookie settings in the footer of any page to change your decision at any time. Declining also deletes any analytics cookies previously set. You may additionally use your browser's cookie controls or Google's opt-out add-on.

Strictly necessary cookies (for example, your session when signed in to the portal) are exempt from consent because the Service cannot function without them. We run no analytics or advertising trackers inside the XiPlay portal (app.xiplay.app) at all.

4. Retention

We retain personal data only as long as needed for the purposes above or as required by law. Device heartbeat logs are retained for a limited window and then deleted. Analytics data is retained for a limited period and then deleted or aggregated.

5. Your rights

You may request access, correction, export, or erasure of your personal data, and object to certain processing. Contact privacy@xiplay.app.

6. Data residency & security

We host data with reputable cloud providers, encrypt data in transit, and protect secrets in a key-management system. We never expose credentials in logs.