Privacy Policy

2.1 Account Information

When you register for a XILA account, we collect essential contact and identity details. This includes your email address, phone number, full legal name, date of birth, and optional demographic data such as gender and geographic location. For business accounts, we also collect formal business registration details and tax identification numbers necessary for compliance and verification.

2.2 Profile Data

To help you connect with others in the marketplace, you may choose to provide additional profile information. This includes personal biographies, cover photos, external website links, social media handles, professional business descriptions, employment history, verified certifications, and specific interests or preferences.

2.3 Chat & Messaging Data

We facilitate communication between users for product inquiries, service bookings, and job applications. We collect message content (text, files, images, videos) and associated metadata (timestamps, sender/receiver IDs, read receipts). Conversations linked to specific marketplace entities (e.g., a product listing) are also tracked.

2.4 Call Data

For users utilizing our integrated voice and video calling features, we collect call metadata, including call duration, participant identities, timestamps, and network quality metrics. We strictly do not record audio or video content unless explicitly authorized by all participants or required by a valid legal process.

2.5 Payment Information

We collect transaction history, billing addresses, and records of credit purchases. Financial transactions are securely processed by our payment partner, Stripe. XILA does not directly store your full credit card numbers or raw bank account details on our servers.

2.6 Usage & Analytics Data

As you navigate the platform, we automatically log technical data. This includes your device specifications, IP address, operating system, browser type, pages visited, specific features utilized, search queries, application crash reports, and the referral sources that led you to our platform.

2.7 Media Uploads

When you upload content, we collect the files themselves (images, videos, PDF documents) along with inherent file metadata, such as file names, sizes, formats, and the exact timestamps of upload.

2.8 Marketplace Activity

We maintain a comprehensive record of your interactions within the marketplace ecosystem. This encompasses product listings created, service appointments booked, job applications submitted, rental reservations made, lead unlocks, detailed transaction records, and the ratings and reviews you publish or receive.

3.1 Platform Operation

We use your information to:

• Provide, maintain, and improve the Platform

• Process transactions and manage subscriptions

• Enable communication features (chat, calls)

• Facilitate marketplace transactions

• Manage user accounts and profiles

• Provide customer support

3.2 Personalization

We use your information to:

• Personalize your experience on the Platform

• Recommend products, services, jobs, or rentals

• Show relevant content and advertisements

• Customize features and settings

3.3 Communication

We use your information to:

• Send transactional emails (confirmations, receipts, notifications)

• Send marketing communications (with your consent)

• Respond to your inquiries and support requests

• Send important updates about the Platform

3.4 Security and Fraud Prevention

We use your information to:

• Detect and prevent fraud, abuse, and security threats

• Verify user identities

• Enforce our Terms and Conditions

• Protect the rights and safety of users

3.5 Analytics and Improvement

We use your information to:

• Analyze Platform usage and performance

• Improve our services and features

• Conduct research and development

• Generate aggregated, anonymized statistics

4.1 Public Information

The following information may be publicly visible:

• Public profiles: Name, profile photo, bio (if profile is set to public)

• Business profiles: Business name, description, services (publicly listed)

• Listings: Products, services, jobs, rentals you list (publicly searchable)

• Public posts: Social media posts set to public visibility

• Reviews: Reviews you write (may be visible to other users)

4.2 Marketplace Transactions

We share information necessary for marketplace transactions:

• Buyer information: Shared with sellers for order fulfillment

• Seller information: Shared with buyers for transaction completion

• Service providers: Shared with clients for service delivery

• Job applicants: Shared with employers for hiring processes

4.3 Communication Features

Information shared through communication features:

• Chat messages: Shared with intended recipients

• Call information: Participant information shared with other call participants

• Group communications: Shared with group members

4.4 Service Providers

We share information with third-party service providers who perform services on our behalf:

• Cloud hosting providers: For data storage and processing

• Payment processors: For payment processing (see Section 6.3)

• Communication services: Agora for chat and calls (see Section 6.1 and 6.2)

• Email service providers: For sending emails

• Analytics providers: For usage analytics

• Customer support tools: For providing customer support

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change in ownership.

4.6 Legal Requirements

We may disclose your information if required by:

• Law, regulation, or legal process

• Government requests or court orders

• To protect our rights, property, or safety

• To protect the rights, property, or safety of our users

6.1 Google Workspace / Google Calendar

• Purpose: Sync calendars and events between Xila Calendar and Google Calendar.

• Data processed: Google account identifiers; calendar and event data; free/busy information as needed for scheduling.

• Permissions (high level): Identify your Google account; read and write calendars and events you authorize for sync.

• Tokens: OAuth tokens are stored encrypted (see Data Security).

• Disconnect: You can disconnect Google Calendar in Xila Calendar Settings. You may also revoke access in your Google Account permissions. After disconnect, stored OAuth tokens are deleted or made unusable.

• Commitments: Google Workspace API Limited Use applies (see Section 5). Google Calendar data is not used for advertising or to train generalized AI models.

6.2 Zoom

• Purpose: Create Zoom meetings and join links for Xila calendar events and bookings on your Zoom account.

• Data processed: Zoom user identifiers; OAuth tokens; meeting identifiers and join URLs created for your events.

• Permissions (high level): Identify your Zoom account; create and delete online meetings as needed for linked Xila events.

• Tokens: OAuth tokens are stored encrypted (see Data Security).

• Disconnect: You can disconnect Zoom in Xila Calendar Settings and/or remove the app in the Zoom Marketplace. After disconnect, stored OAuth tokens are deleted or made unusable.

• See /docs/zoom-integration for setup and removal instructions. Zoom data is not used for advertising or to train generalized AI models.

6.3 Outlook / Microsoft Graph

• Purpose: Sync calendars and events with Outlook via Microsoft Graph and create Microsoft Teams meeting links when you choose that option.

• Data processed: Microsoft account identifiers; OAuth tokens; calendar and event data; Teams meeting join links created for your events.

• Permissions (high level): Identify your Microsoft account; read and write calendars; create online meetings.

• Tokens: OAuth tokens are stored encrypted (see Data Security).

• Disconnect: You can disconnect Outlook in Xila Calendar Settings and/or revoke Xila's access in your Microsoft account. After disconnect, stored OAuth tokens are deleted or made unusable.

• See /docs/outlook-integration for setup and removal instructions. Outlook / Graph data is not used for advertising or to train generalized AI models.

6.4 Provider Comparison

8.1 Data Storage Location

Your data is stored on secure servers. We may transfer and store your data in other locations for redundancy, performance, or legal compliance purposes.

8.2 Chat Message Retention

• Active accounts: Messages are retained for 2 years from the date of the message

• Deleted accounts: Messages are retained for 30 days after account deletion

• Archived messages: May be retained longer if you choose to archive them

• Legal requirements: Messages may be retained longer if required by law

8.3 Call Log Retention

• Call logs: Retained for 1 year from the date of the call

• Call metadata: Retained according to the same schedule

• Call recordings: If recordings are made (with consent), retained according to consent terms or legal requirements

8.4 Media File Storage

• Active accounts: Media files are retained while your account is active and within storage quotas

• Storage quotas: Subject to your subscription plan (see Terms and Conditions)

• Deleted files: Permanently deleted 30 days after deletion

• Account deletion: All media files deleted 30 days after account deletion

8.5 Account Data Retention

• Active accounts: Data retained while account is active

• Inactive accounts: Data retained for 90 days after last activity

• Deleted accounts: Most data permanently deleted after 30 days

• Legal requirements: Some data may be retained longer for legal, tax, or regulatory purposes

9.1 Agora Chat SDK

Our chat and messaging features are powered by Agora Chat SDK. When you use chat features:

• Data processing: Messages and chat data are processed by Agora

• Data storage: Chat data may be stored on Agora's servers

• Privacy practices: Agora's privacy practices apply to chat data processing

• Security: Agora implements security measures to protect chat data

9.2 Agora RTC SDK

Our voice and video calling features are powered by Agora RTC SDK. When you use calling features:

• Data processing: Call data and metadata are processed by Agora

• Media streams: Audio and video streams are transmitted through Agora's infrastructure

• Privacy practices: Agora's privacy practices apply to call data processing

• No recording: We do not record calls unless explicitly authorized and required by law

9.3 Payment Processors

Payment processing is handled by third-party payment processors (e.g., Stripe). When you make payments:

• Payment data: Payment information is processed by the payment processor

• Data storage: Payment processors store payment data according to their policies

• Security standards: Payment processors comply with PCI DSS security standards

• Privacy practices: Payment processor privacy practices apply to payment data

We do not store full credit card numbers. For more information, please review your payment processor's Privacy Policy.

10.1 Security Measures

We implement industry-standard security measures to protect your information:

• Encryption: Data in transit is encrypted using TLS/SSL

• Secure storage: Data at rest is encrypted

• Access controls: Limited access to personal data on a need-to-know basis

• Authentication: Secure authentication and authorization systems

• Monitoring: Continuous monitoring for security threats

• Regular audits: Security audits and vulnerability assessments

• Connected provider tokens: OAuth access tokens for calendar and meeting providers are encrypted at rest, transmitted over encrypted connections, accessible only to the authenticated user's connection and least-privilege internal systems that operate the integration, and refreshed as needed when they expire

10.2 Data Breach Notification

In the event of a data breach that may affect your personal information, we will:

• Notify affected users within 72 hours (where required by law)

• Provide information about the nature of the breach

• Explain steps we are taking to address the breach

• Recommend steps you can take to protect yourself

11.1 Access Rights

You have the right to:

• Access your personal information

• Request a copy of your data

• Review what information we have about you

Contact: support@xila.com

11.2 Correction Rights

You have the right to:

• Correct inaccurate information

• Update your personal information

• Modify your profile data

You can update most information through your account settings.

11.3 Deletion Rights

You have the right to:

• Request deletion of your personal information

• Delete your account and associated data

• Request deletion of specific data

Note: Some information may be retained for legal, tax, or regulatory purposes even after account deletion.

11.4 Data Portability

You have the right to:

• Receive your data in a structured, commonly used format

• Transfer your data to another service

• Export your data from the Platform

Contact: support@xila.com

11.5 Objection and Restriction Rights

You have the right to:

• Object to processing of your personal information

• Restrict processing of your personal information

• Opt out of certain data uses

Contact: support@xila.com

11.6 Withdrawal of Consent

Where processing is based on consent, you have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

12.1 Types of Cookies

We use the following types of cookies:

• Essential cookies: Required for Platform functionality

• Performance cookies: For analyzing Platform performance

• Functionality cookies: For remembering your preferences

• Advertising cookies: For showing relevant advertisements

12.2 Cookie Management

You can manage cookies through:

• Your browser settings

• Emailing support@xila.com

• Opt-out tools provided by third-party services

Note: Disabling certain cookies may affect Platform functionality.

12.3 Third-Party Tracking

Third-party services may use tracking technologies on our Platform. We do not control these tracking technologies. Please review third-party privacy policies for information about their tracking practices.

14.1 Data Transfer

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your country.

17.1 Policy Updates

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on the Platform

• Sending email notifications to registered users

• Updating the "Last Updated" date