01Who we are
XJPCNM (“XJPCNM”, “we”, “us”) is operated by [Company legal name], a company registered at [Registered address]. We provide XJPCNM One, XJPCNM Flow, XJPCNM Cloud and related websites, APIs and services (together, the “Services”).
For personal information you share with us when visiting our website, signing up or contacting us, we act as the controller. For information our customers put into the Services, we act as a processor on their behalf — see Customer Content & AI.
02Scope
This policy applies to xjpcnm.com and its subdomains, our applications and APIs, and our sales, support and marketing activities. It does not apply to third-party websites or services you connect to the Services; their own privacy policies apply.
If your organization gives you access to the Services, your organization’s administrator controls your account and the content in it, and your organization’s own policies may also apply.
03Information we collect
In shortInformation you give us, information generated when you use the Services, and a limited amount from third parties.
| Category | Examples | Source |
|---|---|---|
| Account data | Name, work email, company, role, password hash, profile settings | You or your administrator |
| Contact & sales data | Information you submit through our contact or demo request forms, emails and call notes | You |
| Billing data | Billing contact, address, tax ID, transaction history. Card details are handled by our payment processor; we do not store full card numbers. | You, payment processor |
| Usage data | Features used, API requests and metadata, workflow run logs, error reports, timestamps | Automatically |
| Device & log data | IP address, browser type, operating system, referring URL, approximate location derived from IP | Automatically |
| Customer Content | Documents, messages, prompts, workflow inputs and outputs, and other data you upload or process | You or your organization |
| Integration data | Data from third-party tools you choose to connect, within the permissions you grant | Connected services |
We do not intentionally collect sensitive personal information. Please do not submit it through our website forms.
04How we use information
We use personal information to:
- Provide, operate, maintain and secure the Services, including authenticating users and preventing fraud and abuse;
- Process payments and manage subscriptions and usage-based billing;
- Respond to inquiries and demo requests, and provide customer support;
- Send service communications, such as security alerts, product changes and billing notices;
- Send marketing communications where permitted — you can opt out at any time using the link in the email;
- Understand how the Services are used, in aggregated or de-identified form, so we can improve reliability and design;
- Comply with legal obligations and enforce our Terms of Service.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
05Legal bases for processing
If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases:
- Contract — to provide the Services you or your organization signed up for;
- Legitimate interests — to secure and improve the Services, respond to inquiries and conduct business-to-business marketing, balanced against your rights;
- Consent — where required, for example for certain cookies or marketing emails. You can withdraw consent at any time;
- Legal obligation — to meet tax, accounting and other legal requirements.
06Customer Content and AI
In shortYour content is yours. We process it only to provide the Services, and we never use it to train AI models.
We process Customer Content on behalf of our customers and according to their instructions, as described in our agreement with them and, where applicable, our Data Processing Addendum.
- No training. We do not use Customer Content, prompts or outputs to train or fine-tune AI models — ours or any third party’s.
- Model providers. When you use AI features, relevant content is sent to the model provider selected for that request, under contracts that restrict its use to providing the service and prohibit training on it.
- Access. Our personnel access Customer Content only when needed to provide support you request, maintain security, or comply with law.
- Deletion. Administrators can export or delete Customer Content at any time, subject to the retention periods below.
08International data transfers
We and our service providers may process personal information in countries other than the one where you live. When we transfer personal information from the EEA, UK or Switzerland, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Enterprise customers can choose where Customer Content is stored where data residency options are available.
09Data retention
- Account data — for as long as the account is active, then deleted or anonymized within 90 days of account closure, unless we must keep it longer by law;
- Customer Content — until deleted by you or your administrator; removed from backups within 30 days after deletion;
- Logs and usage data — typically up to 12 months, then aggregated or deleted;
- Sales inquiries — up to 24 months after our last interaction, unless you become a customer;
- Billing records — as long as required by tax and accounting laws.
10Security
We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, audit logging and regular security reviews. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.
To report a security issue, contact security@xjpcnm.com.
11Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal information we hold about you and receive a copy of it;
- Correct inaccurate or incomplete information;
- Delete your personal information;
- Object to or restrict certain processing, including direct marketing;
- Data portability;
- Withdraw consent where processing is based on consent;
- Lodge a complaint with your local data protection authority.
California residents have the right to know, delete and correct personal information, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law.
To exercise your rights, email privacy@xjpcnm.com. We will verify your request and respond within the time required by law. If your account is managed by an organization, we may refer your request to that organization.
13Children
The Services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
14Changes to this policy
We may update this policy from time to time. We will post the updated version on this page and change the “Last updated” date. If changes are material, we will notify you by email or through the Services before they take effect.
15Contact us
Questions about this policy or our privacy practices can be sent to:
- Email: privacy@xjpcnm.com
- Post: [Company legal name], [Registered address]
- EU / UK representative: [Name and address, if required]
Have a privacy question?
Our team usually replies within two business days.