Privacy Policy

This policy explains what personal data xbuild collects and how it’s used. XVN Web Services is the data controller. Contact us at [email protected] about anything in it.

What we collect

• Account details: your name, email address and a securely hashed password.
• Your projects: the prompts and chat messages you write, the website code generated for you, its version history and whether it’s published.
• Usage records: when you run generations, whether they succeeded and how many AI tokens they used, so we can apply plan limits and control costs.
• Billing: if you subscribe to Pro, Stripe processes your payment. We receive your Stripe customer and subscription IDs and the subscription status, never your full card details.
• Technical data: IP address, browser type and session information, used for security, preventing abuse and keeping you logged in. Server logs are kept for up to 14 days.
• Abuse reports: if you report a site, the details you give us and your IP address.

How we use it

To provide xbuild (performance of our contract with you), to keep it secure and prevent misuse (our legitimate interests), to take payments, and to meet legal obligations such as keeping financial records. We don’t sell your data and don’t use it for advertising.

AI processing

To generate and edit your site, your prompt and your site’s current code are sent to Anthropic, our AI provider, which processes them on our behalf. Anthropic does not use data sent through its commercial API to train its models. Please don’t include sensitive personal information in your prompts.

Who we share it with

Only the service providers we need: our hosting provider (servers in the UK/EU), Anthropic (AI generation, which may involve processing in the United States under appropriate safeguards), Stripe (payments) and our email delivery system. Published sites are public by design: anyone with the address can see them.

Cookies

xbuild uses only essential cookies: a session cookie, a security (CSRF) token and, if you choose “keep me logged in”, a remember-me cookie. There are no analytics or advertising cookies. Published sites are shown in a sandbox that can’t read xbuild’s cookies.

How long we keep it

We keep your account and projects until you delete them or close your account. Deleted projects are removed from view immediately and erased from our database within 30 days; deleting your account erases your projects straight away. Billing records are kept for six years for tax purposes.

Your rights

You can access, correct, export or delete your data, object to or restrict certain processing, and withdraw consent where we rely on it. Most of this you can do yourself from your account; for anything else, email us. You can also complain to the UK Information Commissioner’s Office at ico.org.uk.

Changes

We’ll update this page if anything changes and tell you by email if the change is significant.