Privacy & cookie policy.

Effective date: July 4, 2026

This policy explains how Xerensys ("Xerensys", "we", "us") collects, uses, and protects personal information when you visit this website or contact us. We serve clients in the United States, Canada, the United Kingdom, and the European Union, and this policy is written to meet the requirements that apply in each, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA).

For the purposes of EU and UK data protection law, Xerensys is the data controller for the personal information described here. You can reach us through our contact form.

1. Information we collect

• Information you give us. When you use the contact form, email us, or book a call, we receive what you provide: typically your name, email address, the service you're interested in, and your message. If you choose the email option, your message is sent from your own email application.
• Booking information. If you schedule a call through our scheduling provider, that provider collects the details you enter (name, email, chosen time) and shares them with us.
• Technical information. Our hosting provider (Vercel) processes standard server logs, IP address, browser type, pages requested, to deliver the site and protect it from abuse.
• Analytics. Only if you accept analytics in our cookie banner, we use Vercel Web Analytics, a privacy-friendly, cookieless tool that gives us aggregate page-view statistics. It does not track you across other sites and does not build a profile of you.

We do not collect special-category (sensitive) data, and we ask that you don't include any in messages to us.

2. How we use your information, and our legal bases

• Responding to enquiries and providing services, because it's necessary to take steps you've requested before entering a contract (GDPR Art. 6(1)(b)) or in our legitimate interest in responding to people who contact us (Art. 6(1)(f)).
• Running and securing the website, our legitimate interest in operating a reliable, safe site (Art. 6(1)(f)).
• Understanding site usage (aggregate analytics), only with your consent (Art. 6(1)(a)), given through the cookie banner and withdrawable at any time via "Cookie settings" in the footer.
• Marketing communications, only with your consent, and every message will include a way to opt out. We do not send marketing emails unless you've asked for them.
• Legal compliance, where we're required to keep or disclose information (Art. 6(1)(c)).

We do not sell personal information, and we do not share it for cross-context behavioural advertising (as those terms are defined in the CCPA/CPRA). Because we don't sell or share data, opt-out preference signals such as Global Privacy Control don't change anything here, analytics only ever runs if you opt in.

3. Cookies & similar technologies

This site is deliberately light on tracking. We don't use advertising cookies at all. What we do use:

You can change your choice at any time using "Cookie settings" in the footer of any page, and you can clear the stored preference through your browser settings. Declining analytics does not affect anything else on the site.

4. Who we share information with

We share personal information only with service providers who process it on our instructions:

• Vercel Inc. (US), website hosting and, with your consent, aggregate analytics.
• Google LLC (US/EU), delivery of contact-form submissions to our Google Workspace inbox (Google Apps Script).
• Our scheduling provider, call bookings you make through the contact page.
• Our email provider, correspondence with you.

Beyond that, we disclose information only to professional advisers under confidentiality, as part of a business transfer, or where the law requires it. We never give third parties personal information for their own marketing.

5. International transfers

We operate in the United States, Canada, the United Kingdom, and the European Union, so information you send us may be processed in any of those countries. Where UK or EU personal data is transferred internationally, we rely on appropriate safeguards, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or a provider's certification under the EU-US Data Privacy Framework, as applicable to each provider.

6. How long we keep information

We keep personal information only as long as needed for the purposes above. Enquiry correspondence is normally kept for up to 24 months from our last exchange, so we have context if you come back to us. Information connected to a client engagement is kept for the duration of the engagement and any period required for legal, accounting, or contractual reasons, then deleted or anonymised.

7. Your rights

If you are in the UK or EU

You have the right to access, correct, delete, or receive a copy of your personal data; to restrict or object to our processing; and to withdraw consent at any time (without affecting processing that already happened). To exercise any of these, reach us through our contact form, we'll respond within one month. You also have the right to complain to a supervisory authority: the Information Commissioner's Office (ICO) in the UK, or your local data protection authority in the EU.

If you are in the United States

Depending on your state (including California), you may have the right to know what personal information we hold about you, to access or delete it, to correct it, and to opt out of its sale or sharing. As stated above, we do not sell or share personal information. We will never discriminate against you for exercising a privacy right. To make a request, use our contact form; we may need to verify your identity before acting on it, and you may use an authorised agent where your state's law provides for one.

8. Children

This site and our services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16; if you believe a child has provided us information, contact us and we'll delete it.

9. Security

The site is served over HTTPS, we minimise what we collect in the first place, and access to correspondence is limited to the Xerensys team. No transmission over the internet is completely secure, but we take reasonable technical and organizational measures appropriate to the risk.

10. Changes to this policy

If we change how we handle personal information, we'll update this page and its effective date. Significant changes will be flagged more prominently on the site.

11. Contact us

Questions, requests, or concerns about privacy: reach us through our contact form.