DRAFT: not legally reviewed. Highlighted items are filled in before launch.

XVocals Privacy Policy

Last updated: 2026-10-08

Who we are

[LEGAL_NAME], [LEGAL_ADDRESS], Israel, is responsible for your personal data. Contact: [SUPPORT_EMAIL].

What we collect and why

• Account and purchase: your email address, order id, amount, currency and country of the payment, and your license key. We need it to give you your license, let you sign in, and handle refunds and tax records. (Contract; legal obligation.)
• Activation: for each computer you activate, a one-way hash of its hardware id (we cannot read your hardware id), the computer name you see in your system, operating system version, plugin version, and the dates it was activated and last checked in. We need it to enforce the 3 computer limit and to let you manage your computers. (Contract.)
• Trial: a one-way hash of the computer's hardware id, operating system, plugin version, country and dates, with no name or email. We need it to give one 14 day trial per computer. (Legitimate interest.)
• IP address: your IP address is personal data. Our servers see it when you use the website or the plugin. We use it only to limit abuse (rate limits), to estimate your country, and, in a shortened salted hash, to count downloads. We do not build profiles from it. Cloudflare, our hosting provider, processes IP addresses in its network logs. (Legitimate interest: security.)
• Website analytics: we use Cloudflare Web Analytics for aggregate page statistics. [Describe here exactly what the service collects once verified.]
• Support: what you write to us and your email address, kept for as long as needed to help you.
• Sign-in cookie: after you sign in we set one cookie to keep you signed in. It is needed for the service. We use no advertising or tracking cookies.

Who processes your data

• Cloudflare, Inc. (hosting, database, file storage, DNS, email sending and receiving, bot protection, analytics). Data is processed on Cloudflare's global network, including outside Israel and the EU.
• [PAYMENT_PROVIDER_NAME], our payment provider, which handles your card details and tax. We never see your full card number.

We do not sell your data and we do not use it for advertising.

How long we keep it

• Sign-in links and sessions: days. Hashed download counters: 24 months. Email delivery logs: 12 months. Security audit log: 2 years. Orders, licenses and activation records: up to 7 years because of tax and accounting rules; if you delete your account, your email is removed from them. Trial records: 24 months.

Your rights

You can see, correct and delete your data. In your account you can download your data and delete your account. You can also write to [SUPPORT_EMAIL]. If you are in the EU/EEA/UK you also have the rights of the GDPR (including objection, restriction, portability and complaint to your data protection authority). You may also complain to the Israeli Privacy Protection Authority. Deleting your account does not deactivate plugins that are already activated.

Security

We use encryption in transit, hashed storage of sign-in tokens and device codes, rate limits and access controls. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

Children

The Software and website are not directed at children under 16.

Changes

We will post changes here with a new date.