Privacy Policy

The short version

We collect what you send us in an enquiry so we can reply to it. We do not sell it, share it for advertising, or add you to a mailing list. This website sets no advertising cookies and runs no third-party tracking scripts.

Who we are

Xaevora is a digital studio. For anything in this policy, contact us at hello@xaevora.com.

What we collect

When you submit a project enquiry

The form asks for, and we store:

• Your name, and optionally your company
• Your email address, and optionally a phone number
• Your current website address, if you provide one
• The region and country you select
• The service, budget range and timeline you choose
• Your project description and any reference links you include
• Attribution data: the page you first landed on, the site that referred you, and any UTM campaign parameters in the link you followed

We do not store your IP address with the enquiry. An IP address is briefly hashed in memory to apply rate limiting, and is never written to the record or to any log.

When you browse the site

Nothing is collected about you personally. The site stores a small amount of information in your browser so it behaves consistently:

• xv_country — a cookie holding a two-letter country code, used to pick a starting currency. Expires after one year.
• xv_region — a cookie recording the region you chose, if you changed it. Expires after one year.
• xv.theme and xv.region — stored in your browser's local storage to remember your colour theme and region. Never transmitted to us.
• xv.attribution — stored in session storage for the length of your visit so campaign parameters can be attached to an enquiry if you choose to send one. Discarded when you close the tab.

None of these identify you, and none are used for advertising or profiling. You can clear them at any time in your browser settings without breaking the site.

Analytics

If analytics are enabled on this deployment, we use a privacy-conscious, cookieless provider that reports aggregate page views and events such as which calls to action are used. It does not set cookies, does not collect personal data, and does not track you across other websites. When no analytics host is configured, no analytics script is loaded at all.

Why we are allowed to hold it

For enquiry data, our lawful basis is your request that we take steps before entering a contract, and our legitimate interest in replying to business enquiries sent to us. For the preference cookies described above, our basis is the legitimate interest in the website working the way you left it. We ask for consent where the law in your region requires it for anything beyond that.

Who else can see it

Your enquiry may pass through service providers we use to run the studio. Depending on how this deployment is configured, that can include:

• Our hosting provider, which serves this website and runs the form endpoint
• Our transactional email provider, which delivers your confirmation and our notification
• A customer relationship or automation tool, if we have connected one, so an enquiry is not lost in an inbox

Each is bound to handle the data only on our instructions. We do not sell personal data, and we do not share it with advertising networks or data brokers.

International transfers

We work with clients worldwide, so your data may be processed in a country other than your own. Where required, transfers rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

How long we keep it

Enquiries that become projects are retained for the life of the engagement and for as long afterwards as tax and contractual record-keeping requires. Enquiries that do not become projects are deleted within 24 months. You can ask us to delete yours sooner.

Your rights

Depending on where you live — including under the UK and EU GDPR, and India's Digital Personal Data Protection Act — you may have the right to:

• Ask what personal data we hold about you, and receive a copy
• Have inaccurate data corrected
• Have your data deleted
• Object to or restrict how we process it
• Withdraw consent, where we relied on it
• Complain to your local data protection authority

Email hello@xaevora.com and we will respond within 30 days. There is no charge, and you do not need to explain why.

Security

The site is served over HTTPS with a strict content security policy. Form submissions are validated and rate limited on the server. Credentials for the services we use are held as server-side environment variables and are never exposed to the browser. No system is perfectly secure, but we keep the amount of data we hold deliberately small, which is the most effective control available to us.

Children

This is a business-to-business studio site. It is not directed at children and we do not knowingly collect data from them.

Changes

If this policy changes materially we will update the date at the top and, where the change affects data we already hold, contact anyone affected directly.