▚ xentropy

Privacy Policy

Effective July 6, 2026

This policy explains how xentropy ("we") collects, uses, and protects personal data when you use xentropy.ai and store.xentropy.ai (the "Service"). The operator and contact details are in the Legal Notice. Questions or requests: support@xentropy.ai.

1. Data we collect

  • Email address — when you join the waitlist, buy a pack, or sign in.
  • Account & purchases — a Firebase account identifier and the packs you own.
  • Waitlist metadata — signup source, referring page, timestamp, and your consent record.
  • Sign-in session — a strictly-necessary cookie (xen_session); see the Cookie Policy.
  • Technical data — IP address and request logs, processed by our hosting and infrastructure providers for security and delivery.

We measure page traffic with cookieless, aggregate analytics (Vercel Web Analytics) and use first-party cookies on the store to attribute a purchase to the xentropy link that brought you there. We do notuse third-party advertising or cross-site trackers, and we don't sell personal data. See the Cookie Policy for the exact cookies.

2. How we use it and our legal bases (GDPR Art. 6)

  • Provide purchased packs and account access — performance of a contract.
  • Send sign-in and order emails — contract / legitimate interest.
  • Waitlist and product-update emails — your consent (withdrawable at any time).
  • Security, fraud prevention, and legal compliance — legitimate interest / legal obligation.

3. Payments

Purchases are handled by Polar as Merchant of Record (using Stripe for card processing). They act as the seller of record and process your payment and billing data under their own privacy terms. We do not receive or store card details.

4. Processors and sub-processors

We share data only with providers that process it on our behalf:

  • Google (Firebase / Firestore, Cloud Storage) — accounts, entitlements, storage (EU region).
  • Vercel — website hosting and logs.
  • Resend — transactional and waitlist email delivery.
  • Polar and Stripe — payments (as Merchant of Record).

5. International transfers

Some providers are based in the United States. Where data leaves the EEA, transfers rely on appropriate safeguards (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework).

6. Retention

Account and purchase data are kept while your account exists. Raw waitlist signups are deleted within 60 days of ingestion; sign-in tokens and rate-limit records expire automatically. We keep data no longer than needed for the purposes above or as required by law.

7. Your rights

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, to withdraw consent, and to lodge a complaint with your data-protection authority. To exercise any of these, email support@xentropy.ai.

8. Changes

We'll update this page if our practices change and revise the effective date above.