Privacy policy
This English version is provided for convenience. In the event of any discrepancy, the French version prevails.
Purpose of this policy
This policy explains how Xenaos collects, uses, stores and protects personal data in connection with its website, its forms, its demo requests, its commercial communications and its SaaS services.
Data collected
- Identification data: surname, first name, job title, company
- Contact details: email address, telephone number, business address
- Request data: message, written chats with Sophia on the website, stated need, sector, company size
- Commercial data: quotes, subscriptions, invoices, customer status
- Website usage data: IP address, pages viewed, device, browser
- Data relating to the use of Xenaos: leads, opportunities, appointments, notes, conversations
- Support data: tickets, assistance requests, technical logs
Purposes
- Responding to requests sent via the website
- Arranging demos and sales meetings
- Managing the commercial relationship, quotes, subscriptions and invoices
- Providing, configuring, maintaining and improving the Xenaos services
- Providing customer support and technical follow-up
- Securing the services and complying with legal obligations
Lawful bases
- Contact, demo and quote requests: steps taken at your request prior to a contract
- Provision of services, support and customer invoicing: performance of the contract
- Voice or written demo with Sophia on the website: your consent, collected before the conversation starts
- Business-to-business prospecting and service security: Xenaos’s legitimate interest
- Retention of accounting records: legal obligation
Technical processors
- Netlify — website hosting and forms
- Supabase — Cockpit / Pocket application data (Frankfurt region)
- n8n, hosted by Elestio — orchestration and automations (Germany)
- ElevenLabs — voice and conversational agents, including the written chat with Sophia on this website
- Google — appointment booking (Google Calendar) and sending emails (Gmail)
- Microsoft — calendar and email for businesses that connect Outlook / Microsoft 365
- Brevo — sending confirmation emails and text messages
- Anthropic — Claude language model, used by Sophia and Pocket to understand requests and formulate answers
- Telnyx — telephony
- smsmode — SMS
- Twenty — CRM
- Stripe — payment
- Plausible Analytics — website audience measurement, cookie-free, hosted in the European Union
- Google Fonts — display of the website’s typefaces (your IP address is sent to Google when they load)
- unpkg and jsDelivr — delivery of the code for the ElevenLabs chat window and voice demo
Google and Microsoft data (Xenaos Cockpit application)
A business customer can connect its Google account (Google Calendar, Gmail) or Microsoft account (Outlook, Microsoft 365) from Xenaos Cockpit (cockpit.xenaos.com). Xenaos then uses this data only to provide the service: reading the calendar's free/busy times, creating, moving or cancelling the appointments booked by Sophia, listing calendars so each department can choose its own, and sending confirmations and reminders from the business's own address. Xenaos never reads the content of emails or the details of other events, never sells this data, never uses it for advertising and never uses it to train artificial intelligence models. The business can disconnect its account at any time from Cockpit, which revokes access.
Xenaos's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Full details: Xenaos Cockpit privacy policy.
Transfers outside the European Union
Some providers are based in the United States, including Netlify, ElevenLabs, Anthropic, Google, Microsoft, Telnyx and Stripe. These transfers are governed by the adequacy decision on the EU–US Data Privacy Framework for certified companies and, failing that, by the European Commission’s standard contractual clauses. You can obtain a copy of these safeguards by writing to hello@xenaos.com.
Retention periods
- Contact requests and prospects: 3 years from the last active exchange
- Customer data and active accounts: for the duration of the contractual relationship
- Invoices and accounting records: the applicable statutory period (10 years in Luxembourg)
- Summaries and transcripts of calls handled for our customers: period set by each customer in Cockpit, then deletion at the end of the contract
Your rights
In accordance with the GDPR, you have the right of access, rectification, erasure, objection, restriction of processing, data portability and withdrawal of consent, which you may exercise by contacting hello@xenaos.com. You may lodge a complaint with the Luxembourg data protection authority (CNPD, 15 boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu) or with the authority of your country of residence, such as the CNIL in France or the APD in Belgium.
Xenaos has not appointed a data protection officer. For any question: hello@xenaos.com.
Cookies
This website does not set advertising cookies. Audience measurement (Plausible) works without cookies and without any data that could identify you. It uses the browser’s session storage (sessionStorage), which is cleared when the tab is closed, to remember the demo form and the source of your visit (campaign, landing page) in order to process your request. Demo appointments are booked via a Google Calendar page.