1. Who We Are
[OPERATOR NAME], trading as Xarith, of [OPERATOR ADDRESS], is the data controller responsible for your personal data. If you have any questions about how we handle your data, contact us at sales@xarith.com.
2. What We Collect
2.1 Information you provide directly
- Full name and email address when you register an account
- Payment information, processed securely by Stripe (we do not store card details ourselves)
- Images, videos, text, and other files you upload when using the Service
- Communications you send to us, including support emails
2.2 Information collected automatically
- IP address and approximate location
- Browser type, device type, and operating system
- Pages visited, features used, and time spent on the platform
- Referral source (how you arrived at xarith.com)
- Cookies and similar tracking technologies (see Section 9 and our Cookies Policy)
2.3 Information from third parties
- If you interact with our ads on Meta (Facebook/Instagram), TikTok, or Google, those platforms may share event data with us in accordance with your privacy settings on those platforms
3. How We Use Your Data
- To create and manage your account
- To process Credit purchases and manage billing via Stripe
- To provide the AI generation features of the Service
- To store and display your generated outputs and project history
- To send transactional emails (account confirmation, billing receipts)
- To send service updates and, where you have opted in, marketing communications
- To analyse usage patterns and improve the platform
- To measure the effectiveness of our advertising campaigns
- To detect fraud, abuse, and security threats
- To comply with our legal obligations
4. Lawful Basis for Processing
| Purpose | Lawful Basis |
|---|---|
| Providing the Service and managing your account | Contract |
| Processing payments via Stripe | Contract |
| Sending transactional emails | Contract |
| Improving the platform and analysing usage | Legitimate interests |
| Fraud prevention and security | Legitimate interests |
| Measuring ad campaign effectiveness | Legitimate interests / Consent (where cookies required) |
| Sending marketing communications | Consent |
| Complying with legal obligations | Legal obligation |
5. Third-Party Services
We share your data with the following third-party service providers, only to the extent necessary to provide the Service:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and file storage | US / EU |
| Stripe | Payment processing | US / EU |
| Meta (Facebook) | Ad performance measurement and retargeting (with your consent) | US |
| TikTok | Ad performance measurement and retargeting (with your consent) | US / Singapore |
| Ad performance measurement and audience building (with your consent) | US / EU |
We do not sell your personal data to any third party.
6. International Transfers
Some of our third-party providers process data outside the UK and EEA, including in the United States. Where this occurs, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the UK ICO, or the UK International Data Transfer Agreement (IDTA), to ensure your data is protected to an equivalent standard.
7. Data Retention
We retain your personal data for as long as your account is active. If you close your account, we will delete or anonymise your personal data within [X] days, except where we are required to retain it for longer to comply with legal obligations (for example, financial records which must be kept for 6 years under UK law).
Generated outputs stored in your account are deleted upon account closure. Uploaded source files are deleted within [X] days of account closure.
8. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Access — request a copy of the data we hold about you
- Rectification — ask us to correct inaccurate or incomplete data
- Erasure — ask us to delete your data ("right to be forgotten"), subject to legal retention obligations
- Restriction — ask us to limit processing of your data in certain circumstances
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interests or for direct marketing
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing
To exercise any of these rights, contact us at sales@xarith.com. We will respond within one month.
9. Cookies
We use cookies and similar tracking technologies on xarith.com. For full details of the cookies we use, their purpose, and how to manage your preferences, please see our Cookies Policy.
10. Children
The Service is not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us at sales@xarith.com and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or via a notice within the Service before they take effect. The "Effective Date" at the top of this page will always reflect the date of the latest version.
12. Contact & Complaints
For any privacy-related queries or to exercise your rights, contact us at:
If you are not satisfied with our response, you have the right to lodge a complaint with the UK's data protection authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113
© 2026 Xarith. All rights reserved. · [OPERATOR NAME], trading as Xarith.