Privacy policy

Xenpai helps businesses set up forms, client onboarding and payments. This policy explains what information we handle, why, and the choices you have. It covers two groups of people: our customers (the businesses and their staff who use Xenpai) and the people who fill in our customers' forms.

Information about our customers

• Account details: your name, email address, and the name of your business or workspace. If you sign in with Google, we receive your name, email address and whether Google has verified it.
• What you set up: your conversations with Xenpai, the forms, emails and settings it creates, and any files you attach.
• Payments set-up: when you connect Stripe, Stripe collects your business and bank details directly. We keep your Stripe account ID and its status, not your bank details.
• Technical information: IP addresses and request logs, used to keep the service secure, prevent abuse and fix problems.

Information in our customers' forms

When someone fills in a form made with Xenpai, the business that owns the form decides what is collected and what it's used for. We store and process those answers and files on that business's behalf, only to provide the service to them. If you filled in a form and have a question about your information, please contact the business that sent you the form; we'll help them respond.

Card payments made through a form are handled by Stripe on the business's own Stripe account. Card numbers never reach Xenpai.

How we use information

• To provide Xenpai: design and run forms, store responses, send the emails our customers set up, and take payments.
• To sign you in and keep your account and your customers' data secure.
• To send service emails, such as sign-in links and important notices about your account.
• To prevent fraud and abuse, and to meet our legal obligations.

We don't sell personal information, and we don't use it for advertising.

Automated features

Xenpai uses AI services to turn your descriptions into forms and, where you use assistants, to check new submissions against the rules you set. The text of those conversations and submissions is sent to our AI provider for processing. Assistants can move a submission to a different status; emails they draft are only sent once a person approves them.

Service providers we share information with

We use a small number of providers to run Xenpai. Each receives only what it needs:

• Amazon Web Services (Singapore region): hosting, storage, backups and sending email.
• Stripe: payments, and onboarding your business for payments.
• Anthropic: AI processing of conversations and, when assistants are used, submissions.
• Google: sign-in, if you choose to sign in with Google.

We may also disclose information if the law requires it, or to protect the rights and safety of others.

Cookies

We use only the cookies needed to run the service: one that keeps you signed in, one that remembers which workspace you're using, and a short-lived one during Google sign-in. We don't use analytics or advertising cookies.

Where information is kept, and for how long

Xenpai is hosted in Singapore. Information is encrypted in transit and at rest. We keep account information while your account is active. Form responses are kept until the business deletes them or their project. Sign-in links expire after 15 minutes, and sessions after 30 days without use. Nightly backups are kept for 30 days, after which deleted information is gone from them too.

Your choices

You can see and update your account details in Xenpai, export your data at any time, and delete projects and records. To ask for a copy of your information, correct it, or delete your account, email us at hello@xenpai.app.

Changes

If we make significant changes to this policy we'll let customers know by email or in Xenpai before they take effect.

Contact

Questions about privacy: hello@xenpai.app.