Privacy Policy

This Privacy Policy explains how Xebora collects, uses, discloses, retains, and protects personal information for users in the United States.

Xebora provides local marketing automation, Google Business Profile workflows, review reply support, social content planning, messaging approvals, analytics, and related account services.

We may collect account information such as name, email address, business name, phone number, authentication data, billing status, subscription choices, support requests, and preferences.

We may collect business and platform information from connected services, including Google Business Profile data, Facebook Page data, Instagram Business data, reviews, comments, posts, media, profile fields, insights, access tokens, and permission metadata.

We may collect usage, device, log, cookie, analytics, and security information such as IP address, browser, device identifiers, pages viewed, events, timestamps, errors, and approximate location derived from technical signals.

We use personal information to provide and secure the service, authenticate users, operate integrations, prepare content, generate reports, process payments, provide support, communicate with you, improve product quality, prevent abuse, comply with legal obligations, and manage subscriptions.

We may use business context and connected-platform data to generate drafts, review replies, recommendations, scheduling suggestions, profile suggestions, and quality diagnostics.

Xebora uses AI systems and supporting infrastructure to help draft content, classify requests, analyze business context, suggest improvements, and automate operational workflows.

You should review AI-generated content before relying on it for customer-facing, regulated, promotional, legal, medical, financial, or professional statements.

We may disclose personal information to vendors and service providers that help us host, secure, analyze, support, bill, message, and operate the service. These providers may include cloud hosting, payment processors, email providers, analytics providers, AI infrastructure providers, monitoring services, and customer support tools.

When you connect third-party platforms, we disclose and receive information as needed to provide the integration. Those platforms process information under their own terms and privacy policies.

Payments are processed by Stripe or another payment processor. We do not store full payment card numbers. Billing information, invoices, subscription status, and transaction metadata may be retained for accounting, tax, fraud prevention, and customer support purposes.

If you provide a phone number and consent to receive messages, we may send service updates, approval prompts, account notices, product updates, or support messages by SMS, WhatsApp, or another selected channel. Message and data rates may apply.

For SMS, reply STOP to opt out and HELP for help where supported. You may also update communication preferences in the product or contact support.

Essential cookies keep you signed in, protect forms, and remember required service preferences. We use Google Analytics and Microsoft Clarity for site analytics, and Meta Pixel and the Meta Conversions API for advertising measurement, subject to the regional choices described below.

We use the country code supplied by Cloudflare from the visitor IP address to select a privacy regime. For a reliably detected United States visit, analytics and advertising measurement are active by default and can be disabled at any time. For visitors outside the United States, or when the country is missing or uncertain, non-essential analytics and marketing remain off until the visitor makes an explicit choice.

For Meta measurement, we may process the page or conversion event, event time and identifier, campaign parameters, landing page and referrer, Meta browser identifiers (_fbp and _fbc), browser and device context, and an IP address only when our production proxy configuration has been verified. For account conversions, normalized email, phone, and a stable external identifier may be hashed with SHA-256 before being sent to Meta. We do not send the business name or location you searched, Google Place data, visibility-check findings, reviews, or other business content to Meta.

Analytics and marketing are separate choices. You can opt out, customize, or withdraw a prior choice at any time through Privacy choices in the account menu or from this page. We honor Global Privacy Control by disabling Meta Pixel, Meta Conversions API delivery, and future marketing attribution. Global Privacy Control does not disable analytics unless you also turn analytics off.

Depending on your state, you may have rights to request access, correction, deletion, portability, restriction, or opt-out of certain processing of personal information. California residents may also have rights under the CCPA/CPRA.

We do not sell personal information for money. Disclosing identifiers and conversion events to Meta for measurement may be considered a "share" or targeted-advertising activity under certain state laws. Turning off marketing through the Do Not Sell or Share / Privacy choices control, or enabling Global Privacy Control, stops future Meta Pixel and Conversions API events from Xebora.

We retain personal information for as long as needed to provide the service, maintain security, comply with legal obligations, resolve disputes, enforce agreements, operate backups, and support legitimate business needs. Raw Meta browser identifiers and original browser context used for attribution are scheduled for deletion after 90 days. Sanitized attribution and Meta delivery status are retained for up to 13 months.

You can request deletion of account or platform data through the product or by using the Data Deletion page. Some records may be retained where required for billing, security, compliance, or dispute purposes.

We use administrative, technical, and organizational safeguards designed to protect personal information. No system is perfectly secure, and we cannot guarantee absolute security.

Xebora is intended for business users and is not directed to children under 16. We do not knowingly sell or share personal information of children under 16 or use it for targeted advertising.

To ask questions or exercise privacy rights, contact support@xebora.de. We may need to verify your identity and authority before fulfilling certain requests.