Last updated: February 2026
This Privacy Policy explains how XerisLaunch ("we", "us", "the Service") collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the ePrivacy Directive 2002/58/EC.
The data controller for the personal data processed through XerisLaunch is the operator of the Service. For data protection inquiries, you can reach us at the contact email listed on our main website. We are based in Ireland and subject to the jurisdiction of the Irish Data Protection Commission (DPC).
| Data Category | Specific Data | When Collected | Retention |
|---|---|---|---|
| Email address | Email provided during checkout | When you make a purchase | 90 days (KV TTL) |
| Payment data | Transaction ID, amount, currency | When you make a purchase | 90 days (KV TTL); Stripe retains per their policy |
| IP address | Used for rate limiting only | On every API request | In-memory only; not persisted; cleared on server restart |
| Browser storage | Builder progress (template, text, colors) | During app use (with consent) | Until you clear it; stored on your device only |
| Content you create | Token names, descriptions, logos, website content | When you use the builder | Client-side only; sent to our API only for AI generation and deployment |
| Wallet address | Ethereum/Xeris wallet address | When you connect a wallet | Client-side only; never sent to our servers |
| Processing Activity | Lawful Basis | Explanation |
|---|---|---|
| Processing payments | Article 6(1)(b) — Performance of contract | Necessary to fulfil your purchase of Pro features |
| Saving builder progress (localStorage) | Article 6(1)(a) — Consent | Only activated after you accept the consent banner |
| Rate limiting (IP processing) | Article 6(1)(f) — Legitimate interest | Protecting the Service from abuse; IPs are processed in-memory only and never persisted |
| Content moderation | Article 6(1)(f) — Legitimate interest | Preventing scams, phishing, and illegal content on deployed sites |
| AI content generation | Article 6(1)(b) — Performance of contract | Providing the AI copywriting and logo features you request |
| Site deployment | Article 6(1)(b) — Performance of contract | Hosting the website you create and pay to deploy |
We use the following third-party sub-processors. Where data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, or the processor's adequacy framework.
| Sub-Processor | Purpose | Data Shared | Location | Transfer Mechanism |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing | Email, payment details, session ID | USA | SCCs; PCI DSS compliant |
| Vercel, Inc. | Hosting, serverless functions, KV storage | Purchase records (email, session ID), deployed HTML | USA (with EU edge nodes) | SCCs; DPA available |
| Anthropic PBC | AI copywriting | Token name and symbol only (no personal data) | USA | No personal data transferred |
| Replicate, Inc. | AI logo generation | Text prompt only (no personal data) | USA | No personal data transferred |
Note: Anthropic and Replicate receive only the token name/symbol and a text prompt respectively. No personal data (email, IP, wallet address) is shared with these services.
XerisLaunch does not set HTTP cookies. We use browser localStorage to save your builder progress, which requires your consent under the ePrivacy Directive. Full details are in our Cookie and Storage Policy.
Stripe may set strictly necessary cookies during the payment process for fraud prevention. These do not require separate consent as they are necessary for the service you request.
As a data subject in the EU/EEA, you have the following rights:
| Right | Description | How to Exercise |
|---|---|---|
| Access (Art. 15) | Obtain a copy of your personal data | Contact us by email |
| Rectification (Art. 16) | Correct inaccurate personal data | Contact us by email |
| Erasure (Art. 17) | Request deletion of your personal data | Contact us; we will delete within 30 days |
| Restriction (Art. 18) | Restrict processing of your data | Contact us by email |
| Portability (Art. 20) | Receive your data in a structured format | Contact us; we will provide a JSON export |
| Object (Art. 21) | Object to processing based on legitimate interest | Contact us by email |
| Withdraw Consent (Art. 7) | Withdraw consent for localStorage at any time | Clear browser storage or use "Reset All" in the app |
We will respond to all data subject requests within 30 days. Requests are free of charge unless manifestly unfounded or excessive.
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC): Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Website: www.dataprotection.ie. You may also lodge a complaint with the supervisory authority in your own EU/EEA member state.
Purchase records (including email) are stored with a 90-day TTL and are automatically deleted after expiry. IP addresses are processed in-memory only for rate limiting and are never written to persistent storage. Browser localStorage data persists until you clear it, reset the app, or clear your browser data. Deployed websites remain hosted until you or we remove them. Stripe retains payment data per their own retention policy.
We implement appropriate technical and organisational measures including HTTPS/TLS encryption for all data in transit, CORS and CSRF protection on all API endpoints, HMAC-SHA256 signature verification for payment webhooks, input sanitisation and content moderation, rate limiting to prevent abuse, and access controls on administrative functions. In the event of a personal data breach, we will notify the DPC within 72 hours as required by Article 33 GDPR, and affected individuals where required by Article 34.
The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided personal data, please contact us and we will promptly delete it.
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated by updating the "Last updated" date.
For all privacy-related inquiries, data subject requests, or complaints, contact us at the email address displayed on our main website. We aim to respond within 30 days.