Privacy Policy

1. Introduction

Xplainr ("we," "our," or "us") provides an AI-powered marketing intelligence platform that helps you understand and optimize your marketing performance. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our services.

This policy complies with the EU General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL), and other applicable data protection laws.

By using Xplainr, you agree to the collection and use of information in accordance with this policy. If you do not agree with our practices, please do not use our services.

2. Information We Collect

Account Information

When you create an account or sign in with Google, we collect:

• Email address
• Full name
• Profile photo (if provided via Google sign-in)
• Company name and role (optional, during onboarding)

Marketing Platform Data

When you connect your marketing accounts via OAuth, we access aggregated metrics from:

• Google Ads (campaign performance, spend, conversions)
• Meta Ads (ad performance, audience insights)
• LinkedIn Ads (campaign metrics)
• Google Analytics 4 (traffic, user behavior, conversions)
• Google Search Console (search queries, rankings, clicks)

We store OAuth tokens securely to fetch your data. We do not store raw advertising data - only aggregated metrics necessary for generating insights.

AI Conversations

When you interact with Aria, our AI assistant, we collect and store your conversation messages and any feedback you provide (helpful/not helpful ratings, written comments). This helps us improve Aria's responses and personalize your experience.

Usage Data

With your consent, we collect:

• Session duration and frequency of visits
• Pages and features you interact with
• Dashboard customization preferences
• A/B test participation for product improvements

Payment Information

When you subscribe to a paid plan, payment is processed by Stripe. We receive your subscription tier, billing cycle, and payment status, but we never store your credit card numbers or banking details directly.

Technical Data

We automatically collect:

• Device type and operating system
• Browser type and version
• IP address (for security and fraud prevention)
• Error logs for debugging and service reliability

3. How We Use Your Information

We use your information to:

• Provide AI-powered marketing insights, anomaly detection, and recommendations
• Generate personalized dashboards and priority keyword tracking
• Power Aria conversations with context about your marketing data
• Process payments and manage your subscription
• Send important service updates, security alerts, and optional digest emails
• Improve our platform through anonymous, aggregated usage analytics
• Ensure security, prevent fraud, and enforce our terms of service
• Provide customer support when you reach out to us

4. Cookies and Tracking

We use cookies and similar technologies for the following purposes:

Essential Cookies

Required for authentication, security, and core functionality. These cannot be disabled as they are necessary for the service to work.

Analytics Cookies

Help us understand how you use Xplainr so we can improve the experience. These are optional and can be controlled via our cookie banner or in your Privacy Settings.

Marketing Cookies

Used for future advertising optimization and measuring campaign effectiveness. These are optional and require your explicit consent.

You can manage your cookie preferences at any time in Settings → Privacy & Cookies.

5. Third-Party Services

We work with trusted third parties to provide our services:

• Stripe - Processes payments securely.
• Sentry - Monitors errors to ensure service reliability. No personal data is shared, only technical error information.
• Resend - Delivers transactional emails (password resets, notifications).
• Marketing Platforms - Google, Meta, and LinkedIn APIs are used to fetch your marketing data when you connect your accounts via OAuth.

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

6. Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using TLS 1.2+
• Data at rest is encrypted using AES-256
• OAuth tokens are stored securely and never shared with third parties
• TOTP-based two-factor authentication is available for your account
• Regular security audits and vulnerability assessments
• Role-based access controls for our team members

While we strive to protect your information, no method of transmission over the internet is 100% secure. We encourage you to use a strong password and enable two-factor authentication.

7. Data Retention

• Account data - Retained while your account is active
• Marketing metrics - Stored for trend analysis and historical comparisons
• AI conversation history - Retained until you delete individual sessions or your account
• Usage analytics - Retained for 90 days, then aggregated anonymously
• Error logs - Retained for 30 days for debugging purposes

Upon account deletion request, your personal data will be permanently deleted within 30 days, except where we are required by law to retain it.

8. Your Rights

Depending on your location (including under GDPR, CCPA, and UAE PDPL), you have the following rights:

• Access - Request a copy of the personal data we hold about you
• Correction - Update or correct inaccurate information
• Deletion - Request deletion of your account and personal data
• Data Portability - Export your data in a machine-readable format
• Withdraw Consent - Opt out of optional cookies and marketing emails at any time
• Disconnect Platforms - Remove connected marketing accounts in your settings
• Object to Processing - Object to certain types of data processing
• Restrict Processing - Request limitation of processing in certain circumstances (UAE PDPL)

🇦🇪 UAE residents have specific rights under the PDPL, including the right to be informed about cross-border data transfers and the safeguards in place.

To exercise these rights, visit your Account Settings or contact us at privacy@xplainr.io.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States and European Union, where our servers and service providers are located.

We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission, to protect your data during international transfers.

10. Children's Privacy

Xplainr is not intended for users under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via email or a prominent notice within the application at least 30 days before the changes take effect.

Your continued use of Xplainr after the effective date constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us:

• Email: privacy@xplainr.io
• Manage your preferences: Settings → Privacy & Cookies