GDPR Compliance

We process personal data in accordance with the GDPR and applicable national data protection laws. We act as a data controller for the personal data of our users and as a data processor for data our customers process through our platform.

As an EU/EEA resident, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restriction: Request that we limit the processing of your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

We process your personal data on the following lawful bases:

• Contract: Processing necessary to provide our services to you
• Legitimate Interests: To improve our services, prevent fraud, and ensure security
• Consent: Where you have given clear consent for a specific purpose
• Legal Obligation: Where required by applicable law

Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions.

We retain personal data only for as long as necessary to provide our services or as required by law. When you close your account, your data is deleted within 30 days, unless we are required to retain it for legal compliance.

To exercise any of your rights or if you have questions about our GDPR practices, please contact our Data Protection Officer:

Email: hello@xcdify.com

We will respond to all requests within 30 days as required by GDPR. You also have the right to lodge a complaint with your local supervisory authority.

Last updated: May 18, 2026