Privacy Policy

1. Data controller

The data controller for the xClarion service is SAPTSEC LTD, a company registered in England & Wales (company no. 10884563), with its registered office at 124 City Road, London, England, EC1V 2NX.

For data-protection enquiries, contact us at privacy@xclarion.com.

2. Personal data we collect

We do not collect special-category (sensitive) data, and we do not use tracking cookies, advertising pixels, or analytics scripts.

3. Lawful basis for processing

• Contract performance (Art. 6(1)(b) UK GDPR) — processing your account and incident data is necessary to provide the xClarion service.
• Legitimate interests (Art. 6(1)(f)) — security logging, rate limiting, and fraud prevention.

4. Sub-processors

We share personal data only with the sub-processors necessary to operate the service. Each operates under a Data Processing Agreement (DPA).

5. Data retention

• Account data — retained while your account is active; deleted or anonymised on account deletion.
• Incident content — retained according to your workspace retention setting (default: 24 months from incident creation), then automatically purged by our scheduled retention process.
• Audit logs — retained for up to 24 months, then deleted.
• Session data — expires automatically after the session lifetime (30 days maximum).

6. Your rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your personal data (subject to legal retention obligations).
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to restrict processing in certain circumstances.
• Objection — object to processing based on legitimate interests.

To exercise any of these rights, email privacy@xclarion.com. We will respond within one calendar month.

7. Cookies

xClarion uses a single session cookie that is strictly necessary to authenticate you after login. It is HttpOnly, Secure, and SameSite=Lax. We do not use tracking cookies, advertising cookies, or third-party analytics.

Because the session cookie is strictly necessary for the service to function, it is exempt from consent requirements under the Privacy and Electronic Communications Regulations (PECR).

8. International data transfers

Our sub-processors (Cloudflare, Anthropic) may process data outside the UK. Transfers are safeguarded by the UK International Data Transfer Agreement (IDTA) or equivalent adequacy mechanisms provided by each processor under their DPA.

9. Security measures

We implement appropriate technical and organisational measures, including: encrypted transport (TLS), hashed passwords, HMAC-signed webhooks with replay protection, workspace-level tenant isolation, role-based access controls, and a full audit trail.

10. Supervisory authority

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via the email address associated with your account. The “last updated” date at the top reflects the most recent revision.