Privacy Policy
Last updated: October 22, 2026
Tasdemir LLC (“XenChats”, “we”, “us”, “our”) — 243 Harmony Lake Drive, Canton, GA 30115, USA — info@xenworker.com
This Privacy Policy explains how Tasdemir LLC collects, uses, shares and protects personal information when you visit the XenChats website, create an account, subscribe, or use the XenChats agent app. Section 11 explains our role for the visitors and customers of the companies that use XenChats on their own websites.
1. Information We Collect
a. Account data. When you create an account or are invited to one, we collect your name, e-mail address and password (stored only as a salted scrypt hash, never in readable form), your company’s name and website, your role and job title, a photo if you add one, and your two-step sign-in setting. For the Account we keep its plan, billing period, number of users and billing history.
b. Payment data. Card details are entered with our payment processor, Stripe. We do not receive or store full card numbers. Stripe tells us whether a payment succeeded and gives us customer and transaction references, and may give us the card brand and last four digits so we can show which card is on file.
c. Acceptance records. We may record your acceptance of our Terms: your e-mail address, the version accepted, your IP address, your browser identifier and the time.
d. How your team uses the agent app. Sign-in sessions; changes to each person’s availability; an audit log of changes to settings and data (who did what, when, and from which IP address); API usage per day and per token; and usage counts of the AI features.
e. Visitors of our website. Our website runs the XenChats chat widget for our own account. When you visit it, we collect what any company that uses XenChats collects about its visitors (Section 11): the pages you view and when, the page you came from, your IP address and approximate location (country, region and city), your browser, operating system and device, your time zone and language, a device identifier (see Section 5), and anything you write or send in the chat.
f. Contact and support. The messages, files and contact details you send us in the chat or by e-mail.
g. Technical and security data. Our servers and our infrastructure provider process request data, such as IP address, time, the address requested and browser identifier, to deliver and protect the Service.
h. Customer Data. The chats, tickets, contacts and visitor details that companies put into XenChats are processed on their behalf (Section 11).
2. How We Use Information
- To provide, operate, secure and support the Service and your Account.
- To process payments, manage billing, send receipts and notices, and keep the records tax and accounting law require.
- To send account e-mails, such as invitations, security notices, and trial, billing and renewal notices.
- To answer your questions and requests.
- To monitor the health of the Service, investigate incidents, prevent fraud and abuse, and enforce our Terms.
- To understand and improve the Service.
- To comply with law, respond to lawful requests, and protect our rights and the rights of others.
We do not sell personal information and do not use it for third-party advertising or cross-context behavioral advertising. We may send you news about XenChats; you can opt out at any time.
3. Who We Share Information With
We share personal information only with the providers we need to run the Service, each bound to use it only for that purpose, with the services a company connects to its own Account, and otherwise only as the law requires or permits. Infrastructure providers are described by category; the named list is available on written request.
| Who | What they do | Their policy |
|---|---|---|
| Cloud infrastructure provider | Hosting, database, file storage, network delivery and security of the Service and our website | Name available on request |
| Stripe | Payment processing | stripe.com/privacy |
| E-mail delivery provider | Delivery of our own account, billing and security e-mails | Name available on request |
| Services a company connects | The AI model provider the company selects (Section 4), its Twilio account, its mail server and mailbox, Slack, HubSpot, Mailchimp, Segment, webhooks, API tokens and AI assistants connected through the MCP server. They receive the data the connection needs, on that company’s instruction | The policy of each service |
We may also disclose information to comply with a subpoena, court order or other legal obligation; to enforce our Terms; to protect the safety, rights or property of any person; to a card issuer or payment processor in a payment dispute; and to a successor in a merger, acquisition or sale of assets.
4. AI Features
XenChats’s AI features (the AI agent that answers customers, the copilot, reply suggestions, text edits, translations, summaries, ticket triage, product suggestions and personal welcome messages) work only when a company turns them on. Then the text a feature needs is sent to the AI model provider that runs it: chat and ticket messages, the knowledge the company adds, pictures customers send, and the title and address of the page a visitor is on. That provider is the one the company selects in Settings, used with the company’s own API key, so the provider’s own terms apply to that data; many providers say that data sent through their API is not used to train their models, and each company should check the terms of the provider it chooses. Without a key, the AI agent runs in a demo mode that sends nothing to an AI model provider. Do not enter passwords, card numbers, health information or other sensitive data into a chat. AI answers may be wrong; they are not advice.
5. Cookies and Similar Technologies
XenChats uses only the cookies and browser storage below. We do not use advertising, remarketing or cross-site tracking cookies, and our website does not use third-party analytics.
| Name | Purpose | Type / how long |
|---|---|---|
| xl_session | Keeps a team member signed in to the agent app. | First-party cookie that page scripts cannot read — 30 days or until sign-out |
| xl_ws | Remembers which company account a signed-in team member belongs to. | First-party cookie that page scripts cannot read — up to 400 days |
| xl:… | In the chat window: remembers a visitor’s chat (a visitor ID and a signed token), whether the chat window was open, the sound setting and a closed eye-catcher. | Browser storage of the chat window — until cleared |
| xl_theme | Remembers day or night mode on our website and in the agent app. | Browser storage — until cleared |
Device identifier. To recognize returning visitors even when they clear their browser storage or change their name or e-mail, the chat widget computes an identifier from technical characteristics of the browser and device (for example how the browser draws a test image, and screen and system settings) and stores it with the visitor’s record in the company’s Account. Companies that use XenChats can start the widget only after a visitor consents.
6. How Long We Keep Information
| Data | How long |
|---|---|
| Account data | While the Account is active; after it ends, at least 30 days, after which it may be deleted (earlier on the Account owner’s written request), except as below |
| Customer Data in an Account | Until the company deletes it or its data-retention setting removes it (by default nothing is removed automatically); after the Account ends, as for Account data |
| Billing and tax records | 7 years |
| Acceptance records | The life of the Account plus 7 years |
| Chats with us on our website | In our own XenChats account until we delete them; you can ask us to delete yours |
| Request data at our infrastructure provider | For the short period the provider keeps it to deliver and protect the Service |
You may ask for earlier deletion of your personal data at any time (Section 9), subject to records we must keep by law.
7. Security
- Passwords are stored only as salted scrypt hashes; we never store a readable password.
- Sign-in sessions are kept in cookies that page scripts cannot read; on our hosted service they travel only over encrypted connections.
- Two-step sign-in with an authenticator app, and limits on the IP addresses a team can sign in from, are available to every Account.
- An audit log records changes to settings and data.
- API tokens are stored only as hashes, and keys and passwords for connected services stay on the server and are never sent back to a browser.
- Card numbers the Service recognizes in a chat are hidden before they are stored or shown.
- Each company’s data is kept apart from other companies’ data, and companies cannot see one another’s data through the Service.
- Card data for subscriptions is handled by Stripe and never reaches our systems.
No system is entirely secure. We apply reasonable technical and organizational measures but cannot guarantee absolute security. If a breach affects your personal data, we will notify you as the law requires.
8. Children
The Service is a business tool and is not directed to children. Accounts are for people 18 or older. We do not knowingly collect personal information from children under 13; if we learn that we have, we delete it. Contact info@xenworker.com if you believe a child has given us personal data.
9. Your Rights
Subject to applicable law, you may ask to access the personal data we hold about you, to correct it, to delete it (except records we must keep), to receive the data you gave us in a machine-readable form where technically feasible, and to object to processing based on our legitimate interests; and you may opt out of marketing e-mails at any time. E-mail info@xenworker.com with “Privacy Request” in the subject line. We will verify your identity and answer within 30 days (45 days for California requests, extendable as the law allows). We will not discriminate against you for exercising a right.
California residents. In the past 12 months we collected these categories of personal information: identifiers (name, e-mail address, IP address, device identifier); commercial information (subscriptions and payments); internet activity (pages viewed on our website); approximate location; account credentials (hashed); and the content of messages you send us. Sources: you, your browser and device, your company’s Account, and our payment processor. Purposes: those in Section 2. Disclosed for a business purpose to the providers in Section 3. Sold or shared for cross-context behavioral advertising: none.
European Economic Area, United Kingdom and Switzerland. Our legal bases are the performance of our contract with you, our legitimate interests in running, securing and improving the Service, compliance with law, and your consent where we ask for it. Your data is transferred to and processed in the United States and in other countries where our infrastructure provider operates; where a transfer mechanism is required, we rely on standard contractual clauses. You may lodge a complaint with your supervisory authority.
10. International Transfers
We are located in Georgia, USA. Personal data is stored and processed in the United States and in other countries where our infrastructure provider operates data centers. By using the Service you consent to this.
11. Visitors and Customers of Companies That Use XenChats
Companies use XenChats to chat with the visitors of their own websites and with their customers. If you visit such a website, chat with a company through XenChats, send it an e-mail or a text message that reaches XenChats, or fill in one of its forms, that company is responsible for your personal data (it is the “controller” or “business”). For it, XenChats records: your conversations and the files you send; your name, e-mail address and phone number if you give them; your answers to its forms, ratings and surveys; the pages you view on its website, when, and the page you came from; your IP address and approximate location; your browser, operating system, device, time zone and language; the device identifier described in Section 5; and orders and goals the company reports to XenChats. The company’s team can see what you type in the chat before you send it. If the company has turned on AI features, your messages are sent to the AI model provider it chose (Section 4).
We process this data on the company’s behalf as its service provider, under the Data Processing Addendum in our Terms: we store it, secure it, show it to the company’s team, send it to the services the company connects, and delete it as the company instructs. We do not use it for our own purposes. To exercise your rights over that data, contact the company; its own privacy notice applies, and XenChats lets it download or delete everything about you. If you cannot reach the company, you may contact us at info@xenworker.com and we will pass your request on.
12. Links to Other Sites
Our website and the Service may link to third-party sites and services. This policy does not cover them; read their policies before giving them information.
13. Changes to This Policy
We may update this policy. For material changes we will update the date at the top and, where appropriate, tell you by e-mail or by a notice in the Service. Continued use after that date is acceptance of the updated policy.
14. Contact
Tasdemir LLC — 243 Harmony Lake Drive, Canton, GA 30115, USA — info@xenworker.com