Privacy Notice

1. Who We Are

XNBC LLC ("we", "us", "our") is the data controller for the personal data processed through the XNBC service. We operate the platform that lets you create your own AI news channel from the sources you choose.

2. What Data We Collect

We collect and process the following categories of personal data:

• Identity & contact: name, email address, and login credentials.
• Account data: subscription status, plan type, and billing history.
• Service configuration: your selected sources, preferences, and broadcast settings.
• Usage & telemetry: logs of how you interact with the service, device identifiers, and IP address.
• Support messages: communications you send to our support team.

We do not store your third-party API keys in plaintext. We store only a boolean flag indicating whether a key slot is configured, and the actual key is held in a secure server-side vault.

3. How We Use Your Data

We process your personal data for the following purposes and legal bases:

• Providing the service (contract performance) - to create and manage your account, deliver broadcasts, and maintain your channel settings.
• Security & fraud prevention (legitimate interests) - to protect our service and users from abuse and unauthorised access.
• Customer support (contract performance / legitimate interests) - to respond to your enquiries and resolve issues.
• Product improvement (legitimate interests) - to understand usage patterns and improve functionality.
• Marketing (consent, where required) - to send updates about new features, with an opt-out in every message.

4. Who We Share Data With

We share personal data only where necessary and with the following categories of recipients:

• Service providers: hosting, analytics, and support tooling partners who process data on our behalf under strict contractual safeguards.
• Paddle (Merchant of Record): for processing payments, managing subscriptions, handling tax compliance, and invoicing. Paddle acts as an independent controller for payment data. See Paddle's privacy notice at paddle.com/legal/privacy.
• Professional advisers: legal and accounting professionals, bound by confidentiality.
• Authorities: where required by law or to protect our legal rights.

We do not sell your personal data.

5. International Transfers

Your personal data may be transferred to and processed in countries outside the UK and European Economic Area (EEA), including the United States, where our service providers are located. Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions, to protect your data in accordance with UK and EU data protection law.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. If you delete your account, we will delete or anonymise your personal data within 90 days, except where we are required to retain it for legal, tax, or regulatory purposes. Backup copies may persist for a limited period in accordance with our backup retention schedule.

7. Your Rights

Under UK and EU data protection law, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data in certain circumstances.
• Restriction: request limitation of processing in certain circumstances.
• Data portability: receive your data in a structured, commonly used format.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

We will respond to all requests within one month. To exercise your rights, contact us at info@xnbc.studio. You also have the right to complain to the Information Commissioner's Office (ICO) if you believe we have mishandled your data.

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, access controls, row-level security on database tables, and regular security reviews. However, no system is completely secure, and we cannot guarantee absolute security.

9. Cookies & Similar Technologies

We use cookies and similar technologies to operate the service, remember your preferences, and analyse usage. Essential cookies are necessary for the service to function and cannot be disabled. Analytics cookies help us understand how users interact with the service. You can manage your cookie preferences through your browser settings.

10. Children's Privacy

The service is not intended for children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a minor, please contact us immediately.

11. Changes to This Notice

We may update this Privacy Notice from time to time. We will notify you of material changes via email or through the service. The "Last updated" date at the top of this notice indicates when it was last revised.

12. Contact Us

If you have any questions about this Privacy Notice or how we handle your data, please contact us at: info@xnbc.studio