How Xyranik processes personal data

Who is responsible for what

For the people a business markets to — its customers, contacts and sign-ups — the business is the Data Fiduciary (the Controller, under the GDPR) and Xyranik is a Data Processor, acting on the business’s instructions. For the business’s own account holders — the people who sign in — Xyranik is the Data Fiduciary, under the Privacy Policy.

An instruction is what a member of the business’s workspace does in the product, what the business’s connected systems send it, and what the business’s own agents are permitted to do under the controls the business set. Every action an agent takes passes a gateway the business controls and is written to an audit log the business can read and export.

What is processed, and why

• Contacts: names, email addresses, phone numbers, and the record of their consent — what was agreed, when, from which form or import, from what address. Purpose: to send what the business asks to send, to the people who agreed to receive it.
• Orders: the buyer’s address, amounts and dates, from a connected store or a file. Purpose: to measure what the business’s marketing produced in sales.
• What a person did: an email opened or clicked, a text replied to, a tracked link followed, a visit to a published page. Purpose: to trace a sale to the marketing that reached the buyer. A visit is anonymous until the visitor signs up or buys; then the visits of that browser are joined to the person.
• Messages: the contents of what was sent, and the delivery receipts the carriers return.

Xyranik does not use a business’s personal data to train models of its own. Prompts sent to AI model providers carry personal data masked before they leave. Which providers can receive a prompt, and what else they receive, is on the subprocessor list.

Consent

Consent is recorded as an event: the address, what text was agreed to, the source, a keyed hash of the network address, the browser, and the time. A sign-up through a published form is confirmed by the person before it is marketed to (double opt-in). Every email carries an unsubscribe that works in one click; every text honours STOP, and a number that replied STOP is not texted again by any workspace that holds it. Buying is not consent to marketing: a buyer whose consent is not on record is counted but not messaged.

Where it is processed

The application runs in Vercel’s Mumbai region. The database’s region, and each other service’s, is as configured by the operator or decided by the service, and the subprocessor list says which. Transfers outside India are limited to the services named there, for the purposes named.

How it is protected

• Workspaces are kept apart: every record carries its workspace and every query names it. No workspace’s raw data reaches another’s model context.
• Credentials a business connects are encrypted at rest under a key the application holds, which rotates with an overlap.
• Transport is HTTPS only, with strict transport security. Error reports leave with personal data scrubbed, and no session replay is recorded.
• Access by Xyranik’s own staff is limited to named sign-in addresses and logged on each read; the internal pages read a workspace’s figures and its account standing, not its contact lists.
• Each closed day of a workspace’s audit log is hashed and chained to the day before, and the newest seal’s digest is carried in the weekly briefing to the business’s own inbox.

How long it is kept

Nothing is removed until the business says so. A business can set a period after which the contents of form submissions and anonymous visits are removed; every period starts empty, which keeps everything, and every change is audited. Contacts, orders and messages are kept for as long as the workspace exists, because they are the business’s own record of its customers and its sales.

How it is deleted

• One person: the business can erase a person from its workspace. What identifies them is removed; the records the business must keep — a sale, a send — are de-identified with a random stand-in, so the business’s figures stay right and nothing leads back to anyone. Two things are kept on purpose: the do-not-contact and do-not-text flags, so a later import cannot start messaging them again, and the record of when they agreed, which is the business’s proof should they complain. The preview says what will be deleted before anything is.
• The whole workspace: the owner can close it. Closure waits 7 days, during which it can be cancelled and the workspace works as before; then every record is removed. What remains is one row: that the workspace was closed, when, and a keyed hash of the owner’s address. Removal is counted, and a removal that leaves anything behind fails with the leftover named rather than reporting success.

A person’s rights

A business answers its own customers, and the product gives it the means. From its own Data page a business can export what it holds — email contacts, sms contacts, orders, form submissions, do-not-contact list, activity log — and erase a person as above. A person who writes to Xyranik directly about a business’s processing is directed to that business; a person who writes about their own Xyranik account is answered by Xyranik. The address for either is support@xyranik.com.

A data processing agreement

A standard data processing agreement on these terms has been drafted and is available on request from the address above. It has not been reviewed by counsel, and it says so; a business that needs a signed agreement before it can proceed should ask, and will be told where the draft stands.

What is not in place

• No security certification, external audit or penetration test.
• No choice of the region data is kept in: one deployment serves every workspace.
• No copy of the audit seals held outside the application other than the digest in the weekly briefing.
• Backups of the database depend on the database tier the operator runs; the operator’s own policy says whether one exists.