Privacy Policy

Last updated 21 October 2026

This Privacy Policy explains how Xuroe L.L.C ("Xuroe", "we", "us") collects, uses, shares and protects personal information when you use the Xuroe platform at https://app.xuroe.com, our website at https://xuroe.com, and the booking pages, web chat, voice assistant and messaging channels that businesses run on Xuroe. It also explains the choices you have. If you do not agree with this policy, please do not use Xuroe.

1. Who this policy covers

Xuroe is a scheduling, front-desk and business-management platform used by service businesses such as Tour Operators, salons, spas and other small businesses. Because of that, we handle personal information about four groups of people:

• Businesses — the companies that sign up for a Xuroe workspace, and the owners and administrators who manage it ("Business", "you").
• Staff — employees and contractors a Business adds to its workspace (for scheduling, timesheets, leave, attendance, shift rosters and payroll).
• Customers — people who book, pay, chat or call a Business through Xuroe ("Customers"). Customers usually interact with a page or phone number branded by the Business, not by Xuroe.
• Visitors — anyone browsing https://xuroe.com or a public Xuroe page without an account.

Different sections below apply to different groups. Section 2 explains which role we play for each.

2. Our role: service provider to Businesses, controller of our own data

For Customer and Staff information, the Business you deal with decides why and how that information is collected, and we process it on the Business's behalf and under its instructions (we act as a "processor" or "service provider"). If you are a Customer or a Staff member, the Business is responsible for telling you how it uses your information, and requests about that information should go to the Business first. We will help the Business respond, and you may also contact us directly (Section 13).

For Business account information, billing, usage, security and our own website, we decide how the information is used and are the "controller". This policy is our notice to you for that information.

Where a Business has signed a data processing agreement with us, that agreement governs our processing of its Customer and Staff information and takes precedence over this policy in the event of a conflict.

3. Information we collect

Information you give us

• Account and profile information — name, email address, password (stored hashed), phone number, job title, profile photo, language and time-zone preferences.
• Business information — business name, addresses, phone numbers, business type, opening hours, services, prices, tax settings, logo and photos, custom domain, and the knowledge-base content a Business writes to describe itself.
• Staff and HR information (entered by the Business or the Staff member) — employment details, reporting lines, pay configuration, timesheets, attendance, leave requests and balances, shift assignments, payslips and related documents.
• Customer and booking information — the Customer's name, email, phone number, notes, tags, booking dates and times, services booked, number of guests, add-ons, forms and signatures submitted, and any files uploaded with a booking (for example a payment receipt).
• Communications — messages exchanged with a Business through Xuroe web chat, WhatsApp or SMS, call transcripts and summaries from the voice assistant, support requests to us, and any feedback you send.
• Payment information — when a Customer pays by card, the card details are entered directly with our payment processor, Stripe; Xuroe never receives or stores full card numbers. We receive the amount, currency, last four digits, card brand, payment status and a processor reference. For bank-transfer and cash payments recorded by a Business we store the amount, reference and any receipt the Customer uploads. For Business subscriptions we store billing contact and invoice history.
• Payout information — to pay a Business what it has earned, we collect the details of its payout account (for example a Stripe recipient account, Paypal or bank account details), tax and identity information required by our payment partners, and the Business's country.

Information we collect automatically

• Usage and device data — IP address, browser and device type, operating system, pages viewed, actions taken, referring URL, approximate location derived from IP, and timestamps.
• Activity logs — who created, changed or deleted records in a workspace and when, which Businesses use to audit their own account.
• Cookies and local storage — see Section 9.

Information from third parties

• Messaging and telephony providers — when a Customer messages or calls a Business, Meta (WhatsApp) and Twilio send us the sender's phone number, display name, message content, media, delivery status and, for calls, call metadata and the audio stream needed to run the voice assistant.
• Payment providers — Stripe sends us payment, refund, dispute and payout status, and verification status for Business payout accounts.
• Meta Business accounts — when a Business connects its WhatsApp Business Account to Xuroe through Facebook Login for Business (Embedded Signup), Meta sends us the connecting user's Facebook user ID and name, the Business's WhatsApp Business Account ID, phone-number ID, display name and verification status, and an access token that lets Xuroe send and receive messages for that number. We do not receive the user's Facebook password, friends list, posts or Pages content.
• Data a Business imports — a Business may import existing customer and booking records from another system into its workspace.

4. How we use information

We use the information described above to:

• Provide, operate and maintain the platform — creating bookings, sending confirmations and reminders, running calendars, rosters, timesheets, invoices and payroll, and storing files.
• Run the AI front desk — answering calls and messages for a Business, checking availability, and creating booking requests (Section 5).
• Process payments, hold and release funds to Businesses, handle refunds, disputes and chargebacks, and meet our obligations as merchant of record (Section 7).
• Bill Businesses for subscriptions and AI usage, and send usage alerts.
• Send transactional messages — booking confirmations, reminders, payment links, receipts, invitations, password resets and security notices. These are not marketing and cannot be opted out of while you use the service.
• Provide customer support and respond to requests.
• Secure the platform — detecting abuse, fraud, unauthorised access and outages, verifying webhooks, and enforcing rate limits.
• Improve the platform — understanding which features are used and fixing problems. We use aggregated or de-identified data for this wherever possible.
• Comply with law, respond to lawful requests, and enforce our Terms of Service.
• Send marketing about Xuroe to Business contacts, where permitted, with an unsubscribe link in every email. We do not send marketing to Customers of a Business on our own behalf.

Where the law requires a legal basis (for example the GDPR or UK GDPR), we rely on: performance of a contract with you; our legitimate interests in running, securing and improving the service; your consent where we ask for it (for example non-essential cookies or marketing); and compliance with legal obligations.

5. AI features

A Business can switch on an AI front desk that answers its phone line and replies to messages on its behalf. When it does, the content of those calls and messages is processed by AI models hosted by our providers (currently Anthropic for text and ElevenLabs for voice) together with the Business's own knowledge base, services and opening hours, so the assistant can answer questions and take booking requests.

• Disclosure. The assistant identifies itself as an automated assistant when asked. Businesses must not configure it to claim to be a human.
• No model training. Our AI providers process the content only to generate a response for that conversation. Under our agreements with them, your content is not used to train their general models.
• Human review. Staff of the Business can read every AI conversation, take over a chat at any time, and correct anything the assistant recorded. The assistant can also hand a conversation to a person on its own when someone asks for one or raises a complaint.
• Accuracy. AI responses can be wrong. Bookings created by the assistant are requests that the Business confirms; prices, availability and policies quoted by the assistant are subject to the Business's confirmation.
• Call recording and transcripts. Calls answered by the voice assistant are transcribed and summarised so the Business can see what was requested. Where the law requires it, the Business is responsible for playing a recording or automated-agent notice at the start of the call.

6. WhatsApp, SMS, voice and web chat

Businesses can connect a WhatsApp Business number, an SMS/voice number, or a web chat page to Xuroe. When you message or call that number or page, your message, phone number and profile name are delivered to us by the channel provider and stored in the Business's workspace so the Business (and, if enabled, its AI assistant) can reply.

• WhatsApp is provided by Meta Platforms, Inc. Messages are also subject to the WhatsApp Privacy Policy and Meta's Business Terms. Xuroe receives messages through the WhatsApp Business Platform as a technology provider for the Business. We do not access your WhatsApp contacts, groups or messages with anyone other than the Business.
• SMS and voice are carried by Twilio. Standard message and data rates from your carrier may apply.
• Web chat on a Business's chat page stores a random visitor token in your browser so you can return to the same conversation. Clearing it ("Start a new conversation") starts a fresh thread. Web-chat transcripts are archived after 90 days of inactivity unless the platform is configured to keep them longer.
• Opting out. Reply STOP to an SMS to stop receiving texts from that number, block or delete the WhatsApp conversation to stop receiving WhatsApp messages, or ask the Business to remove you. Transactional messages you asked for (for example a booking confirmation) may still be sent to complete that request.

7. Payments

When a Customer pays a Business by card through Xuroe, Xuroe is the merchant of record: the charge is made by Xuroe through Stripe, Xuroe's name appears on the Customer's card statement alongside the Business's name, and Xuroe handles refunds and disputes. Xuroe then pays the Business its share after the appointment, less the platform fee agreed with the Business. Card details are collected on Stripe-hosted pages and are governed by the Stripe Privacy Policy. We keep payment records for as long as tax, accounting and anti-fraud rules require (Section 10).

Businesses that receive payouts must provide Stripe (or, for some countries, Xuroe directly) with the identity, business and bank information required by law to verify them and send funds.

8. How we share information

We do not sell personal information and we do not share it with third parties for their own marketing. We share information only:

• With the Business you deal with. Everything a Customer or Staff member submits through a Business's pages, numbers or workspace is visible to that Business's authorised users.
• With service providers ("subprocessors") that host, deliver or process data for us under contracts that limit their use of it to providing their service to us. The current list is below.
• For legal reasons — to comply with a law, regulation, legal process or government request; to enforce our terms; or to protect the rights, property or safety of Xuroe, our users or the public.
• In a business transfer — if Xuroe is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy.
• With your direction or consent — for example when you connect a third-party integration.

Subprocessors

We will update this list when we add or replace a subprocessor. Businesses that have signed a data processing agreement will be notified as set out in that agreement.

9. Cookies and local storage

Xuroe uses a small number of cookies and browser storage entries, almost all of them strictly necessary to run the app:

We do not use advertising cookies or third-party tracking pixels in the app. Our marketing site at https://xuroe.com may use analytics cookies; if it does, a banner will let you accept or decline them. You can block or delete cookies and local storage in your browser settings, but the app will not work without the sign-in entries.

10. How long we keep information

We keep personal information for as long as it is needed for the purposes above, and then delete or de-identify it. In practice:

• Workspace data (customers, bookings, staff records, conversations, files) is kept for as long as the Business's account is active, and deleted within 30 days after the Business closes its account or asks us to delete it, except as noted below.
• Web-chat transcripts are archived after 90 days of inactivity by default and deleted with the rest of the workspace data.
• Call recordings and transcripts are kept according to the Business's settings and deleted with the workspace data.
• Payment, payout, invoice and tax records are kept for 7 years, or longer if required by tax, accounting, anti-money-laundering or card-network rules, even after an account is closed.
• Security and access logs are kept for up to 12 months.
• Backups are rotated on a schedule of up to 35 days; deleted data may persist in backups until they expire.
• Support correspondence is kept for 3 years.

A Business controls the retention of its Customers' and Staff records within its workspace and can delete individual records at any time. See our Data Deletion page for how to request deletion.

11. Security

We protect information with technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest, hashed passwords, encrypted storage of API credentials, per-workspace isolation of data, role and permission checks on every request, signature verification of inbound webhooks, rate limiting, expiring access tokens, private file storage with time-limited download links, audit logs, and least-privilege access for our staff. No system is completely secure; if we learn of a breach affecting your information we will notify you and the relevant authorities as required by law.

You are responsible for keeping your password confidential and for the activity that happens under your account. Please tell us immediately if you suspect unauthorised access.

12. International transfers

Xuroe L.L.C. is a United States (Wyoming) company and our subprocessors are located mainly in the United States and the European Union, so information is transferred to and processed in those countries. Where we transfer personal information from the United Kingdom, the European Economic Area or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), adequacy decisions, or another lawful mechanism, and we require the same of our subprocessors.

13. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to restrict or object to how we use it, to withdraw consent, and to complain to a data protection authority. We honour these rights regardless of location wherever we reasonably can.

• Businesses and Staff can view and update most information directly in the app (Profile, Settings, Team).
• Customers should contact the Business they booked with, which controls their record. If you cannot reach the Business, or you want us to act, email us and we will forward the request or handle it ourselves where we are permitted to.
• Everyone can email support@xuroe.com with a request. We may need to verify your identity first. We respond within 30 days, or sooner where the law requires.
• Marketing emails from us include an unsubscribe link. Transactional emails and messages (confirmations, reminders, receipts, security notices) are part of the service and continue while you use it.
• Deletion is described step by step on our Data Deletion page.

We will not treat you differently for exercising any of these rights.

14. Children

Xuroe accounts are for adults acting on behalf of a business. Our services are not directed to children under 16, and we do not knowingly collect personal information from them on our own behalf. A Business may record a minor as a Customer (for example a child's dental appointment) where a parent or guardian makes the booking; the Business is responsible for obtaining any consent required. If you believe a child has provided us with personal information without consent, contact us and we will delete it.

15. Businesses' own policies and third-party links

Each Business decides how it uses the information it collects through Xuroe, and may have its own privacy policy that applies to you in addition to this one. Booking pages, chat pages and messages may link to websites and services we do not control; their privacy practices are their own.

16. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "Last updated" date and, for material changes, notify Businesses by email or an in-app notice before the change takes effect. Continued use of Xuroe after the change means you accept the updated policy.

17. Contact us

Privacy questions and requests: support@xuroe.com

Postal address: Xuroe L.L.C., 30 N Gould St, Ste R, Sheridan, Wyoming, 82801

If you are in the European Economic Area or the United Kingdom and are not satisfied with our response, you may lodge a complaint with your local supervisory authority.