How your data is processed
Plain-language summary. The binding terms live in the Terms of Service; a countersigned DPA is available for Agency customers on request.
Roles
You are the controller of content you upload; Xentavi sp. z o.o. acts as processor, handling it only to run scans, keep your history, and bill your plan.
What we store
Account email and plan; scan metadata (score, verdict, indicators — never the raw upload, which is deleted after analysis); billing records and VAT ID; sales-lead form entries. See Subprocessors for who else can see what.
Retention
Scan history expires after 30 days. Deleting your account purges content immediately and completes within 90 days. Lead entries are kept until you ask us to remove them.
Transfers
Default path stays in Frankfurt, DE (EU). Any future transfer outside the EU/EEA happens only under a signed vendor DPA with appropriate safeguards — announced 30 days in advance.
Your rights
Access, correct, export (CSV), or erase your data anytime from the cabinet and account settings. For anything else: hello@xentavi.com.