Privacy Policy
How Xephlo collects, uses, protects and shares personal information.
This Privacy Policy explains how Xephlo ("we", "us", "our") collects, uses, discloses and safeguards your information when you visit our website, contact us through any channel, or engage us to design and build software.
Xephlo operates from Mississauga, Ontario, Canada. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL), and we apply the same standards to clients and enquiries wherever they are located. Where the law of your jurisdiction gives you stronger rights, we honour those rights.
We are committed to handling your data responsibly and only for the purposes described here. We do not sell your personal information to any third party, for any purpose. The only parties we share it with are the service providers and the registered marketing and communication tools we actively use to run our business and reach our own customers, and every one of them is contractually bound to act only on our instructions and never for their own purposes.
01Information We Collect
We collect information you provide directly to us, information collected automatically when you use our website, and information from third parties where relevant to a project.
- Contact details you share with us: name, company, email address, mobile or landline number, messaging handle, and anything you include in a message.
- Project information you provide so we can scope, quote, or deliver work, including requirements, existing systems documentation, credentials you choose to share for integration work, and business context.
- Communications you send us or receive from us, including email, WhatsApp messages, and SMS/text messages initiated from our website, from our messaging number, or in reply to our messages.
- Messaging consent records: where you consent to receive text messages from us, we record the fact of your consent, the mobile number it applies to, the method by which it was given, and the date and time. We keep this record so we can demonstrate that consent was properly obtained and honour any later withdrawal.
- Usage and device data such as IP address, browser type, pages viewed, referring URLs, and interactions with tools like our cost calculator, collected via cookies and analytics.
- Billing information necessary to invoice and receive payment. We do not store full payment card numbers; payments are handled by our payment providers.
We ask you not to send us more sensitive personal information than a project requires. If a project genuinely requires handling sensitive or regulated data, we address that in the Service Agreement with appropriate safeguards.
02How We Use Your Information
We use the information we collect to operate our business, respond to enquiries, deliver our services, and improve our website and offerings. Specifically:
- To respond to your enquiries and provide quotes or proposals.
- To schedule, confirm, and remind you about scoping calls and meetings.
- To deliver, maintain, and support the products and services we build for you, including sending project and sprint status updates and notifying you when deliverables are ready for review.
- To issue invoices and process payments.
- To improve our website, understand how it is used, and measure the effectiveness of our content.
- To send you service updates and, where you have asked to hear from us, our own marketing communications by email — delivered through the registered marketing tools we actively use — and to measure whether those communications are useful. We do not send marketing by text message.
- To comply with legal obligations, enforce our agreements, and maintain records demonstrating compliance with messaging and privacy law.
We do not use your information for automated decision-making that produces legal effects, and we do not build advertising profiles.
03Legal Bases for Processing
Where applicable law requires a legal basis, we rely on one or more of the following: your consent; the performance of a contract with you; our legitimate interests in operating and growing our business, where those interests are not overridden by your rights; and compliance with legal obligations.
For text messages, we rely on your consent, and only on consent. See section 05.
04Our Commitments on Sharing and Selling Data
These commitments apply to all customer and enquiry information we hold, not only to any single channel.
- We do not sell or rent your personal information to anyone, for any purpose. We receive no payment or other consideration in exchange for sharing it.
- We do not share your personal information with third parties for their own marketing, advertising, or promotional purposes, and we do not permit any party we work with to do so.
- We do not disclose client project information to other clients or use one client's confidential material for another's benefit.
Where we do share information, it is limited to the following, and always under appropriate safeguards. In every case the recipient is a party that helps us run our business or reach our own customers, acts on our documented instructions, and is contractually barred from using your information for its own purposes or passing it on:
- With service providers who help us operate — hosting, analytics, email delivery, scheduling, telecommunications and messaging providers, payment processors — under contractual confidentiality obligations, and only to the extent needed to perform their function on our behalf.
- With the registered marketing and communication tools we actively use to reach our own customers — our email delivery and marketing platform, our CRM, website analytics, and the advertising and social platforms we run our own campaigns on. These tools process your information as our providers, under their data-processing terms, solely to deliver and measure communications we send. They are not permitted to use your information for their own purposes, to sell it, or to share it onward, and we do not receive any payment for the data they process on our behalf. We only pass data to a tool we are actively using; we do not seed lists into platforms speculatively.
- With your explicit direction, for example to integrate with third-party platforms on your project.
- Where required by law, regulation, or legal process, or to establish, exercise, or defend legal claims, or to protect our rights and the safety of others.
- In connection with a business transfer such as a merger or acquisition, subject to this policy continuing to apply to the transferred information.
05SMS and Mobile Information
No mobile opt-in or text message consent will be shared with third parties or affiliates. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories of sharing described in section 04 expressly exclude text messaging originator opt-in data and consent — including the registered marketing and communication tools named there, which never receive it. This information will not be shared with any third parties, excluding aggregators and providers of the text message services who transmit the messages on our behalf.
Where you provide your mobile number and consent to receive text messages from us, we use it only to send the categories of message described in our SMS Terms. We do not send marketing or promotional text messages, and we do not text people who have not asked us to.
Consent is never a condition of anything. You are not required to consent to receive text messages in order to enquire, receive a quote, engage us, or use our website. Declining changes nothing about the service you receive.
You can withdraw consent at any time. Reply STOP to any message, or email info@xephlo.com. We will send one confirmation and will not text you again unless you opt in a second time. We honour withdrawal requests promptly and retain only the minimum record needed to make sure we continue to honour them.
For full programme details — message types, frequency, cost, and how to get help — see our SMS Terms.
07Data Retention
We retain personal information for as long as necessary to fulfil the purposes described in this policy, to comply with our legal obligations, resolve disputes, and enforce our agreements. In practice:
- Enquiries that do not become projects: retained for up to 24 months, then deleted or anonymised.
- Client and project records: retained for the duration of the engagement and for the period afterwards required by tax, accounting, and limitation-period rules.
- Messaging consent and opt-out records: retained for as long as we operate the messaging programme and for a reasonable period afterwards, because we are required to be able to demonstrate that consent was obtained and that opt-outs were honoured.
When information is no longer needed, we delete or anonymise it.
08Your Rights
Depending on your location, you may have the right to:
- Access the personal information we hold about you and be told how it is used and to whom it has been disclosed.
- Correct information that is inaccurate or incomplete.
- Delete information, subject to our legal and contractual retention obligations.
- Port information to another provider in a portable format.
- Object to or restrict certain processing.
- Withdraw consent at any time, including consent to receive text messages, without affecting the lawfulness of processing already carried out.
To exercise any of these rights, contact us using the details in section 13. We will respond within 30 days, and sooner where the law requires it. We will not charge you for making a request or treat you differently for having made one. We may need to verify your identity before acting on a request.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, or to your local supervisory authority.
09Security
We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, access controls, least-privilege principles, and limiting access to project data to those who need it to do the work. We review access when engagements end.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the relevant regulators as required by law.
Please note that SMS and email are not secure channels. Do not send passwords, API keys, financial account details, or other sensitive credentials by text message or unencrypted email. Tell us if you need a secure channel and we will arrange one.
10International Transfers
We operate from Canada and work with clients across North America, and your information may be processed in countries other than your own — including the United States, where some of our service providers operate. Where we transfer personal data internationally, we take steps to ensure it receives protection consistent with applicable law and with this policy. Information may be accessible to law enforcement or regulators in those jurisdictions under their local law.
11Children's Privacy
Our website and services are directed at businesses and are not intended for children. We do not knowingly collect personal information from anyone under 16, and we do not knowingly send text messages to anyone under 16. If you believe a child has provided us information, contact us and we will delete it.
12Changes to This Policy
We may update this policy from time to time. We will post the revised version on this page with a new effective date. Where changes are material — particularly any change affecting how we use mobile or messaging information — we will take reasonable steps to notify you, and we will not apply materially different uses to information already collected without a fresh basis for doing so.
13Contact Us
If you have questions about this policy, want to exercise a privacy right, or want to opt out of messages:
Xephlo
6399 Spinnaker Circle, Apt 122
Mississauga, ON L5W 1Z6, Canada
Email: info@xephlo.com
Phone (toll-free): +1 (888) 693-4841
SMS / WhatsApp: +1 (647) 915-7451
Or use our contact page.
Privacy enquiries are handled by our designated privacy contact, who is responsible for our compliance with this policy. We aim to respond within one business day and, for formal privacy requests, no later than 30 days.
Effective date: August 2026
This document is provided for general information and does not constitute legal advice. Please consult qualified counsel for advice specific to your situation.