Skip to content

Privacy Policy

Last updated 2026-10-14 · Version 1.1

This Privacy Policy explains how Xavier Device Management LLC (“Xavier”, “we”, “us”) handles personal information. Which part applies depends on who you are:

1. Website visitors

What we collect

  • Forms. When you use the contact form or join the trial waitlist, we collect what you enter (name, email address, company, fleet size, reason, and message), plus your IP address, browser user agent, language, and the time of submission.
  • Server logs. Our web host records standard request information, such as IP address, the page requested, user agent, and time.
  • Cookies. The website sets a single cookie, language, to remember the language you choose. It is kept for one year. We do not use advertising or analytics cookies on the website.

How we use it

To respond to your enquiry, to tell you when trials reopen if you asked us to, to protect the website from abuse, and to keep it working. Our legal basis under the GDPR is our legitimate interest in responding to enquiries and running the website, or steps taken at your request before entering into a contract.

Who processes it

  • Google (Google App Engine hosts the website; contact and waitlist submissions are stored in a Google Sheet through Google Apps Script).
  • The website loads its styling framework from Tailwind Labs’ content delivery network, which receives your IP address when the page loads.

How long we keep it

Form submissions are kept for 12 months after our last contact with you, then deleted. Server logs are kept for no longer than 30 days.

2. Customers and administrators

For this information, Xavier is the controller.

What we collect

  • Signup: organization name, chosen subdomain, your name, and work email address. The signup form is protected by Cloudflare Turnstile, which processes your IP address and browser signals to detect bots.
  • Account: name, email address, role, and a one-way hash of your password (we never store the password itself), together with sign-in and activity records in your organization’s activity log.
  • Billing: billing contact, invoices, and payment status. If you pay by card, you enter card details directly with our payment processor, Stripe; we do not store full card numbers.
  • Support: what you tell us in support requests and our replies.
  • Service operation: technical logs (including IP addresses) and usage information about how the Service performs and which features are used.

How we use it

To provide and secure the Service, create and manage your account, bill for usage, send service, security, billing, and legal notices, provide support, and improve the Service. Our legal bases under the GDPR are performance of our contract with your organization, our legitimate interests in operating, securing, and improving the Service, and compliance with legal obligations (such as tax and accounting records). We send service emails (such as alerts, invoices, and password resets) through Resend. We do not send marketing email without your consent.

How long we keep it

For as long as your organization’s account is active, and afterwards as described in the Subscription Agreement. Billing and tax records (invoices, payment records, and the billing contact and address on them) are kept for 7 years after the end of the year they relate to, then deleted.

3. People whose devices are managed with Xavier

Organizations use Xavier to manage the computers, phones, tablets, and other devices they provide or allow their people to use. For the information Xavier collects from those devices and about their users, the organization that manages the device is the controller and Xavier acts as its processor. That organization decides which features are on and what is collected, and its own privacy notice and policies apply. If you have questions or want to exercise your rights over this information, contact that organization. If you contact us, we will refer your request to it.

Depending on the device and the features the organization enables, Xavier may process: device identifiers and hardware details; installed software; user accounts on the device; the assigned user’s name and email; and, only if the organization enables them, precise location, time spent in each app, Android network and security logs, USB device events, and information about AI tools on the device. The full list is in Annex I of our Data Processing Addendum. Xavier does not capture screenshots, keystrokes, message content, or general browsing history.

4. Sharing

We share personal information only with service providers that process it for us (listed above and on the Subprocessors page), with services a customer chooses to connect, when required by law or to protect rights and safety, and with a successor in a merger or acquisition, subject to this policy. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

5. International transfers

Xavier is based in the United States, operates the Service from there, and stores data there. A customer may instead choose to have its organization’s data stored in another region we offer, or in its own database in a location it chooses. In either case we still process that data in the United States to provide the Service, and the account and billing information described in section 2 stays in the United States. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we use the standard contractual clauses and related safeguards described in the Data Processing Addendum.

6. Security

We protect personal information with the measures described in our Security Overview. No system is perfectly secure, and we cannot guarantee absolute security.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of California and other US states with privacy laws may have the right to know what personal information we collect and how we use and disclose it, to correct and delete it, and not to be discriminated against for exercising these rights. We do not sell or share personal information and do not use sensitive personal information to infer characteristics about you.

To make a request about information for which Xavier is the controller (sections 1 and 2), use our contact form and choose Privacy or legal request. We may need to verify your identity before acting, and you may use an authorized agent where the law allows. We will respond within the time required by law. For information collected from a managed device (section 3), contact the organization that manages the device.

If you are in the EEA, the UK, or Switzerland, you also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe the infringement took place. In the UK, this is the Information Commissioner’s Office; in Switzerland, it is the Federal Data Protection and Information Commissioner.

8. Children

Our website and the admin console are intended for businesses and other organizations and are not directed to children. Schools and other organizations may use Xavier to manage devices used by students, including children; in that case the school is the controller of the student information and is responsible for meeting the laws that apply to it, and Xavier processes that information only on the school’s instructions.

9. Changes and translations

We may update this policy. We will post the new version here with its date and, for material changes, notify customers by email or in the Service.

This policy is written in English. Translations are provided for convenience; if a translation differs from the English text, the English text governs.

10. Contact

Xavier Device Management LLC. Contact us through xavier-dm.com/contact or by email to legal@xavier-dm.com.