Boundary and principles
Free XAgent features do not require registration. An email account is needed only to purchase, manage subscriptions, generate Activation Keys, or manage device slots.
The licensing cloud does not read local Project files, desktop content, browsing history, or page bodies merely to provide a license. Any future AI, sync, or third-party capability in Desktop or Browser must describe its own data flow and request the permissions it needs.
This notice describes the website and licensing service that exist today—not future processing presented as if it already happens.
Data we process
Account
Display name, email address, verification state, account timestamps, and securely hashed password credentials.
Session and security
Session token and expiry, IP address, browser User-Agent, verification/reset tokens, rate-limit counters, and necessary request identifiers.
Order and subscription map
Paddle customer, transaction, subscription, product, and price IDs; purchase email, name, locale, status, quantity, currency, amount, and billing dates. XAgent does not receive or store full card numbers.
License and device
Plan and license state, Activation Key hash and hint, notes, device type, hashed device UUID, label, app version, binding, and last-verification timestamps.
License lifecycle
Activation, replacement, renewal, rejection, unbinding, and key-rotation events with request identifiers for account visibility, troubleshooting, and abuse prevention.
Language and essential cookies
Your locale appears in the URL path and is saved in a non-sensitive preference cookie and browser storage. Essential cookies maintain sign-in and request security; Paddle Checkout may set its own essential cookies.
Purposes and legal bases
Deliver the service
Create and verify accounts, complete purchases, synchronize subscriptions, issue or renew device certificates, and show billing and license history.
Protect the service
Validate sessions and webhooks, prevent fraud and abuse, rate-limit abnormal traffic, revoke invalid licenses, and investigate failures.
Meet obligations
Handle refunds, disputes, tax or accounting records, and valid legal requests.
Legal basis
Depending on applicable law, processing relies on contract performance, requested services, legitimate interests, legal obligations, or consent where required.
We do not sell personal information or use account or license data for behavioral advertising. As of this notice, the site has no third-party advertising tracker or behavioral analytics tool.
Providers and sharing
Paddle↗
Acts as authorized reseller and Merchant of Record for checkout, tax, payment methods, risk, receipts, and refunds. XAgent receives customer, transaction, and subscription state needed for fulfillment.
Resend↗
Sends verification and password-reset email for XAgent and processes the recipient address, message body, and delivery metadata.
Hosting infrastructure
Contracted cloud hosting, database, CDN, logging, and security providers process site and network data only to run and protect the service.
Required disclosure
We disclose necessary information only on user instruction, to complete a transaction, protect lawful rights, or answer a valid request from a competent authority.
Location and international processing
Providers may process data outside your country or region, where privacy rules can differ. We limit processing through provider contracts, access controls, and applicable transfer mechanisms.
Where law requires added notice, separate consent, contractual safeguards, or a local representative, those steps must be completed before the relevant feature is formally offered in that region. Do not create a paid account or purchase if you do not want these providers to process your email and purchase information.
Retention
- Sign-in sessions last up to 30 days; email verification and password-reset links normally expire after one hour.
- Account data remains while the account exists, then is deleted or de-identified after a valid request except where law or dispute handling requires retention.
- License, device binding, and lifecycle data remains while needed to deliver, replace, revoke, troubleshoot, and protect licenses, then is deleted or de-identified.
- Local billing mappings and provider transaction records remain as required for tax, accounting, refunds, chargebacks, anti-fraud, and other legal duties.
Actual periods depend on account and license status, transaction disputes, and applicable law. We use the shortest period needed for the stated purpose.
Your choices and rights
- View licenses, device bindings, and recent lifecycle events in Account; unbind a device or rotate an Activation Key.
- Request access, correction, export, deletion, or restriction; object or withdraw consent where applicable.
- Use Paddle's customer portal to manage subscriptions, payment details, invoices, and cancellation. Exercise rights over data controlled independently by Paddle directly with Paddle.
- Complain to a competent privacy authority. We do not reduce service because you legitimately exercise a privacy right.
Children, changes, and contact
Paid and licensing services are intended for users with the legal capacity to contract and are not directed to children. Contact us if a child supplied personal data without proper authorization.
We update this page when purposes, categories, recipients, or transfer arrangements materially change, and provide prominent notice or obtain consent where law requires. The effective date identifies the current version.
Make a privacy request
You may ask to access, correct, export, or delete account-linked information, or ask how it is handled. We may verify your identity first. Transaction or security records required by law may not be deleted immediately.