How to use this document
Privacy laws differ by country and, in the United States, by state. This page summarizes categories of rights that many Xive users may have, depending on where they live and how we process their data. It is not an exhaustive list of every right in every jurisdiction.
- If a specific law does not apply to you, you are not entitled to exercise a right solely because it appears in this summary.
- Our Privacy Policy remains the primary place we describe what we collect, why we use it, and who we share it with.
- To exercise rights, use in-product privacy controls where we offer them, or email [email protected].
- We may need to verify your identity (or, for agent requests, both the agent and you) before we act, to protect your account and others from fraud.
EEA, United Kingdom, and Switzerland (GDPR and UK GDPR–style rights)
Where the EU General Data Protection Regulation (“GDPR”), the UK GDPR, or closely aligned Swiss law applies, you may have some or all of the following rights. Which rights apply depends on the facts, including our legal basis for processing.
- Access: obtain a copy of or information about the personal data we hold about you.
- Rectification: correct inaccurate personal data, or complete incomplete data where appropriate.
- Erasure: request deletion of personal data in certain circumstances (“right to be forgotten”).
- Restriction: ask us to limit processing in specific situations while a dispute is resolved.
- Portability: receive personal data you provided in a structured, commonly used format, where processing is based on contract or consent and technically feasible.
- Objection: object to processing based on legitimate interests, including some profiling, where the law requires us to weigh your interests against ours.
- Withdraw consent: where we rely on consent, you may withdraw it at any time without affecting prior lawful processing.
- Complaint: lodge a complaint with a data protection supervisory authority in your country of residence, place of work, or place of an alleged infringement.
These rights are not absolute. For example, we may refuse erasure where we must keep data to comply with law or to establish, exercise, or defend legal claims. We will explain our position when we deny or partially deny a request where the law requires us to do so.
Brazil (LGPD-style rights, where applicable)
Where Brazil’s Lei Geral de Proteção de Dados (“LGPD”) applies, you may have rights such as the following, subject to statutory exceptions:
- Confirmation of whether we process your personal data, and access to that data.
- Correction of incomplete, inaccurate, or outdated data.
- Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in non-compliance with the LGPD.
- Portability to another service or product provider, when prescribed by regulation.
- Information about public and private entities with which we have shared data.
- Revocation of consent, where processing is based on consent, using procedures that preserve good-faith processing prior to revocation.
We respond under the timelines and procedures the LGPD and applicable regulations require when your request is valid and complete.
California and other U.S. states with comprehensive privacy laws
Residents of U.S. states that have enacted comprehensive consumer privacy statutes may have rights similar to those below. Exact labels and scope depend on the statute that applies to you.
- Access: learn categories of personal information we collect, and in many cases obtain specific pieces you have the right to receive.
- Correction: request correction of inaccurate personal information we maintain about you.
- Deletion: request deletion of personal information we collected from you, subject to exceptions in law (for example complete transaction records we must retain).
- Portability: receive certain personal information in a portable format where the law requires.
- Opt-out of sale or sharing: where “sale” or “sharing” (including for cross-context behavioral advertising) is defined by your state law, you may have the right to opt out of those activities.
- Appeal: appeal a refusal of your request where your state grants that right.
We do not discriminate against you for exercising privacy rights granted by law. Authorized agents may submit requests on your behalf where your state permits; we may require proof of agency and may still need to verify you.
Response timelines and extensions
We aim to respond within the deadlines set by the law that governs your request. Some laws allow short extensions for complex or high-volume requests; where we rely on an extension, we will tell you when the law requires notice.
- Incomplete requests may be paused until we have enough information to verify you and understand what you want.
- We may clarify whether you want access, deletion, or another remedy when a single message is ambiguous.
- If we deny all or part of a request, we explain the reason when the law requires an explanation.
Appeals (U.S. state privacy laws, where applicable)
If your privacy request is denied in whole or in part and your state grants a right to appeal, we provide appeal instructions with our response, or you may request them at [email protected].
Contact
General privacy and rights requests: [email protected]. For EU/UK supervisory authority or DPO-related inquiries where that channel is active for your request type: [email protected].