Information We Collect
Account Information
When you register or log in, we collect your first name, last name, email address, username, and a securely hashed version of your password. If your account was created via an admin invitation, we collect the information provided during that process.
Address and Upload Data
To run feasibility analysis, you may upload CSV, XLS, or XLSX files containing property addresses, or connect a Google Sheet as a live data source. We store the addresses and any associated metadata you provide so analysis results can be displayed and retained in your dashboard.
Analysis Results
We store the output of every feasibility analysis tied to your account — including EV charging, battery storage (BESS), rooftop solar, and energy efficiency scores, LLM-generated summaries, and site-level data — so you can access and review them at any time.
Calendar and Event Data
When you use the Calendar module, we store event titles, descriptions, dates, times, locations, meeting URLs, category labels, recurrence rules, and any guest email addresses you add. Events imported via ICS file are also retained.
Document Data
Files you upload to the Presentation module (PDFs and HTML documents) are stored on our servers. We also store per-document analytics data such as view counts, viewer identity (email), and page-level engagement.
Device and Usage Information
We may automatically collect technical data including your IP address, browser type, operating system, device identifiers, pages visited within the platform, and date/time of access. This data is used to maintain security and improve the service.
How We Use Your Information
We use the information we collect to operate, maintain, and improve the Xura platform. Specific uses include:
- Authenticate your account and manage user sessions securely
- Run multi-technology clean energy feasibility analysis across uploaded or synced addresses
- Display, organise, and retain analysis results in your personal dashboard
- Sync with connected Google Drive and Google Sheets sources for live data analysis
- Provide calendar scheduling, event management, ICS import/export, and guest notifications
- Enable secure document upload, in-app viewing, and password-protected sharing with external recipients
- Send account emails including invitations, OTP verification, password resets, and event notifications
- Attribute AI-generated analysis to the LLM provider (Gemini or OpenAI) used for each job
- Generate usage analytics and audit logs visible to administrators
- Detect and prevent unauthorised access, abuse, or fraudulent activity
- Comply with applicable legal and regulatory obligations
Cookies and Tracking Technologies
Session and Authentication Cookies
We use cookies and browser storage to maintain your authenticated session and store short-lived access tokens. These are strictly necessary for the platform to function.
Analytics Cookies
We may use analytics tools that set cookies to measure aggregate usage patterns — such as pages visited and session duration — to help us improve the platform. These tools do not identify you personally.
Disabling Cookies
You may disable cookies in your browser settings. Note that disabling session cookies will prevent you from logging in or accessing protected features of the platform.
Third-Party Services
Xura integrates with third-party services to deliver its features. These services process data in accordance with their own privacy policies.
- Google Drive API and Google Sheets API — for connecting live data sources and syncing files
- OpenAI — for LLM-powered feasibility analysis (address data may be submitted to the OpenAI API)
- Google Gemini — for LLM-powered feasibility analysis (address data may be submitted to the Gemini API)
- Email delivery providers — for sending invitations, password reset links, event notifications, and shared-document credentials
- Cloud infrastructure and database providers — for storing your data securely
Data Sharing
We do not sell your data
We do not sell, rent, or trade your personal information to third parties for marketing or commercial purposes.
When we may share information
We may share your information with service providers that assist in operating the platform (as listed in Section 4), with LLM providers to process analysis requests, to comply with legal requirements or respond to lawful requests from public authorities, to protect the rights, property, or safety of Xura and its users, or in connection with a business transfer, merger, or acquisition.
Shared document access
When you share documents via the Presentation module, the recipient's email address and a generated password are transmitted to the email delivery service. The shared portal at /document-access uses a session token scoped to the specific files you selected.
Data Retention
Account data
We retain your account information and associated analysis results for as long as your account is active. Accounts that are deactivated or soft-deleted are retained in our database for audit purposes but are excluded from all platform queries.
Uploaded files and analysis
Uploaded CSV, XLS, XLSX, PDF, and HTML files, along with their analysis results, are retained until you delete them from the platform or request account deletion.
Audit logs
System activity logs may be retained for a longer period to meet security and compliance obligations, even after individual records are deleted.
Data Security
Technical measures
We implement industry-standard security measures including password hashing (bcrypt), JWT-based authentication with short-lived access tokens and rotating refresh tokens, HTTPS for all data in transit, and role-based access control across all platform features.
Limitations
No method of electronic transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify you as required by applicable law.
Children's Privacy
Xura is a professional B2B platform intended for use by organisations and adults aged 18 and over. We do not knowingly collect personal information from children under the age of 13. If we become aware that a child has provided personal data, we will take steps to delete that information promptly. If you believe a child has registered on our platform, please contact us using the details in Section 12.
Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data. To exercise any of these, please contact us at the address in Section 12.
- Access — request a copy of the personal information we hold about you
- Correction — request that inaccurate or incomplete information be corrected
- Deletion — request that your personal information be deleted, subject to legal retention obligations
- Portability — request your data in a structured, machine-readable format where technically feasible
- Withdrawal of consent — withdraw consent for any processing that relies solely on your consent
- Opt-out of marketing — unsubscribe from non-essential communications at any time
Account Deletion
You may request deletion of your account by contacting us at the email address in Section 12 or through any account management controls available in your profile. Upon verification of your identity, we will deactivate and soft-delete your account, removing it from all active platform queries. Certain data may be retained in anonymised form for audit, fraud prevention, or legal compliance purposes. If you created an account via admin invitation, deletion must be coordinated with your organisation's administrator.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will update the effective date at the top of this page. We encourage you to review this page periodically. Continued use of Xura after any changes constitutes your acceptance of the updated policy.
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us: