← Back to Office XYZ

Privacy Policy

Last updated: January 27, 2026

Office.xyz ("Company", "we", "us", or "our") operates Office XYZ (office.xyz). This Privacy Policy explains how we collect, use, and protect your personal information when you use our Service.

1. Information We Collect

Information You Provide

• Account Information: Email address, name, profile picture
• Authentication Data: Wallet addresses (if using Web3 login via Privy)
• Content: Files, messages, and data you create within your workspace
• Communications: Messages you send to our support team

Information Collected Automatically

• Usage Data: Features used, actions taken, time spent
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, pages viewed
• Analytics Data: Information collected by Google Analytics (see Section 8)
• Cookies: Session cookies and authentication tokens

2. How We Use Your Information

Purpose	Legal Basis (GDPR)
Provide and maintain the Service	Contract performance (Art. 6(1)(b))
Authenticate your identity	Contract performance (Art. 6(1)(b))
Process payments	Contract performance (Art. 6(1)(b))
Send service updates and notifications	Legitimate interest (Art. 6(1)(f))
Analyze usage and improve the Service	Legitimate interest (Art. 6(1)(f))
Prevent fraud and abuse	Legitimate interest (Art. 6(1)(f))
Marketing communications (with consent)	Consent (Art. 6(1)(a))
Comply with legal obligations	Legal obligation (Art. 6(1)(c))

3. Third-Party Services

We use the following third-party services that may collect information:

Service	Purpose	Privacy Policy
Privy	Authentication and wallet connection	privy.io/privacy
Google Analytics	Usage analytics and improvement	policies.google.com/privacy
OpenAI / Anthropic	AI agent capabilities	openai.com/privacy
Amazon Web Services	Cloud hosting (US-East-1)	aws.amazon.com/privacy
Paddle	Payment processing (Merchant of Record)	paddle.com/legal/privacy

4. Data Sharing

We do not sell your personal information. We may share data with:

• Service Providers: Who help us operate the Service under data processing agreements
• Legal Authorities: When required by law or to protect our rights
• Business Transfers: In connection with a merger or acquisition (with notice)

5. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Until you delete your account
• Workspace content: Until you delete it or your account
• Analytics data: 26 months (Google Analytics default)
• Log data: 90 days
• Backup data: 30 days after deletion request

6. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Access controls and multi-factor authentication
• Regular security assessments and penetration testing
• Secure cloud infrastructure on AWS (US-East-1, N. Virginia)
• Employee security training and access restrictions

7. Your Rights (Including GDPR)

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restriction (Art. 18): Limit how we process your data
• Right to Data Portability (Art. 20): Receive your data in a machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time where processing is based on consent
• Right to Lodge a Complaint: File a complaint with your local data protection authority

To exercise these rights: Email us at privacy@office.xyz. We will respond within 30 days (or sooner as required by law).

For California residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information (we do not sell personal information).

8. Cookies and Analytics

Essential Cookies

Required for the Service to function:

• Authentication session cookies
• Security tokens (CSRF protection)
• User preferences

Analytics Cookies (Google Analytics)

We use Google Analytics to understand how users interact with our Service. Google Analytics collects:

• Pages visited and time spent
• Device and browser information
• Approximate location (country/city level)
• Referral source

Opt-out: You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

Cookie Settings

You can control cookies through your browser settings. Note that disabling essential cookies may prevent you from using the Service.

9. International Data Transfers

Your data is stored and processed in the United States (AWS US-East-1, N. Virginia).

For users in the EEA, UK, and Switzerland: When we transfer your data outside of these regions, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs): EU-approved contractual terms with our service providers
• Data Processing Agreements: Binding agreements that require data protection
• AWS compliance: AWS participates in the EU-U.S. Data Privacy Framework

By using the Service, you acknowledge that your data will be transferred to and processed in the United States.

10. Children's Privacy

Our Service is not intended for users under 18 years of age (or 16 in the EEA where applicable). We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the new policy on this page
• Updating the "Last updated" date
• Sending an email notification for material changes

We encourage you to review this policy periodically.

12. Contact Us

For privacy-related questions, data requests, or to exercise your rights:

• Email: privacy@office.xyz
• Address: 16192 Coastal Highway, Lewes, Delaware 19958, United States

We aim to respond to all requests within 30 days.