Privacy Policy

Draft for review before launch. Replace [LEGAL BUSINESS NAME], [BUSINESS ADDRESS], [PRIVACY EMAIL], [JURISDICTION], [RETENTION PERIOD], and [EFFECTIVE DATE]. This text is not legal advice or a claim of verified compliance.

Effective date: [EFFECTIVE DATE]. Xenon Agency is operated by [LEGAL BUSINESS NAME], [BUSINESS ADDRESS], [JURISDICTION].

Information we collect

Our inquiry form collects only your full name, email address, and contact number. The database also records an automatically generated identifier and submission timestamp. A hidden anti-spam field is checked and discarded; its value is never stored.

Hosting providers may keep technical request logs, including network addresses, under their own policies. Please do not send passwords or sensitive customer information.

Why we use it

We use inquiry information to respond to your request, discuss possible services, and maintain records of the conversation. Inquiry submission does not enroll you in marketing messages. [CONFIRM APPLICABLE LEGAL BASES, such as steps requested before a contract and legitimate interests, with local review.]

Storage and providers

Supabase PostgreSQL stores inquiries. The intended hosting provider is Vercel. These providers process data to operate the service and may process information outside your country. [CONFIRM DATABASE REGION, PROVIDER AGREEMENTS, TRANSFER SAFEGUARDS, AND ANY ADDITIONAL PROCESSORS BEFORE LAUNCH.] No Google Sheets, CRM, or email notification synchronization is enabled in the initial implementation.

Retention and deletion

Inquiry records remain in the database until deleted. The operator must configure and publish a retention period of [RETENTION PERIOD] and apply the corresponding deletion schedule. No automatic inquiry deletion schedule is enabled by default. Expired rate-limit records are cleaned up during subsequent submission processing after two days. Provider logs and backups may follow separate retention periods.

Your requests and rights

Depending on the law that applies to you, you may have rights to request access, correction, deletion, restriction, portability, or objection, and to contact a supervisory authority. Send requests to [PRIVACY EMAIL]. We may need to verify identity before acting. While the address is being configured, use the contact form and include your request with your contact details.

Security

The website uses server-side validation, restricted database access, encrypted provider connections, and basic abuse protections. No internet service can promise absolute security. Access to stored inquiries should be limited to authorized personnel.

Cookies and analytics

The application does not add advertising trackers or analytics cookies. Hosting infrastructure may process technical information needed to provide and protect the service. Update this policy before adding analytics or other integrations.

Changes and contact

We may update this notice when practices change. Publish the effective date with each material update. Contact: [PRIVACY EMAIL], [LEGAL BUSINESS NAME], [BUSINESS ADDRESS].