When you submit our contact form or email us, we collect the details you choose to provide so we can respond and assess fit:
Like most websites, we collect limited technical and usage data through cookies and similar technologies — your IP address, device and browser type, the pages you visit, and the site or ad that referred you.
We use Google Analytics 4 to understand how the site is used and Google Ads conversion tracking to measure which campaigns lead to genuine inquiries. These tools set cookies and process data on Google’s infrastructure.
You can control cookies through your browser settings and opt out of Google Analytics with Google’s opt-out browser add-on. Google describes how it uses data from sites that use its services at policies.google.com/technologies/partner-sites.
We do not sell your personal information.
We share information only with the providers that help us run the site and respond to you, under their own security and privacy commitments:
For data processed inside the XecSuite platform, control and ownership are part of the product. You own your data: company memory, evidence, embeddings, and transcripts are exportable anytime in open formats and deleted on termination.
Customer data is never used to train shared or external models, tenants are isolated at the database layer using Postgres row-level security, sovereign Canadian hosting is available, and outbound or irreversible actions are approval-gated. Full details are on our Trust Center.
When a teammate connects their Google account to XecSuite, the platform accesses Google Workspace data (Gmail messages, Calendar, Drive files, Docs, Sheets, Slides, and Forms, plus read-only Google Analytics, Google Ads, and Tag Manager reporting) only to answer that user’s explicit requests in the assistant — never in the background. Write actions, such as creating an event, document, or file, or sending an email, run only after the user approves the exact action in the app.
Google data is fetched on demand to serve the request and is not stored on our servers except where the user explicitly imports content. OAuth tokens are held server-side only and are never exposed to the browser. Disconnecting Google in Settings revokes XecSuite’s access with Google and deletes the stored tokens; access can also be revoked anytime at myaccount.google.com/permissions.
XecSuite’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, never used for advertising, and never used to train shared or external models.
We keep website inquiry data for as long as needed to respond to you and maintain our business relationship and records, then delete or anonymize it. Customer platform data is retained and deleted according to the customer agreement.
Our website analytics and email providers may process data in Canada and the United States. For customer engagements that require it, platform data can be hosted on sovereign Canadian infrastructure.
Consistent with Canadian privacy law (PIPEDA) and applicable regulations, you can ask us to access, correct, or delete the personal information we hold about you, or withdraw consent to marketing contact. Email us and we will respond within a reasonable time.
We protect information with encryption in transit, least-privilege connectors that terminate on disconnect, tenant isolation, and human approval gates for sensitive actions. No method of transmission or storage is perfectly secure, but we work to protect your data and limit access to those who need it.
To report a security concern or vulnerability, contact security@xecsuite.com.
This website and XecSuite are intended for businesses and are not directed to children under 16. We do not knowingly collect their information.
We may update this policy as our products and practices evolve; the “Last updated” date above reflects the latest version.
Questions or privacy requests? Contact us at nick@xecsuite.com.
