Privacy Policy

Xeaura designs, builds, and manages websites for businesses across the United States, from its home in Orange County, California. This policy covers xeaura.com and its forms, the client app at app.xeaura.com, the contact forms on websites Xeaura hosts for its clients, and how we research and contact businesses that may want our services.

Questions about this policy or your information: contact@xeaura.com.

Applications (Get Started): your name, email, business name (optional), business type, phone number and website (both optional), what you need done, your timeline, and any add-ons you'd like a quote on.

Contact requests (homepage): your name, email, business name (optional), business type, and phone number and website (both optional).

Call requests (Book a 15-minute call): your name, email address, phone number, preferred date and time, and any message you add.

Portal password: only if you choose to set one. It's stored as a one-way hash — we can't see or recover it. If you use the portal, we also record when you first set your password and when you last signed in.

How you found us: when you submit an application, contact request, or call request, we store the name of the website that referred you (not the full address), the first page you visited on our site, and any campaign tags in the link you used (such as the source of an email we sent), together with your submission.

Partner applications (Partner Program): your name, email, phone number, company and website or social profile (both optional), how you plan to refer businesses, and any message. We record which version of the Partner Program Terms you accepted, and when. If you're approved, we also keep your referral code, when you last signed in to the partner portal, records of your referrals, commissions, and payouts (amounts, dates, and the payment method and reference we used), and any manual-credit requests you send us (a business type and an approximate date). We don't collect bank, card, or tax details on the site.

Partner links: if you reach us through a Xeaura partner's referral link, we also store that partner's referral code with your application or request so the partner can be credited. The partner never receives your name, contact details, or what you told us — only your business type, the date, a general status (for example, whether you became a client), and, once their commission is earned, the amount of your Website Setup fee payment it was earned on.

Concept websites (demo.xeaura.com): when you open a concept website (demo) we made for you, we record that it was opened and when, and a scrambled form of your internet address, to know whether you saw it.

Emails you send us, and our replies.

Technical data: when you visit, our hosting and network providers process standard request data (such as IP address, browser, and the pages requested) to deliver and protect the site. We also use cookie-free web analytics from our network provider to see aggregate visit counts.

Visit counts: our own counter adds one to a daily number when you open a page, for the page and the kind of site that sent you (for example a search engine, an AI assistant, or a social app), and when you tap Get started or Book a call. Only those daily totals are kept: not your IP address, your browser, the time, or anything else that could tell you apart from another visitor, and nothing is shared with anyone. It sets no cookie; your browser keeps a note for the open tab (session storage) so a page you've already opened isn't counted twice.

Abuse prevention: to limit repeated form submissions, we store a one-way, keyed hash of your IP address with your submission (never the IP address itself). We use it only to limit repeated submissions, and it is kept for as long as the submission is.

Client app (app.xeaura.com): you sign in with a code or link we email you. We keep what you give us to build and run your website: your business details, the files you upload (such as logos, photos, and text), your change requests and our messages about them, and the plan you choose. When you accept the service agreement, we record which version you accepted, when, and the IP address it was accepted from. If you pay us, we keep payment and subscription records (amounts, dates, and status); card details stay with our payment processor.

Face ID sign-in: if you turn on Face ID for your Xeaura account, your device creates a sign-in key. Your face, fingerprint and the private part of the key never leave your device. To check your sign-in, Xeaura stores only the public part of the key, its ID and a use counter, the device's name and type, and when it was added and last used. You can remove it at any time under Sign-in in your account.

Contact forms on client websites: when someone fills in the contact form on a website Xeaura hosts for a client, we store what they entered (typically name, email, phone, and message) in that client's inbox in the client app. We hold it on the client's behalf, for the client to answer. On a plan without an inbox, we email it to the client instead and do not keep a copy.

Customers of a business that uses Xeaura: If you are a customer of a business that uses Xeaura, we may hold your name and email address because that business asked us to email you a review request, a reply or a reminder on its behalf. We use them only for that, keep a record that you were asked so you are never asked twice, and stop emailing you when you unsubscribe.

Business research: to find businesses that may want our services, we research publicly available business information: business name, website, the contact details a business publishes, location, industry, and notes about its public website. We use it only to decide whether, and how, to contact that business.

To review your application or request and reply to you, to provide and manage our services if you become a client, to send the emails described below, and to keep the site running and secure.

If you request a call, we use your phone number only to text or call you to arrange it. A requested time is only a request — it isn't a confirmed appointment until we confirm it with you. We don't store or use your phone number for marketing, and we don't share it with third parties — it's only handled by the service providers listed below, on our behalf, to deliver your request to our team.

To run the Partner Program: to review partner applications, credit referrals to the right partner, calculate and pay commissions, and keep the related financial records.

We don't use your information for advertising, and the site has no advertising trackers.

AI: we use AI models to help build websites, draft emails and replies, summarize information, and research businesses. A person at Xeaura reviews AI-drafted emails before they're sent and approves websites before they go live. The AI provider receives only the information a task uses: for example, the business details you gave us when we build your site, or a message someone sent when we draft a reply.

When you submit an application, we email you a confirmation (including a link to set a portal password), and our team gets a notification with the details you entered. If you request a password link later, we email it to the address on your application.

When you send a contact request, the details you entered are shared with the Xeaura team by email so we can respond and follow up.

When you request a call, the details you entered are sent to the Xeaura team by email so we can text you to confirm a time. We don't send you an automated email or confirmation.

If you apply to the Partner Program, we email you a confirmation and our team gets a notification with your application. Approved partners receive their referral link, one-time sign-in links for the partner portal when they ask for them, and update emails about their referrals and commissions (a referral recorded or confirmed, a client won, a commission eligible, approved or paid) plus a monthly summary; each update email has a link to stop them.

Replies about your application come from our team by email. We don't add you to a marketing list.

If we contact your business because of our research, the email comes from a person at Xeaura and says how to opt out: reply "unsubscribe". We then put your email address on our do-not-contact list, and no further email to it can be drafted.

If you sign in to the client portal, a cookie keeps you signed in (up to 30 days). Xeaura team members have their own sign-in cookie for the admin area. If you dismiss an announcement banner, your browser remembers that choice in local storage. To record how you found us, your browser keeps those details in session storage (not a cookie) until you close the tab; they're only sent to us if you submit a form. Requesting a call doesn't set any cookies or add any tracking beyond the visit counts above. If you open a Xeaura partner's referral link, your browser remembers that partner's code in local storage for up to 90 days (just the code — nothing about you), and it's sent to us with a form you submit. Opening the link also sends us the code once, so we can add one to a daily count of how many times that partner's link was opened; we keep only that number, nothing about you or your visit, and the partner sees the totals. Approved partners have their own sign-in cookie for the partner portal (up to 30 days).

Our web analytics, from our network provider, count page visits without setting cookies. We don't use advertising or cross-site tracking cookies, and because we don't track you across other sites, the site doesn't change its behavior for browser “Do Not Track” signals.

We use a small number of service providers, and each processes information only on our behalf to provide its service: our hosting provider (the servers that run the site, the client app, and the database), our network and security provider (domain, network delivery and protection, file storage, and cookie-free web analytics), our email delivery provider (automated emails, such as application confirmations and sign-in codes), and our email inbox provider (where replies to contact@xeaura.com arrive, and where emails we write are drafted). If you pay us, your card details are handled by our payment processor; we never see or store your card number.

AI providers: Anthropic (Claude models) by default, and OpenAI or DeepSeek only for tasks we have set to use their models. If we add another AI provider, we'll name it here before sending it any information.

We don't sell or rent your personal information.

We keep application and contact records for as long as we need them to respond to you and, if you become a client, to provide our services and keep business records. Partner Program records, including referral, commission, and payout history, are kept as financial records for as long as we need them for accounting and tax purposes. Business research is kept while it's relevant to us, and deleted on request. If you've asked us not to contact you, we keep your email address on our do-not-contact list so we can keep honoring that request. Messages sent through a client's website stay in that client's inbox for as long as they're a client. For clients, what happens to site content after cancellation is covered in our service agreement.

The site is served over HTTPS. The client and partner portals have no passwords: you sign in with a one-time code or link we email you, which works once, expires, and is stored only as a one-way hash. Access to application and contact records is limited to Xeaura team members with admin accounts. No system is perfectly secure, but we work to protect what you share with us.

You can ask us to show you, correct, or delete the information we hold about you by emailing contact@xeaura.com. Existing clients can also write to support@xeaura.com. To stop emails about our services, reply “unsubscribe” to any of them. If you sent a message through a client's website, that client decides what happens to it; you can ask them, or us, and we'll pass the request on.

Xeaura provides services to businesses. The site isn't directed to children, and we don't knowingly collect information from them.

If our practices change, we'll update this page and the date at the top.