1. Who we are
This Privacy Policy explains how Xurfin ("we", "us") collects, uses and protects personal data when you visit xurfin.com or use the Xurfin app at app.xurfin.com (the "Service"). Questions or requests: contacto@xurfin.com.
2. Data we collect
- Account data: name, email, password (stored only as a secure hash), role and profile photo of each user; company name, tax ID and billing details you enter in "My company".
- Data you load into the CRM: contacts, deals, quotes, invoices, contracts and documents about your own customers. For this data we act as a processor / service provider on your behalf (see section 5).
- Usage and security data: IP address, browser and device, sign-in times and an audit log of actions taken in the app.
- Payment data: card payments are handled by Paddle. We never see or store your full card details; we only receive the subscription status, plan and a Paddle customer ID.
- Cookies and local storage: only what is strictly necessary for the site and app to work. See our Cookie Policy.
3. How we use it
- To provide, operate, secure and support the Service, and to bill your subscription.
- To send service emails: invitations, password resets, invoices and important account notices.
- To run the AI features you use (for example, drafting quotes or prospecting) on the data you choose to process.
- To prevent fraud and abuse and to comply with legal obligations.
We do not sell or share your personal information, do not use it for targeted advertising, and do not use your CRM data to train AI models.
4. Legal bases
Where these concepts apply, we process account data to perform our contract with you, for our legitimate interest in running and securing the Service, and to comply with the law. You can withdraw any consent you have given at any time.
5. Data you load into the CRM
You remain the controller of the data about your own customers. We process it only to provide the Service and according to your instructions, as described in our Terms of Service. You can export it at any time.
6. Who we share data with
We use trusted providers that process data on our behalf, under confidentiality and data-protection obligations: Cloudflare (hosting, CDN and security), DigitalOcean (database), Google (Sign in with Google, only if you choose it), Resend (transactional email), Paddle (payments, as our reseller and merchant of record), Fintoc (bank reconciliation for Chilean customers) and AI model providers that power the agent features. Some are located outside your country, including in the United States; transfers are made with appropriate safeguards. We may also disclose data when required by law.
7. Retention
We keep account and CRM data while your account is active. When you cancel, you can export your data; we delete it from production systems at your request or 60 days after termination, unless we must keep it longer by law (for example, billing records). Backups are overwritten on a rolling basis.
8. Security
Encryption in transit (TLS), isolation between organizations, role-based access, session controls, audit logging and backups. No system is 100% secure; if a breach affects your data we will notify you without undue delay.
9. Your rights
Depending on where you live, you may have the right to know, access, correct, delete, port or restrict the processing of your personal data, and to object to it. California residents have these rights under the CCPA/CPRA, and we will not discriminate against you for exercising them. Residents of Chile have the rights granted by Law No. 21,719 and may complain to the Data Protection Agency. To exercise any right, email contacto@xurfin.com; we will verify your request and reply within the timeframe required by law. If you are a customer of one of our customers, we will forward your request to them.
10. Children
Xurfin is a business tool and is not directed to children under 13. We do not knowingly collect their data.
11. Changes
We will post any update here with its date. If a change is material, we will notify account administrators by email or in the app.