How XFORG collects, uses and protects your personal data when you visit our site or build with our platform.
Last updated: October 1, 2026
The short version: we collect only what we need to run your account and your projects. We never sell your data. Card details go straight to Stripe, and you can ask us to access, correct or delete your data at any time by writing to legal@xforg.com.
XFORG (“XFORG”, “we” or “us”) is responsible for the personal data described in this policy. This policy is our privacy notice under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and its regulations.
For anything related to your personal data, write to legal@xforg.com.
Account data. Your email address and password when you sign up. Passwords are stored hashed, never as plain text. If you sign up with Google, we receive the basic profile details Google shares, such as your name and email address.
Project data. The names and descriptions of your projects and the settings you configure, such as domains and connected services.
Billing data. Your plan, payment history and billing details. Card numbers are entered directly with Stripe and never reach our servers.
Technical data. Your IP address, browser and device type, the pages you visit, and error reports, including a record of what happened on the page before an error.
Messages. What you send us when you ask for support or make a request.
We do not collect sensitive personal data, such as health information or religious beliefs, for our own purposes.
Your projects can store data about your own customers and users, such as form answers, accounts and orders. You are responsible for that data, and we process it only on your behalf and on your instructions, to run your project. You must have your own privacy notice and a lawful basis for collecting it.
Primary purposes, needed to provide the service:
• Create and manage your account, and log you in.
• Build, host and run your projects.
• Charge your subscriptions and keep billing records.
• Answer your requests and give you support.
• Keep the platform secure, prevent abuse and fix errors.
• Send you service messages, such as receipts and security alerts.
• Comply with our legal obligations.
Secondary purpose, which you can refuse: sending you news about XFORG features and offers. You can opt out at any time with the unsubscribe link in each email or by writing to legal@xforg.com, and it will not affect your service.
We never sell your personal data. We share it only with providers that help us run XFORG, who may use it only to provide their service to us:
• Amazon Web Services, which hosts our servers, databases and files.
• Stripe, which processes payments.
• Google, for Google sign-in and the fonts our pages load.
• Sentry, which reports errors so we can fix them.
• Our email delivery providers, to send account and billing emails.
Some of these providers process data outside Mexico, including in the United States. We may also disclose data when the law requires it, for example to a competent authority.
You can access your data, rectify it if it's wrong, cancel it when it's no longer needed, and oppose its use for specific purposes. You can also revoke your consent, or limit how we use or disclose your data.
To do so, write to legal@xforg.com with your name, the email of your XFORG account, the right you want to exercise and the data involved, plus a document that proves your identity. We'll reply within 20 days of receiving your request and, if it's approved, act on it within the following 15 days.
If you believe we haven't respected your rights, you can file a complaint with Mexico's data protection authority.
We keep your data while your account is active. When you close it, we delete or anonymize your data, except records we must keep by law, such as billing records required for tax purposes.
Every project runs on its own database and storage, passwords are hashed, login sessions use HttpOnly cookies, connections are encrypted with HTTPS, and access to private data is checked on the server. No system is perfectly secure, but if a breach significantly affects your rights, we'll tell you without delay.
We use a small number of cookies and similar technologies to keep you logged in, remember your preferences and catch errors. Our Cookie Policy lists them and explains how to control them.
If the GDPR applies to you, we process your data to perform our contract with you, to meet legal obligations, for our legitimate interest in keeping the service secure and working, or with your consent. Besides the rights above, you have the right to data portability and to complain to your local data protection authority.
XFORG is not intended for people under 18, and we don't knowingly collect their personal data.
When we change this policy, we update this page and the date at the top. If the changes are significant, we'll also tell you by email or in your dashboard.
