XALVEN
PRIVACY POLICY — XALVEN
Version: v2.0 — Date: 2026-09-12
This version replaces v1.0 (2026-03-01), available at
/legal/archive/privacy-v1.0.md.
1. DATA CONTROLLER
- Owner: KORNYX LLC
- Tax identification: EIN 61-2374219 (United States)
- Address: 30 N Gould St, Ste R, Sheridan, WY 82801, United States
- Legal form: limited liability company (LLC) incorporated in the State of Wyoming (United States). KORNYX LLC is not a Spanish company.
- Contact email: support@xalven.app
- Data Protection Officer (DPO): Not currently applicable (the company is not legally required to appoint a DPO given its processing volume)
2. SCOPE
This Policy applies to users of the XALVEN website and application, which is available globally. If you access the service from outside the European Economic Area (EEA), your data may be processed in accordance with this Policy and with appropriate safeguards where international transfers take place.
3. DATA WE PROCESS
Depending on how you use the service, we may process:
- Identification and account data: name, email, access credentials, user preferences.
- Transaction data: purchase/subscription status, amount, currency, payment identifiers. XALVEN does not store full card details; these are handled directly by the payment provider.
- Technical data: IP address, device identifiers, operating system, access logs, language, time zone, session security information.
- Usage data: interactions within the app and technical events needed to operate and improve the service.
- Support data: communications with customer support.
- Location data: the app uses maps (Leaflet + OpenStreetMap) to display geographic results. Precise GPS location is neither requested nor stored. Should precise geolocation be requested in the future, explicit operating-system permission will be sought.
- Consent records: date, version of the legal documents accepted and technical data of the session in which consent was given.
4. PURPOSES
We process data in order to:
- (a) Create and manage your account and provide the contracted service.
- (b) Manage payments, invoicing and compliance with accounting and tax obligations.
- (c) Provide support and customer service.
- (d) Ensure security, prevent fraud and maintain the service technically.
- (e) Improve the product through analysis of technical performance.
- (f) Comply with applicable legal obligations.
- (g) Record the acceptance of legal terms (consent audit trail).
- (h) Allow you to send, from your account and under your control, commercial prospecting emails to the companies you select.
How sending works: XALVEN is a prospecting tool. The system sends emails on behalf of the user to the companies that user chooses, using the sender address and signature the user configures, and drafts their content from publicly available information about those companies. The user is the data controller for their recipients' data and is responsible for complying with the rules applicable to their commercial communications; XALVEN acts as a processor for those sends. XALVEN does not send newsletters or its own commercial communications to its users' recipients.
5. LEGAL BASIS (GDPR art. 6)
| Processing | Legal basis |
|---|---|
| Account, core service, support | Performance of a contract (art. 6.1.b) |
| Invoicing, tax/accounting obligations | Legal obligation (art. 6.1.c) |
| Security, abuse/fraud prevention, technical improvement | Legitimate interest (art. 6.1.f) |
| Precise geolocation, optional notifications, non-essential cookies | Consent (art. 6.1.a) |
| Consent records (audit trail) | Legal obligation / legitimate interest |
6. RETENTION
- Account and active service: for as long as the account remains active.
- Support data: for as long as needed for resolution and reasonable traceability.
- Invoicing and transactions: for the applicable legal periods in tax and accounting matters (generally 5-10 years under Spanish rules).
- Security logs: the minimum necessary for security and auditing.
- Consent records: kept for the life of the contract and for at least 3 additional years in order to evidence the consent given.
Once those periods have elapsed, data is deleted or irreversibly anonymised.
7. RECIPIENTS AND PROCESSORS
Your data may be shared with the following processors, under contract and with appropriate security measures. The table reflects the providers used by xalven.app and by the XALVEN CRM (crm.xalven.app):
| Provider | Category | Purpose |
|---|---|---|
| Hostinger (VPS server) | Infrastructure | Hosting of the application and the database |
| Amazon Web Services — SES | Communications | Delivery of the email campaigns the user sends from the platform |
| Zoho Mail | Communications | Delivery of transactional and account service emails (welcome, team invitations, password reset) |
| Amazon Web Services — S3 | Infrastructure | Database backups |
| Stripe | Payments | Payment processing and subscription management |
| Anthropic (Claude) | Artificial intelligence | Generation of email copy and of Ximena's conversational replies |
| HERE Technologies | Business data | Geocoding of postcodes and search for establishments |
| OpenStreetMap / Overpass API | Business data | Search for establishments from open data |
| Overture Maps Foundation | Business data | Public places database |
| Apify | Business data | Enrichment of public company data (website, email, phone) |
| CARTO | Technical maps | Map tile server (receives the browser's IP when the map loads) |
| Meta Platforms — WhatsApp Business API | Communications | Sending WhatsApp messages from the CRM, only if the user enables that channel |
| n8n | Automation | Orchestration of prospecting and reply-handling workflows |
| Telegram | Internal operations | Technical alerts to the operations team (does not include the content of users' emails) |
| The user's own email provider (SMTP/IMAP) | Communications | Sending and receiving email with the credentials the user configures in their account |
No provider is authorised to process the data for its own purposes other than those indicated.
XALVEN ELITE (elite.xalven.app) is a separate product and has its own privacy policy, with its own list of processors.
8. INTERNATIONAL TRANSFERS
The data controller, KORNYX LLC, is located in the United States. This means that, as a general rule, the personal data of users located in the European Economic Area (EEA) or the United Kingdom is transferred to the United States, in addition to the processors listed in section 7, some of which also operate outside the EEA.
These transfers rely on the following safeguards:
- Standard Contractual Clauses (SCCs) approved by the European Commission (Implementing Decision (EU) 2021/914), supplemented by the technical and organisational measures described in section 12 and, where appropriate, by a transfer impact assessment.
- EU-US Data Privacy Framework (DPF), and its UK and Swiss extensions, where the specific provider is certified under that framework and the transfer is covered by its certification.
- Adequacy decisions of the European Commission, where one exists for the destination.
You may request information about the safeguards applied to a specific transfer, including a copy of the relevant clauses, by writing to support@xalven.app.
8.1 Representative in the European Union (GDPR art. 27)
KORNYX LLC is not established in the European Union. The appointment of a representative in the Union under Article 27 GDPR is in the process of being designated. Until it is completed and its details are published in this Policy, you may address any data protection matter to support@xalven.app, which is the controller's contact channel.
9. USER RIGHTS
Under the GDPR you may exercise the following rights:
| Right | Description |
|---|---|
| Access | Find out what data we process about you |
| Rectification | Correct inaccurate or incomplete data |
| Erasure | Request deletion of your data ("right to be forgotten") |
| Objection | Object to processing based on legitimate interest |
| Restriction | Ask us to restrict the use of your data |
| Portability | Receive your data in a structured, machine-readable format |
| Withdrawal of consent | Withdraw any consent given, without retroactive effect |
Channels to exercise your rights:
- Email: support@xalven.app (subject: "Exercise of GDPR rights")
- Form in the app/website: xalven.app/en/legal/rights
We may request identity verification in order to protect your data. The response period is 1 month (extendable to 3 in complex cases).
You may also lodge a complaint with the supervisory authority of your country. In Spain, the Spanish Data Protection Agency (AEPD) at www.aepd.es.
10. AUTOMATED DECISIONS AND ARTIFICIAL INTELLIGENCE
XALVEN uses artificial intelligence in its product. Specifically, Ximena —the platform's assistant— generates the content of emails from publicly available information about the recipient companies (their website, sector, location and other publicly available data), as well as the text of its conversational replies within the application. The provider of this technology is listed in section 7.
No automated decisions are taken that produce legal effects on users or similarly significantly affect them, within the meaning of Article 22 GDPR, nor is high-impact profiling carried out on them. Decisions on which companies to write to, with what content and when to send are always the user's, who can review and edit the generated text before it is sent.
11. MINORS
The service is not directed at persons under 16 years of age. If we detect data of minors processed without a valid legal basis, we will delete it immediately.
12. SECURITY
XALVEN applies technical and organisational measures proportionate to the risk:
- Encryption of communications in transit (TLS/HTTPS).
- Access control and secure authentication.
- Data minimisation: we only process the data that is necessary.
- Logging of security events.
- Internal access and confidentiality policies.
No system is 100% infallible. In the event of a security breach that may affect your rights, we will act in accordance with the GDPR (notification to the AEPD within 72 hours and to those affected where appropriate).
13. MAP TECHNOLOGY — OPENSTREETMAP / LEAFLET
Maps are displayed using Leaflet.js, with OpenStreetMap (OSM) cartographic data served as tiles by CARTO. When maps load, the browser makes requests to CARTO's tile servers, which may record IP addresses in their own logs. This communication is technically necessary for the map to work. For more information: openstreetmap.org/copyright.
14. CHANGES TO THIS POLICY
We may update this Policy at any time. We will publish the new version with an updated date. If the changes are material and affect your rights, we will notify you in the application at least 30 days in advance.
15. PRIVACY NOTICE FOR CALIFORNIA RESIDENTS (CCPA/CPRA)
This section applies to residents of the State of California (USA).
XALVEN does not sell users' personal data.
XALVEN may "share" data with providers acting as service providers in order to deliver the service. This exchange does not constitute a "sale" or "sharing for behavioural advertising" within the meaning of the CCPA/CPRA.
Your rights as a California resident:
- Know what personal data we collect, use, disclose or share.
- Access your personal data.
- Delete your personal data (subject to legal exceptions).
- Correct inaccurate data.
- Limit the use and disclosure of sensitive personal information (where applicable).
- Not be discriminated against for exercising these rights.
To exercise these rights: support@xalven.app or xalven.app/en/legal/rights
We will respond within 45 days of receiving a verifiable request.
XALVEN — KORNYX LLC — support@xalven.app — v2.0 — 2026-09-12
KORNYX LLC · EIN 61-2374219 (Estados Unidos) · 30 N Gould St, Ste R, Sheridan, WY 82801, Estados Unidos · support@xalven.app