Privacy Policy for xhr.dev
Last updated: 08/08/2026
This page describes our on-prem product. xhr.dev is licensed software that you deploy inside your own infrastructure. We do not operate a hosted service that processes your traffic, and this notice reflects that — it covers only the limited business data we collect to sell and support the software.
This is a plain-language summary drafted for the on-prem product change. It has not been reviewed by counsel — treat it as a starting point, not a final legal document, until it has been.
This privacy notice for xhr.dev ("we," "us," or "our") describes how and why we collect, store, use, and/or process information when you:
- Visit our website at https://xhr.dev/ or https://docs.xhr.dev/
- Contact us about, purchase, or receive support for a licence to our on-prem software
- Engage with us in sales or marketing activities
Questions or concerns? Contact us at privacy@xhr.dev.
Summary of Key Points
- What do we process? Business contact information you give us directly — name, email, company, and billing details — to issue a licence, invoice you, and provide support.
- Do we process your application traffic or end-user data? No. Our software runs inside your infrastructure; we never receive, store, or have access to the traffic it processes, the target sites it interacts with, or any data belonging to your end users.
- Do we receive information from third parties? Only from our payment processor, if you pay via invoice/card, and only what's necessary to reconcile payment.
- How do we keep information safe? Standard organizational and technical safeguards for the limited business data described above — see Security for how the software itself is secured.
- What are your rights? You may access, correct, or request deletion of the business contact information we hold about you.
1. What Information Do We Collect?
We collect the business contact information you give us when you inquire about a licence, sign a licensing agreement, or request support: name, email, company name, and billing information. If you pay by card, our payment processor handles and stores your payment details on our behalf — we do not store full card numbers.
We do not collect or have access to the traffic, requests, responses, proxies, target-site data, or end-user data that our software processes once it's deployed on your infrastructure. See Security for how that boundary is maintained.
2. How Do We Process Your Information?
We use the information above to issue and renew licences, invoice you, respond to support requests, and communicate about the product (e.g. licence expiry, security-relevant updates). We do not sell this information.
3. Legal Bases
Where applicable law requires a legal basis, we rely on: performance of a contract (issuing and administering your licence), legitimate interests (support, security communications), and consent where you've given it (e.g. marketing emails, which you can opt out of at any time).
4. When and With Whom Do We Share Information
We share business contact/billing information only with:
- Our payment/billing processor, to process payment
- Service providers who help us run our business (see Subprocessors)
- Where required by law, or in connection with a business transfer (merger, acquisition)
We do not share it for advertising purposes.
5. How Long Do We Keep Information
Business contact and licensing records are kept for as long as needed to administer your licence and comply with tax/accounting obligations, then deleted or anonymized.
6. How We Keep Information Safe
We apply standard organizational and technical safeguards to the business data described above (access controls, least-privilege access, two-factor authentication for internal systems). No system is perfectly secure, but critically, the software's design means the vast majority of data relevant to your deployment — your application traffic — is never in our custody to begin with. See Security.
7. Children's Data
We don't knowingly collect information from anyone under 18. If you believe we have, contact legal@xhr.dev.
8. Your Privacy Rights
Depending on your jurisdiction, you may have rights to access, correct, or delete the business contact information we hold about you, or to withdraw consent for marketing communications. Contact legal@xhr.dev to exercise these rights.
9. Do Not Track
We don't currently respond to browser DNT signals; we'll update this notice if that changes.
10. Changes to This Notice
We'll update the "Last updated" date above when this notice changes.