Privacy Policy for xhr.dev
Last updated: 2026-10-18
This page describes our on-prem product. xhr.dev is licensed software that you deploy inside your own infrastructure. We do not operate a hosted service that processes your traffic, and this notice reflects that — it covers only the limited business data we collect to sell and support the software.
This is a plain-language summary drafted for the on-prem product change. It has not been reviewed by counsel — treat it as a starting point, not a final legal document, until it has been.
This privacy notice for xhr.dev ("we," "us," or "our") describes how and why we collect, store, use, and/or process information when you:
- Visit our website at https://xhr.dev/ or https://docs.xhr.dev/
- Contact us about, purchase, or receive support for a licence to our on-prem software
- Try our hosted evaluation services (the trial solver or the hosted MCP server)
- Engage with us in sales or marketing activities
Questions or concerns? Contact us at privacy@xhr.dev.
Summary of Key Points
- What do we process? Business contact information you give us directly — name, email, company, and billing details — to issue a licence, invoice you, and provide support.
- Do we process your application traffic or end-user data? Not for a licensed deployment. Our software runs inside your infrastructure; we never receive, store, or have access to the traffic it processes, the target sites it interacts with, or any data belonging to your end users. The one exception is the optional hosted evaluation services, described in section 2.
- Who is responsible for this data? XHR Software Inc., a Delaware corporation, is the controller of the business data described here. Reach us at privacy@xhr.dev.
- Do we receive information from third parties? Only from our contract platform (Common Paper) and bank (Mercury), and only what's necessary to execute your agreement and reconcile payment.
- How do we keep information safe? Standard organizational and technical safeguards for the limited business data described above — see Security for how the software itself is secured.
- What are your rights? You may access, correct, or request deletion of the business contact information we hold about you.
1. What Information Do We Collect?
We collect the business contact information you give us when you inquire about a licence, sign a licensing agreement, or request support: name, email, company name, and billing information. Contracts are executed through Common Paper, which may also collect payment details if your order form uses its integrated billing; otherwise we invoice you and receive payment by bank transfer into our Mercury account. Those providers handle and store payment details on our behalf — we do not store full card or bank account numbers.
For a licensed deployment we do not collect or have access to the traffic, requests, responses, proxies, target-site data, or end-user data that our software processes once it's deployed on your infrastructure. See Security for how that boundary is maintained.
2. Evaluation Services (Optional)
If you send requests to the hosted trial solver or the hosted MCP server, we receive and process what those requests contain: the target URL, challenge documents and scripts, cookies (potentially including session cookies), device and browser characteristics, your IP address, and your API key. We use it only to compute the response and to operate and secure the service, and we keep operational logs for 15 days. The trial key is revoked when the evaluation ends, and you can ask us to delete what is associated with it. Please don't send credentials for real accounts or your end users' personal data to these services. The same applies to the Chrome extension when pointed at them. The vendors that host these services are listed on Subprocessors.
3. How Do We Process Your Information?
We use the information above to issue and renew licences, invoice you, respond to support requests, and communicate about the product (e.g. licence expiry, security-relevant updates). We do not sell this information.
4. Legal Bases
Where applicable law requires a legal basis, we rely on: performance of a contract (issuing and administering your licence), legitimate interests (support, security communications), and consent where you've given it (e.g. marketing emails, which you can opt out of at any time).
5. When and With Whom Do We Share Information
We share business contact/billing information only with:
- Common Paper (contracts, e-signature and optional billing) and Mercury (our bank, for invoice payments), to execute your agreement and receive payment
- Service providers who help us run our business (see Subprocessors), including Google Workspace for email and call scheduling, and the hosting vendors behind the evaluation services
- Where required by law, or in connection with a business transfer (merger, acquisition)
We do not share it for advertising purposes.
6. How Long Do We Keep Information
Business contact and licensing records are kept for as long as needed to administer your licence and comply with tax/accounting obligations, then deleted or anonymized. Evaluation logs are kept for 15 days. Evaluation data is handled as described in section 2. Email and support correspondence is kept for as long as it is useful to support you.
7. Our Websites
Our websites (xhr.dev and docs.xhr.dev) are static, set no cookies, and use no analytics, advertising or tracking scripts; fonts are self-hosted. Our hosting providers (see Subprocessors) see ordinary web server data such as your IP address. If you use our call-booking link, the booking is handled by Google Calendar.
8. How We Keep Information Safe
We apply standard organizational and technical safeguards to the business data described above (access controls, least-privilege access, two-factor authentication for internal systems). No system is perfectly secure, but critically, the software's design means the vast majority of data relevant to your deployment — your application traffic — is never in our custody to begin with. See Security.
9. Children's Data
We don't knowingly collect information from anyone under 18. If you believe we have, contact legal@xhr.dev.
10. Your Privacy Rights
Depending on your jurisdiction, you may have rights to access, correct, or delete the business contact information we hold about you, or to withdraw consent for marketing communications. If you are in the EU/UK you may also object to or restrict processing, request portability, and complain to your supervisory authority; if you are in California or another US state with a privacy law, you may request access, correction, deletion, and to know the categories we collect (identifiers, commercial information such as licence and payment records, and, for the evaluation services, internet activity data). We don't sell or share personal information for cross-context advertising, and we won't discriminate against you for asking. Contact legal@xhr.dev to exercise these rights.
11. Do Not Track
We don't currently respond to browser DNT signals; we'll update this notice if that changes.
12. International Transfers
We are based in the United States and our vendors operate primarily there. If you are in the EU or UK, your business data is transferred to the US; for customers we cover this in the DPA using the EU-US Data Privacy Framework or Standard Contractual Clauses.
13. Changes to This Notice
We'll update the "Last updated" date above when this notice changes.