---
url: /privacy.md
---
# Privacy Policy for xhr.dev

**Last updated: 2026-10-18**

> **This page describes our on-prem product.** xhr.dev is licensed software
> that you deploy inside your own infrastructure. We do not operate a hosted
> service that processes your traffic, and this notice reflects that — it
> covers only the limited business data we collect to sell and support the
> software.
>
> This is a plain-language summary drafted for the on-prem product change.
> It has not been reviewed by counsel — treat it as a starting point, not a
> final legal document, until it has been.

This privacy notice for xhr.dev ("we," "us," or "our") describes how and why
we collect, store, use, and/or process information when you:

* Visit our website at <https://xhr.dev/> or
  <https://docs.xhr.dev/>
* Contact us about, purchase, or receive support for a licence to our
  on-prem software
* Try our hosted evaluation services (the trial solver or the hosted MCP
  server)
* Engage with us in sales or marketing activities

**Questions or concerns?** Contact us at
<privacy@xhr.dev>.

***

## Summary of Key Points

* **What do we process?** Business contact information you give us directly
  — name, email, company, and billing details — to issue a licence, invoice
  you, and provide support.
* **Do we process your application traffic or end-user data?** Not for a
  licensed deployment. Our software runs inside your infrastructure; we
  never receive, store, or have access to the traffic it processes, the
  target sites it interacts with, or any data belonging to your end users.
  The one exception is the optional hosted evaluation services, described
  in [section 2](#_2-evaluation-services-optional).
* **Who is responsible for this data?** XHR Software Inc., a Delaware
  corporation, is the controller of the business data described here. Reach
  us at <privacy@xhr.dev>.
* **Do we receive information from third parties?** Only from our contract
  platform (Common Paper) and bank (Mercury), and only what's necessary to
  execute your agreement and reconcile payment.
* **How do we keep information safe?** Standard organizational and technical
  safeguards for the limited business data described above — see
  [Security](/security) for how the software itself is secured.
* **What are your rights?** You may access, correct, or request deletion of
  the business contact information we hold about you.

***

## 1. What Information Do We Collect?

We collect the business contact information you give us when you inquire
about a licence, sign a licensing agreement, or request support: name,
email, company name, and billing information. Contracts are executed
through Common Paper, which may also collect payment details if your order
form uses its integrated billing; otherwise we invoice you and receive
payment by bank transfer into our Mercury account. Those providers handle
and store payment details on our behalf — we do not store full card or bank
account numbers.

For a licensed deployment we do **not** collect or have access to the traffic, requests, responses,
proxies, target-site data, or end-user data that our software processes
once it's deployed on your infrastructure. See [Security](/security) for how
that boundary is maintained.

## 2. Evaluation Services (Optional)

If you send requests to the hosted trial solver or the hosted MCP server,
we receive and process what those requests contain: the target URL,
challenge documents and scripts, cookies (potentially including session
cookies), device and browser characteristics, your IP address, and your API
key. We use it only to compute the response and to operate and secure the
service, and we keep operational logs for 15 days. The
trial key is revoked when the evaluation ends, and you can ask us to delete
what is associated with it. Please don't send credentials for real accounts
or your end users' personal data to these services. The same applies to the
[Chrome extension](/extension-privacy) when pointed at them. The vendors that
host these services are listed on [Subprocessors](/subprocessors).

## 3. How Do We Process Your Information?

We use the information above to issue and renew licences, invoice you,
respond to support requests, and communicate about the product (e.g. licence
expiry, security-relevant updates). We do not sell this information.

## 4. Legal Bases

Where applicable law requires a legal basis, we rely on: performance of a
contract (issuing and administering your licence), legitimate interests
(support, security communications), and consent where you've given it
(e.g. marketing emails, which you can opt out of at any time).

## 5. When and With Whom Do We Share Information

We share business contact/billing information only with:

* Common Paper (contracts, e-signature and optional billing) and Mercury
  (our bank, for invoice payments), to execute your agreement and receive
  payment
* Service providers who help us run our business (see
  [Subprocessors](/subprocessors)), including Google Workspace for email
  and call scheduling, and the hosting vendors behind the evaluation
  services
* Where required by law, or in connection with a business transfer (merger,
  acquisition)

We do not share it for advertising purposes.

## 6. How Long Do We Keep Information

Business contact and licensing records are kept for as long as needed to
administer your licence and comply with tax/accounting obligations, then
deleted or anonymized. Evaluation logs are kept for 15 days. Evaluation data is handled as described in
[section 2](#_2-evaluation-services-optional). Email and support
correspondence is kept for as long as it is useful to support you.

## 7. Our Websites

Our websites (`xhr.dev` and `docs.xhr.dev`) are static, set no cookies, and
use no analytics, advertising or tracking scripts; fonts are self-hosted.
Our hosting providers (see [Subprocessors](/subprocessors)) see ordinary web
server data such as your IP address. If you use our call-booking link, the
booking is handled by Google Calendar.

## 8. How We Keep Information Safe

We apply standard organizational and technical safeguards to the business
data described above (access controls, least-privilege access,
two-factor authentication for internal systems). No system is perfectly
secure, but critically, the software's design means the vast majority of
data relevant to your deployment — your application traffic — is never in
our custody to begin with. See [Security](/security).

## 9. Children's Data

We don't knowingly collect information from anyone under 18. If you believe
we have, contact <legal@xhr.dev>.

## 10. Your Privacy Rights

Depending on your jurisdiction, you may have rights to access, correct, or
delete the business contact information we hold about you, or to withdraw
consent for marketing communications. If you are in the EU/UK you may also
object to or restrict processing, request portability, and complain to your
supervisory authority; if you are in California or another US state with a
privacy law, you may request access, correction, deletion, and to know the
categories we collect (identifiers, commercial information such as licence
and payment records, and, for the evaluation services, internet activity
data). We don't sell or share personal information for cross-context
advertising, and we won't discriminate against you for asking. Contact
<legal@xhr.dev> to exercise these rights.

## 11. Do Not Track

We don't currently respond to browser DNT signals; we'll update this notice
if that changes.

## 12. International Transfers

We are based in the United States and our vendors operate primarily there. If
you are in the EU or UK, your business data is transferred to the US; for
customers we cover this in the [DPA](/dpa) using the EU-US Data Privacy
Framework or Standard Contractual Clauses.

## 13. Changes to This Notice

We'll update the "Last updated" date above when this notice changes.

## 14. Contact

<privacy@xhr.dev> /
<legal@xhr.dev>