Legal
Privacy Policy
1. Who is responsible
XNDR, SLU, NRT L-719706-H, Camí de la Planella 4, Ed. Baccara 11B, 2-4, AD400 Escàs, Andorra, is the controller of the personal data described here. Contact: stephen@xndr.io.
2. This website
This site sets no cookies, no analytics and no tracking scripts, and does not load third-party fonts or scripts, so there is no cookie banner. Our hosting provider, Cloudflare, processes technical data such as your IP address when it serves a page, as any web host does, and keeps its own server logs to run and secure the service.
3. What we collect
- Purchases. Payments are taken by our merchant of record, which collects your payment and billing details. We receive the data we need to deliver the product and keep our records: your email address, the product bought, the date and amount, and your country for tax purposes. We never see your full card number.
- Contact. If you email us, we receive your email address and what you write.
4. Why we use it, and the legal basis
- To deliver what you bought and give support: performing a contract.
- To keep accounting and tax records: a legal obligation.
- To answer your messages and to prevent fraud and abuse: our legitimate interest.
We do not sell personal data. We do not send marketing email unless you ask for it.
5. Who processes it
- Dodo Payments, our merchant of record, for payments, refunds, VAT and fraud checks. It acts as an independent controller for its own purposes, under its own privacy policy.
- Cloudflare, for hosting this website.
- Our email provider, to receive and send mail at stephen@xndr.io.
International transfers: Andorra has an adequacy decision from the European Commission, so data can flow between the EU and Andorra. Where a provider, such as Cloudflare or Dodo Payments, processes data outside the EEA and Andorra, it relies on standard contractual clauses or the provider's equivalent safeguards.
6. How long we keep it
- Purchase and accounting records: 6 years from the date of the last annual closing, as required by Article 7 of Andorran Law 30/2007 on the accounting of businesses.
- Support emails: until the matter is closed, then for up to 2 years, unless you ask us to delete them sooner.
7. Your rights
You can ask us for access to your data, correction, deletion, restriction or a portable copy, and you can object to processing based on legitimate interest. Email stephen@xndr.io and we will reply within 30 days. We may keep data the law obliges us to keep. You can complain to the Andorran data protection authority (APDA, apda.ad) or to the authority in your own country.
8. Automated handling
Emails to stephen@xndr.io are read and answered by Stephen, an AI agent working on behalf of XNDR, SLU. No decision with legal effect on you is made by automated means beyond what our merchant of record does for payment and fraud checks.
9. Changes
If this policy changes, the new version and its date will be on this page.