Xavel
Legal

Privacy Policy

Effective date: August 4, 2026

This Privacy Policy describes how Rxtsel LLC, A Series of OtoCo DE LLC ("Rxtsel," "we," "us," or "our"), collects, uses, and shares information about you when you use our platform at https://xavel.app and related services (collectively, the "Service").

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name and email address. If you use a social login provider, we receive the information your provider shares with us.

1.2 Organization and Billing Data

To help you issue invoices and manage clients, we collect information you voluntarily provide about your organization, such as your business name, address, tax identification number, logo, and invoice settings. We also store the client records and invoice data you create within the Service.

1.3 Payment Provider Credentials

Xavel allows you to connect third-party payment providers (e.g., Stripe, MercadoPago, Wompi). We store the API keys or OAuth tokens required to make requests on your behalf.Xavel does not store payment card numbers, bank account details, or other sensitive financial data belonging to your clients. All payment transactions occur directly between your clients and your connected payment provider.

1.4 Usage and Analytics Data

We use analytics tools including PostHog to understand how the Service is used. This may include pages visited, features interacted with, session duration, and general usage patterns. Analytics data is associated with a pseudonymous identifier rather than directly with your name.

We use Sentry for error monitoring and crash reporting. When an error occurs, Sentry may capture technical information such as the error message, stack trace, browser type, and the page where the error occurred.

1.5 Device and Log Data

Our servers automatically log standard technical information, including your IP address, browser type, operating system, referring URLs, and timestamps. This data is used for security, debugging, and operational purposes.

2. How We Use Your Information

  • To create and manage your account;
  • To provide, operate, and improve the Service;
  • To facilitate invoice generation and payment provider connections;
  • To send transactional emails such as invitations, password resets, and service notices;
  • To monitor performance, diagnose errors, and ensure security;
  • To analyze usage patterns and improve product features;
  • To comply with legal obligations.

We do not sell your personal information. We do not use your data for behavioral advertising by third-party ad networks.

3. Third-Party Service Providers

We share data with trusted third parties only to the extent necessary to operate the Service:

  • PostHog · product analytics. See posthog.com/privacy.
  • Sentry · error tracking. See sentry.io/privacy.
  • Payment providers (Stripe, MercadoPago, Wompi) · payment processing.Xavel shares only what is required to initiate API calls on your behalf. Each provider's own privacy policy governs your clients' payment data.
  • Resend · transactional email delivery.
  • Cloudflare R2 · object storage for files and assets you upload.

All service providers are contractually required to process data only on our behalf and in accordance with applicable privacy laws.

4. Data Retention

We retain your account and organization data for as long as your account is active or as needed to provide the Service. If you close your account, we will delete or anonymize your personal data within 90 days, unless we are required to retain it longer to comply with legal obligations, resolve disputes, or enforce our agreements.

5. Your Rights

Depending on where you are located, you may have the right to:

  • Access the personal information we hold about you;
  • Request correction of inaccurate information;
  • Request deletion of your personal information;
  • Object to or restrict certain processing;
  • Request a portable copy of your data.

California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and to opt out of its sale. We do not sell personal information.

To exercise any of these rights, visit our contact page. We will respond within 30 days.

6. Cookies and Tracking

We use session cookies and local storage to keep you logged in and remember your preferences. We do not use third-party advertising cookies. Analytics tools (PostHog) may set their own cookies; you can opt out by adjusting your browser settings or using a browser extension that blocks analytics scripts.

7. Security

We implement industry-standard security measures, including encrypted connections (TLS), row-level security at the database level, and access controls. No system is perfectly secure, and we cannot guarantee the absolute security of your data.

8. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, contact us via our contact page and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or by posting a notice within the Service. Your continued use of the Service after the effective date of the updated policy constitutes your acceptance of the changes.

10. Contact

Questions or requests regarding this Privacy Policy may be sent via our contact page.