Legal
Privacy Policy
Last updated: 20 October 2026
This policy explains what personal data Weesite LTD (“we”, “us”) collects when you use XenoMind (the “Service”, at www.xenomind.studio), why we collect it, how long we keep it, and the rights you have. We are the “data controller” for that data under the UK GDPR and the Data Protection Act 2018.
1. What we collect
- Account & profile: your name, email address, and anything you choose to add to your profile - nickname, surname, a short bio/headline, job title, city/country, phone, organization, social/profile links (including LinkedIn), and an avatar image.
- Access requests: if you apply through our join page, the details you submit - name, email, phone, organization, team size, website, who referred you, any referral code, and your message - plus your IP address and browser user-agent (to guard against spam).
- Your content: the maps, spreadsheets, folders, notes, attachments and images you create or upload, and comments you post.
- AI API keys: if you connect your own AI provider, the API key you supply (stored encrypted - see section 3).
- Support: the contents of any support tickets you open.
- Technical & security logs: sign-in events, IP addresses and a record of security-relevant actions, kept to operate and protect the Service.
- Analytics: if you consent, aggregate usage data via Google Analytics (see section 5).
2. Why we use it & our legal basis
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Create your account and provide the Service | Performance of a contract |
| Review access requests and invite people | Legitimate interests (running an invite-only service) |
| Send sign-in links and essential service emails | Performance of a contract |
| Keep the Service secure and prevent abuse | Legitimate interests |
| Understand usage to improve the product | Consent (analytics cookies) |
3. AI features & your own API keys
XenoMind's AI features use your own API key for the provider you choose - Anthropic (Claude), OpenAI (ChatGPT) or Google (Gemini). We store your key encrypted and never show it again in full or sell or reuse it. When you use an AI feature, the relevant content (for example your prompt and the map you're editing) is sent to the provider you selected so it can respond. That processing is governed by that provider's terms and privacy policy. If you don't connect a key, no content is sent to any AI provider by the built-in assistant.
4. Who we share it with
We don't sell your data. We share it only with the service providers that help us run XenoMind (our “processors”), each under a data-processing agreement:
- Hosting - our cloud host and server management, where the application and database run.
- Email delivery - to send sign-in links and service notifications.
- Analytics - Google Analytics, only if you consent.
- AI providers - only the provider whose key you connect, and only when you use an AI feature (see section 3).
We may also disclose data if required by law, or to protect our rights, users or the Service.
5. Cookies & analytics
We group cookies into three categories, and ask for your consent through a banner before loading anything non-essential:
- Strictly necessary (always on) - sign-in session, security (CSRF) and your cookie-consent choice itself. The Service can't work without these, so they don't need consent.
- Analytics (off until you allow it) - Google Analytics, to understand how the Service is used.
- Marketing (off until you allow it) - reserved for measuring marketing; not used today.
You can change your choice at any time from the “Cookie preferences” link, and your preference is remembered for 12 months. Declining analytics does not limit your use of the Service.
6. How long we keep it
| Data | Retention |
|---|---|
| Account, profile & your content | For as long as your account is active |
| Items in Trash | Purged 30 days after deletion |
| Declined access requests | Deleted after 90 days |
| Security / audit logs | Up to 180 days |
| A closed/deleted account | Erased within a few days of closure |
Backups you download are held by you, not by us.
7. Your rights
Under UK GDPR you can ask us to: give you a copy of your data (access); correct it (rectification); delete it (erasure); restrict or object to processing; and provide it in a portable form (portability). You can export all your own content yourself at any time using the backup download in the app, and you can withdraw analytics consent whenever you like. To exercise any other right, email ; we'll respond within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) - though we'd appreciate the chance to put things right first.
8. International transfers
Some providers (for example analytics and the AI provider you choose) may process data outside the UK. Where that happens, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses.
9. Security
We protect your data with encryption in transit (HTTPS), encryption of sensitive fields such as API keys at rest, passwordless sign-in (magic links - no passwords for us to leak), per-user access controls, rate limiting and audit logging. No system is perfectly secure, but we work to keep your data safe.
10. Children
XenoMind is not intended for children under 13 (or the minimum age in your country). Where a school or organization enrols pupils, that institution is responsible for obtaining any necessary consents. If you believe a child has given us personal data without authorisation, contact us and we'll remove it.
11. Changes & contact
We may update this policy as the Service evolves; the “last updated” date above reflects the latest version, and significant changes will be highlighted in the app. Questions or requests: .