Privacy Policy

Last updated: June 27, 2026

Thank you for choosing to be part of our community at Xactli. We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about this policy or our practices with regard to your personal information, please contact us at privacy@xactli.com.

This privacy policy applies to information collected through our website at xactli.com, our Xactli mobile application (available on iOS and Android), and any related services (collectively, the "Services"). Please read it carefully.

We do not sell your personal information to third parties.

1. WHAT INFORMATION DO WE COLLECT?

Information you provide to us

In Short: We collect information you provide when you register, use our Services, or contact us.

  • Account information: Name, email address, and password when you create an account.
  • Profile information: Company name, phone number, and business address if you choose to provide them.
  • Project content: Project names, addresses, locations, trades, materials, quantities, budgets, cost estimates, resources, product selections, and any other content you enter into the Services. This is your data and you control it.
  • Communications: Messages you send us, including support requests and feedback.
  • Payment information: Billing details for subscription payments. Payment card data is processed by our payment processor and is not stored on our servers.
Information collected automatically

In Short: Some technical information is collected automatically when you use our Services.

  • Usage data: Pages visited, features used, actions taken within the application, and timestamps.
  • Device information: Device type, operating system version, app version, and unique device identifiers.
  • Network information: IP address and general geographic region (country/state level).
  • Crash and diagnostics data: Error logs and performance data used to identify and fix bugs.
Information we do NOT collect
  • We do not access your device's location (GPS).
  • We do not access your contacts, photos library, camera, or microphone unless you explicitly use a feature that requires it (such as uploading an image for a material selection), in which case you will be prompted by your device's OS for permission first.
  • We do not collect health or biometric data.
  • We do not track your activity across third-party apps or websites.

2. HOW DO WE USE YOUR INFORMATION?

In Short: We use your information to provide, improve, and secure the Services.

  • To create and manage your account.
  • To provide the Services and all features you use within them.
  • To process payments and manage your subscription.
  • To send transactional emails (account confirmation, password reset, invitation notifications). We do not send marketing emails without your opt-in consent.
  • To respond to support requests and inquiries.
  • To monitor and improve application performance, fix bugs, and develop new features.
  • To comply with legal obligations.

3. WILL YOUR INFORMATION BE SHARED WITH ANYONE?

In Short: We share information only as necessary to operate the Services or as required by law. We do not sell your personal information.

  • Service providers: We share data with vendors who help us operate the Services (hosting, email delivery, payment processing, analytics). These vendors are contractually required to protect your data and may only use it to provide services to us.
  • Project collaborators: When you invite a contractor, trade partner, or other user to a project, they will see the project data you have shared with them. You control who is invited.
  • Legal requirements: We may disclose information if required by law, court order, or government authority, or to protect the safety, rights, or property of Xactli or others.
  • Business transfers: If Xactli is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
  • We do not sell, rent, or trade your personal information to any third party for their own marketing or commercial purposes.

4. MOBILE APPLICATION — SPECIFIC DISCLOSURES

This section provides additional disclosures specific to the Xactli mobile app (available on iOS and Android).

Authentication tokens

When you log in via the mobile app, we store an authentication token securely on your device using the platform's secure credential storage (iOS Keychain / Android Keystore via MAUI SecureStorage). This token is used to keep you signed in and is never transmitted to third parties.

Data synced to the cloud

All project data you view or create in the mobile app is synced with our servers so that it is accessible from both the app and the website. The mobile app does not store a local copy of your project data beyond what is displayed in the current session.

Device permissions

The mobile app may request the following device permissions depending on features you use:

  • Internet access: Required to communicate with our servers. Always requested.
  • Camera / Photo library: Only requested if you choose to upload an image for a material selection or project resource. You can decline this permission; the upload feature simply will not be available.

We do not request access to your contacts, microphone, location, Bluetooth, or any other device resource not listed above.

Push notifications

The current version of the Xactli app does not send push notifications. If we add this feature in the future, we will ask for your explicit permission before enabling it and will update this policy.

Analytics in the mobile app

The mobile app may collect anonymous usage and crash data (such as which screens are visited and any unhandled errors) to help us improve the app. This data is aggregated and does not identify you personally.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: The website uses cookies. The mobile app does not use browser cookies.

Our website uses cookies and similar tracking technologies (web beacons, pixels) to maintain your session, remember your preferences, and understand how visitors use the site. We use Google Tag Manager and analytics tools for this purpose. You can configure your browser to refuse cookies, but some parts of the site may not function correctly.

The Xactli mobile app does not use browser cookies. Session authentication in the app is handled via secure token storage as described in Section 4.

6. THIRD-PARTY SERVICES AND SDKS

We use the following categories of third-party services. Each has its own privacy policy governing its data practices:

  • Cloud hosting: Our servers and database are hosted in the United States on cloud infrastructure. Server logs and your data reside there.
  • Payment processing: Subscription payments are handled by our payment processor. We do not store your card number. The processor receives billing information as required to complete your transaction.
  • Email delivery: Transactional emails (account confirmation, password reset, invitations) are sent via a third-party email delivery service.
  • Analytics (website): We use Google Analytics (via Google Tag Manager) and PostHog to understand how visitors use our website. These tools may set cookies and collect IP addresses.
  • Customer support: We use Intercom to provide in-app support chat on the website. Intercom may collect your name and email address when you initiate a conversation.

The Xactli mobile app does not include third-party advertising SDKs or social media SDKs.

7. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you register using a social media account, we receive limited profile information from that provider.

If the Services offer social login (e.g., "Sign in with Google"), we will receive certain profile information — typically your name and email address — from the social media provider you choose. We use this information only to create and manage your account. We do not receive your social contacts, posts, or other social media data. Please review the privacy policy of any social provider you use to understand their data practices.

8. HOW DO WE KEEP YOUR INFORMATION SECURE?

In Short: We use technical and organizational measures to protect your information, but no system is completely secure.

  • All data in transit between the app or browser and our servers is encrypted using TLS (HTTPS).
  • Passwords are stored as salted hashes — we cannot retrieve your plaintext password.
  • Authentication tokens on mobile devices are stored in the platform's secure credential storage (iOS Keychain / Android Keystore).
  • Access to production systems is restricted to authorized personnel.

Despite these measures, no security system is impenetrable. If you believe your account has been compromised, contact us immediately at privacy@xactli.com.

9. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We retain your information for as long as your account is active or as needed to provide the Services.

We keep your personal information and project data for as long as your account remains active. When you delete your account (see Section 10), we will delete or anonymize your personal information within 30 days, except where we are required by law to retain certain records (such as billing history for tax purposes). Backup copies may persist for up to 90 days before being permanently purged.

10. HOW DO YOU DELETE YOUR ACCOUNT AND DATA?

In Short: You can request deletion of your account and personal data at any time by emailing us.

To delete your Xactli account and the personal information associated with it, send a deletion request to privacy@xactli.com from the email address associated with your account. Include "Account Deletion Request" in the subject line.

Upon a valid deletion request, we will:

  • Deactivate your account within 5 business days.
  • Permanently delete your personal information (name, email, password hash, profile data) within 30 days.
  • Delete your project content (projects, locations, trades, materials) within 30 days, unless you are an owner of projects that have active collaborators — in that case we will contact you to confirm how those projects should be handled before deletion.

Some information may be retained in anonymized or aggregated form that cannot identify you, and certain billing records may be retained as required by applicable law.

Note: Deleting the Xactli app from your device does not delete your account or data. You must submit a deletion request as described above to have your data removed from our servers.

11. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

Xactli is intended for use by adults 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have inadvertently collected data from a minor, we will promptly delete that information and deactivate the associated account. If you are aware of any such data, please contact us at privacy@xactli.com.

12. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on where you live, you may have rights to access, correct, export, or delete your personal information.

Regardless of where you live, you may:

  • Access: Request a copy of the personal information we hold about you.
  • Correct: Ask us to update inaccurate information (you can also update most information directly within the app).
  • Delete: Request deletion of your account and personal data (see Section 10).
  • Opt out of marketing emails: Click the unsubscribe link in any marketing email, or contact us at privacy@xactli.com. Transactional emails related to your account will continue.
  • Portability: Request an export of the project data you have entered into the Services.

If you are a resident of the European Economic Area (EEA), you also have the right to lodge a complaint with your local data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu.

To exercise any of these rights, email us at privacy@xactli.com. We will respond within 30 days.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature. No uniform technology standard for DNT has been finalized, and we do not currently respond to DNT signals. If a binding standard is adopted, we will update this policy accordingly.

14. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes. California residents have additional rights under the CCPA/CPRA.

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents may:

  • Know what personal information we have collected, disclosed, or sold in the past 12 months.
  • Request deletion of their personal information (subject to certain exceptions).
  • Opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising.
  • Correct inaccurate personal information we hold about them.
  • Not be discriminated against for exercising these rights.

To submit a California privacy request, email us at privacy@xactli.com with "California Privacy Request" in the subject line. We will verify your identity before processing the request. You may also designate an authorized agent to submit a request on your behalf.

"Shine the Light" (Cal. Civ. Code § 1798.83): California residents may once per year request information about disclosures of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes, so no such disclosure report is applicable.

15. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: Our servers are in the United States. If you use the Services from outside the US, your data will be transferred here.

Our servers are located in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the US. By using the Services, you consent to this transfer. We take reasonable steps to ensure your data is protected consistent with this policy and applicable law.

16. DO WE MAKE UPDATES TO THIS POLICY?

In Short: Yes. We will update this policy as needed and notify you of material changes.

We may update this privacy policy from time to time. The "Last updated" date at the top of this page will reflect when the policy was last revised. If we make material changes — particularly changes to how we collect, use, or share your personal information — we will notify you via email and/or a prominent notice in the Services before the change takes effect.

17. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have questions or concerns about this policy or our privacy practices, please contact us:

Email: privacy@xactli.com
Mail:
Xactli Corporation
2109-C South Wright Street
Santa Ana, CA 92705
United States

We will respond to all privacy-related inquiries within 30 days.

HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

To request access to, correction of, or deletion of your personal information, email us at privacy@xactli.com with the subject "Data Request — [Access / Correction / Deletion]". Include the email address associated with your Xactli account. We will respond within 30 days.