Skip to main content

Free for 14 days · from $9.90/mo

See plans

Privacy Policy

Last updated: October 2026

Overview

XO Report ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our Excel and Google Sheets add-ins and related services.

XO Report is the data controller for your personal data. For privacy-related inquiries, contact us at .

Data Controller

XO Report is operated by Clovis Global. For privacy inquiries: .

Information We Collect

Account Information

When you authenticate with Xero, we collect:

  • Your email address and name (from your Xero profile)
  • Your Xero user identifier
  • Names and identifiers of Xero organizations you authorize
  • Subscription and billing information (via Stripe)

Xero Data Access

XO Report connects to Xero using OAuth 2.0 with read-only access to your accounting data. We never create, modify, or delete any data in your Xero account. We access your Xero data only to provide the functionality you request (pulling data into Excel or Google Sheets) and do not store your Xero financial data permanently on our servers.

We access the following Xero data based on your usage (read-only):

  • Chart of Accounts
  • Contacts (customers and suppliers)
  • Invoices and Bills
  • Payments and Credit Notes
  • Financial Reports (P&L, Balance Sheet, etc.)
  • Tracking Categories
  • Tax Rates and Currencies

Google Sheets Add-on

The XO Report Google Sheets add-on works only in the spreadsheet you have open (Google's "spreadsheets.currentonly" permission). In that spreadsheet it writes the tables you insert, reads them back when you refresh, reads the cells you pick as report dates, and keeps table settings inside the spreadsheet. It sends our servers the spreadsheet's ID (to run your requests) and the dates from the cells you picked (used as report dates and also sent to Xero). It sends our servers usage data that contains no spreadsheet values (timings, row and organization counts, and outcome codes) and a one-time install count (see Usage Data and Error Reporting below), and sends error reports (the failure type, a cleaned-up error message, the spreadsheet ID, and your account's internal ID when you are signed in) to our error-monitoring provider, Sentry. It does not send the rest of your spreadsheet's contents.

XO Report's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we handle Google user data

  • Data accessed: only the spreadsheet you have open. The add-on reads the tables it inserted, the cells you pick as report dates, the table settings it saved in that spreadsheet, and basic details such as sheet names, time zone and locale. It does not access your other files, Gmail, Drive, contacts or calendar, and it does not read your Google profile or email address.
  • How we use it: only to provide the features you ask for: inserting and refreshing Xero reports in that spreadsheet, linking the spreadsheet to the Xero organizations you chose, and fixing errors you run into. We do not use Google user data, raw or aggregated, for advertising, profiling, credit or lending decisions, or any other purpose.
  • Who receives it: the spreadsheet ID and the dates you picked go to our own servers, hosted by Supabase (database). The dates are also sent to Xero as the report period. The spreadsheet ID and your account's internal ID can appear in error reports at Sentry (error monitoring). These providers process the data only on our behalf. We do not sell Google user data or share it with advertisers, data brokers or any other third party, except where the law requires it.
  • How we protect it: all traffic uses TLS encryption, data is stored in Supabase behind row-level security and protected against unauthorized access (people who use the same spreadsheet share its record), sign-in tokens are never shown to the spreadsheet, and only the small XO Report team can access production systems.
  • Human access: no one at XO Report reads Google user data unless you ask us to (for example, to look into a problem you report), it is needed for security, such as investigating abuse, or the law requires it.
  • Retention and deletion: the spreadsheet ID is kept with your connection while you use the add-on. Signing out of the add-on does not delete these records. Deleting your account (see Delete Your Account) deletes your connection records, including each spreadsheet ID and the record of which Xero organizations it was linked to, after the 30-day cooling-off period. Error reports at Sentry are deleted automatically after 30 days. The tables in your spreadsheet belong to you: uninstalling the add-on leaves them in place, and you can delete them like any other sheet. To ask us to delete Google user data at any time, email us at the address under Contact Us.
  • AI and machine learning: Google user data is never used to develop, improve or train AI or machine-learning models, and is never sent to third-party AI services.

Usage Data and Error Reporting

We collect limited data to improve our service and fix issues. Website page and event analytics are collected through Vercel Web Analytics and PostHog. They run by default everywhere so we can see which pages are useful and where visitors leave. Vercel Web Analytics is cookieless. You control three things in Privacy settings: analytics, ad click measurement and sign-up attribution. In the opt-in regions below, the notice asks about the last two:

  • Aggregate website page views and a small number of named site events (Vercel Web Analytics and PostHog) and, with sign-up attribution, the pages linked to your account when you sign up (see Campaign Attribution below)
  • Ad click measurement: campaign context such as a Google Ads click ID stored in your browser so we can tell which advertising works (see Campaign Attribution below)
  • Which add-in features you use and how quickly they respond, linked to your account
  • An anonymous install count: the first time an add-in opens, it stores a random number on your device (Google Sheets: in your Google settings) and sends it to us with the add-in version and the date you first sign in. It is never linked to your account
  • Error reports via Sentry (includes error messages, stack traces, device/browser info, the approximate country, region and city that Sentry works out from your IP address, and your account's internal ID when you are signed in; the Excel add-in also includes the last account that signed in on that device, even after you sign out)
  • Performance metrics

In the EEA, the UK, Switzerland, and every country we have not individually reviewed, PostHog keeps its identifiers in memory only unless you allow sign-up attribution, so analytics alone stores nothing on your device. Other things may still be saved in your browser: your own privacy choices, your display preference such as dark mode, strictly necessary cookies (see Cookies below), and, only if you allow ad click measurement, campaign attribution (see Campaign Attribution above) together with Google's own advertising storage. The notice offers two buttons: Allow all, or Cookie settings to decide per purpose. Until you allow them, ad click measurement and sign-up attribution stay off and no consent, campaign context, or consent receipt is recorded; analytics runs as described above. You can switch analytics off at any time under Privacy settings in the footer; that choice is stored in your browser and remembered.

In the reviewed markets (currently the United States, Australia, New Zealand, and South Africa) all three are active by default without a notice, PostHog stores its identifiers in your browser's local storage, and Privacy settings has a switch for each.

Error reports help us identify and fix bugs. They may include technical details about your session but do not include your Xero financial data.

Campaign Attribution

We capture limited marketing-campaign context: UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, and utm_content), ad-click identifiers (gclid and gad_source), the domain of the site that referred you, the landing page path, and the first and most recent times you arrived from a campaign link. We store this information in your browser's localStorage and, if you start Xero sign-in from our website, send it with that sign-in request to understand which campaigns lead to sign-ups. This website-to-account attribution is sent as an optional acquisition_context object.

Whether we capture this depends on where you are and on your choice:

  • EEA, UK, Switzerland, and other unreviewed countries: we capture campaign context only if you allow ad click measurement. If you switch it off, or make no choice, we store nothing.
  • Reviewed default-on markets (United States, Australia, New Zealand, South Africa): campaign capture is active by default. Turning ad click measurement off in Privacy Settings, or a Global Privacy Control signal, opts you out and clears stored campaign context.

In those reviewed markets only, and as part of analytics, we also record when you arrive from an AI assistant such as ChatGPT, Perplexity, Claude, Gemini, or Copilot. We store the assistant's domain, the landing page path, and the first and most recent times you arrived that way, and send them with sign-up in the same way. This record holds no ad-click identifier. Turning analytics off in Privacy Settings, or a Global Privacy Control signal, clears it. Outside the reviewed markets we do not keep this record.

In the same markets, on the same terms, we also record when you arrive from a search engine such as Google or Bing, or from an app store such as the Xero App Store, Microsoft AppSource, or the Google Workspace Marketplace. We keep only the site's main domain (for example google.com), the landing page path, and the first and most recent times, never your search words. An assistant or a campaign link takes precedence over this record.

When sign-up attribution is on and you sign up, we save PostHog's random visitor ID with your account. This links the pages you viewed on our website to your account, so we can see what brings customers. We never send your name or email to PostHog. You can switch this off in Privacy settings, or email us and we will remove the link.

We decide which rule applies using an approximate country classification derived from your IP address through Vercel's x-vercel-ip-country header. Its accuracy varies, so misclassification is possible and accepted.

The legal basis is your consent where we ask for it (the advertising measurement choice) and our legitimate interest in measuring marketing effectiveness elsewhere, including the website-to-account link.

How We Use Your Information

We use your information to:

  • Provide the XO Report service
  • Process your subscription and payments
  • Send important service updates
  • Send setup tips and occasional review requests
  • Provide customer support
  • Improve our product

We process your data based on:

  • Contract performance: Providing the service you subscribed to
  • Legitimate interests: Analytics operates under our legitimate interest in understanding site usage. It is collected through our own domain by the processors named above, is not used to identify you personally (except that, with sign-up attribution, the visitor identifier is saved with your account at sign-up; see Campaign Attribution), and does not track you across other sites. In the opt-in regions its identifiers are held in memory only unless you allow sign-up attribution, so analytics itself stores nothing on your device, and you can turn it off durably at any time in Privacy settings.
  • Consent: Ad click measurement and sign-up attribution are under consent in the opt-in regions and under a notice-and-opt-out approach in the reviewed markets. The opt-in regions are the EEA, the UK, Switzerland, and every country we have not individually reviewed.
  • Legitimate interests: Error reporting, security, and service improvement other than the consent choices described above
  • Legal obligations: Tax records and fraud prevention

Data Security

We implement industry-standard security measures to protect your data:

  • All data is transmitted using TLS encryption
  • OAuth tokens are stored securely and never shared
  • We use Supabase for secure data storage with row-level security
  • We do not store your Xero password

AI and Machine Learning

Your Xero financial data and the Google user data the Sheets add-on handles are never used for AI training, machine learning, or any form of automated profiling. We do not sell, share, or provide your data to third parties for AI/ML purposes. Your data is used solely to deliver the XO Report service to you.

Data Retention

We retain your account information for as long as your account is active. Xero financial data is cached temporarily to improve performance and automatically purged:

  • Financial reports (P&L, Balance Sheet, etc.): cached for up to 30 minutes
  • Reference data (Chart of Accounts, Contacts, Tax Rates, etc.): cached for up to 1 hour

No Xero financial data is permanently stored on our servers. You can request deletion of your account data at any time.

The visitor identifier saved with your account at sign-up (see Campaign Attribution) is kept for as long as your account exists and is deleted with it.

Install counts are deleted after 25 months.

When you allow ad click measurement or sign-up attribution, or turn analytics back on after switching it off, we record an affirmative receipt on our server for that grant, including the purpose settings recorded at that moment (analytics, ad click measurement, sign-up attribution), the consent version, notice ID and fingerprint, choices presented, service, server-received time, and a random receipt/grant identifier. Leaving the notice unanswered records no consent and sends no receipt. A refusal made in Privacy settings with no earlier grant is stored only locally in your browser and writes no receipt. The same is true of a Save in Privacy settings, made before any receipted grant, that only switches a purpose off or keeps your current choices: it writes no receipt, and whatever it needs to remember is kept only in your browser. Turning a purpose back on that was off is a grant and is receipted as described above. Changing your choices after a receipted grant sends one linked receipt for that change (a narrowing or a withdrawal) so the record of what you allowed stays accurate. In the reviewed default-on markets, all three may run without a prompt, subject to Global Privacy Control and your opt-out. The receipt also records the country and the consent policy our server observed for the request. The region is attested by our server, never claimed by your browser. A deployment identifier is included when available.

Consent receipts contain no IP address or user agent, are stored privately in Vercel's EU region, and are removed after approximately 24 months by a monthly sweep. When a best-effort withdrawal receipt is delivered, it links to the earlier grant.

Third-Party Services

We use the following third-party services:

  • Xero: Accounting data provider (subject to Xero's privacy policy)
  • Stripe: Payment processing (subject to Stripe's privacy policy)
  • Supabase: Database and authentication
  • Vercel (hosting): Web hosting for this site and the XO Report account portal (subject to Vercel's privacy policy)
  • Vercel Web Analytics: Subject to the analytics choice described above, this measures aggregate page views and a small number of named site events. For Analytics events, XO Report removes query strings and fragments from the event URL. Analytics processes the sanitized page path, referrer, approximate country, region and city, device type, operating-system and browser versions, and timestamp. Vercel derives a short-lived session hash from the incoming request; the IP address is used to derive it but is not stored in Analytics, and the hash is discarded after 24 hours. Vercel may process data internationally under its data-processing terms; private consent receipts in the EU do not limit all Vercel processing to the EU.
  • PostHog (analytics processor): As described above, PostHog measures website usage under a random identifier, without your name or email: page views, clicks, referrer, and campaign parameters (e.g. UTM tags), with an approximate location derived from your IP address. With sign-up attribution that identifier is saved with your account when you sign up (see Campaign Attribution). PostHog does not track you across other sites, and we never send it your name, email, or account identity. In opt-in regions, PostHog keeps its identifiers in memory only unless you allow sign-up attribution; in reviewed default-on markets, PostHog stores its identifiers in your browser's local storage. PostHog never uses a cookie for analytics. If you switch analytics off, PostHog records that opt-out flag in your browser so it stays off. Requests are routed through our own domain (not PostHog's), and are stored and processed in PostHog Cloud EU (Frankfurt). PostHog uses Cloudflare as a global network subprocessor at the connection edge, so this EU-residency guarantee covers where your data is stored and processed, not where the network connection first terminates.
  • Google Ads (ad click measurement): When ad click measurement is active, campaign identifiers such as a Google Ads click ID are stored in your browser. When advertising-measurement tags are enabled, this data is shared with Google for conversion measurement, and Google acts as an independent controller for that measurement under How Google uses information from sites or apps that use our services. This is measurement only: no personalized advertising takes place, and Google's ad_personalization signal is denied.
  • Sentry: Error monitoring and performance tracking, stored in the EU
  • Microsoft: Excel add-in platform
  • Google: Google Sheets add-on platform
  • Resend: Sends our emails to you, such as welcome, setup tips, trial, billing, review requests, and account deletion notices, plus account activity alerts to our own team. Located in the United States.
  • Cloudflare (security log archive): Stores our archive of security logs in Europe. Personal details in these logs are masked, and you are referred to only by a coded reference.

Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR) and similar laws, you have the following rights regarding your personal data:

  • Right to Access (Art. 15): Request a copy of all personal data we hold about you
  • Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data
  • Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten"), available self-service from your account portal or by contacting us
  • Right to Restriction (Art. 18): Restrict the processing of your personal data in certain circumstances
  • Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format
  • Right to Object (Art. 21): Object to processing of your personal data based on legitimate interests
  • Automated Decision-Making (Art. 22): We do not make decisions about you based solely on automated processing. With sign-up attribution we do link your website visits before sign-up to your account, as described in Campaign Attribution.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with a data-protection supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee. If you are in another EU/EEA country, you may also complain to your local authority.

How to Exercise Your Rights

You can exercise your rights in two ways:

  • Self-service deletion: Use "Delete My Account" from your account portal under Advanced. Your account enters a 30-day cooling-off period during which you can cancel the deletion. After 30 days, your personal data is permanently deleted, except the records listed under Delete Your Account below.
  • Email: Contact for any rights request. We will respond within 30 days as required by GDPR.

Delete Your Account

You can permanently delete your account and your personal data at any time, apart from the few records listed below. Here is how the process works:

  • How to request: Go to your account portal > Advanced > "Delete My Account", or email .
  • 30-day cooling-off period: After requesting deletion, your account enters a 30-day cooling-off period. During this time, you can cancel the deletion request from your account page (a banner at the top shows the scheduled deletion date and a Cancel Deletion button).
  • Immediate effects: Upon requesting deletion, your Xero access is disconnected, XO Report starts any related cache-cleanup work, and any active subscription enters the cancellation process.
  • After 30 days: Your account information, Xero organization connections, sign-in tokens, and cached Xero data are permanently deleted, and so is your customer record at Stripe.
  • Error reports: Any older add-in error reports stored in our own database are kept with your user ID removed. They can still contain your organization name and technical details of the error. Error reports at Sentry, including your account's internal ID, are deleted automatically 30 days after they are sent, so reports sent during the cooling-off period can remain for up to 30 days after your account is deleted.
  • Billing records: Billing records, including Stripe reference numbers, are kept for as long as accounting law requires (currently 7 years).
  • Deletion record: A record of the deletion is kept for compliance purposes. It holds a one-way coded version of your user ID, the deletion date, and your Stripe customer reference.
  • Backups: Our database backups are kept for 7 days, so deleted data can remain in a backup for up to 7 days after deletion.
  • Security logs: Our security log archive keeps entries about your account with personal details masked, referring to you only by a coded reference.

Cookies

Our website uses necessary cookies for authentication and session management. We also use browser localStorage to remember your consent choices. If your browser cannot read or save your consent choice there, we set one strictly necessary cookie, xo-report-consent-failsafe (and the same marker in your browser's session storage), that keeps every purpose switched off after a reload and in your other open tabs (and, while the cookie is stored, in any tab you open later) until a later choice can be saved normally; both are removed at that point and the cookie otherwise expires after 12 months. Analytics stays cookie-free: Vercel Web Analytics is cookieless, and PostHog keeps its identifiers in memory only in opt-in regions (unless you allow sign-up attribution) and in your browser's local storage in reviewed default-on markets. PostHog never uses a cookie for analytics, so neither provider ever sets an analytics cookie.

The website always works before you make a choice. In the EEA, the UK, Switzerland, and every unreviewed country, a notice appears when you first visit and asks about ad click measurement and sign-up attribution. The notice offers two buttons: Cookie settings and Allow all. Neither runs until you choose; analytics runs as described above. In the reviewed default-on markets (United States, Australia, New Zealand, South Africa) all three are on by default and no notice is shown; Privacy settings in the footer turns each off at any time.

A grant is valid for 12 months. A refusal remains until you change it or the scope materially changes. In August 2026 we added the advertising measurement purpose and therefore, in the jurisdictions where we ask for consent up front (the EEA, the UK, Switzerland, and every unreviewed country), re-asked prior refusals (once) whether they also wanted to allow it; their earlier refusal stayed in force until they answered. A durable refusal in a reviewed default-on market remains honoured there without a new prompt. Withdrawal takes effect immediately. A Global Privacy Control signal detected when the page loads is treated as a refusal of every purpose worldwide, including in the default-on markets.

Children's Privacy

XO Report is not intended for use by children under 16. We do not knowingly collect information from children.

International Data Transfers

Your data may be processed in countries outside your own, including the United States (where our infrastructure providers operate) and New Zealand (where Xero operates). Sentry error monitoring, website analytics, and consent records are kept in the EU. We ensure appropriate safeguards are in place, including Standard Contractual Clauses where required.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes via email or through our service.

Governing Law

This Privacy Policy is governed by the laws of the European Union, specifically the General Data Protection Regulation (GDPR).

Contact Us

If you have questions about this Privacy Policy, email us at .