Skip to main content

Privacy Policy

Last updated: August 2026

Overview

XO Report ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our Excel add-in and related services.

XO Report is the data controller for your personal data. For privacy-related inquiries, contact us at .

Data Controller

XO Report is operated by Clovis Global. For privacy inquiries: .

Information We Collect

Account Information

When you authenticate with Xero, we collect:

  • Your email address and name (from your Xero profile)
  • Your Xero user identifier
  • Names and identifiers of Xero organizations you authorize
  • Subscription and billing information (via Stripe)

Xero Data Access

XO Report connects to Xero using OAuth 2.0 with read-only access to your accounting data. We never create, modify, or delete any data in your Xero account. We access your Xero data only to provide the functionality you request (pulling data into Excel) and do not store your Xero financial data permanently on our servers.

We access the following Xero data based on your usage (read-only):

  • Chart of Accounts
  • Contacts (customers and suppliers)
  • Invoices and Bills
  • Payments and Credit Notes
  • Financial Reports (P&L, Balance Sheet, etc.)
  • Tracking Categories
  • Tax Rates and Currencies

Usage Data and Error Reporting

We collect limited data to improve our service and fix issues. Website page and event analytics are collected through Vercel Web Analytics and PostHog only after your consent:

  • Aggregate website page views and a small number of named site events (Vercel Web Analytics and PostHog)
  • Which add-in features you use (anonymized)
  • Error reports via Sentry (includes error messages, stack traces, and device/browser info)
  • Performance metrics

Error reports help us identify and fix bugs. They may include technical details about your session but do not include your Xero financial data.

Campaign Attribution

We capture limited marketing-campaign context — UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, and utm_content), ad-click identifiers (gclid and gad_source), the domain of the site that referred you, the landing page path, and the first and most recent times you arrived from a campaign link. We store this information in your browser's localStorage and, if you start Xero sign-in from our website, send it with that sign-in request to understand which campaigns lead to sign-ups. This website-to-account attribution is sent as an optional acquisition_context object.

This applies only to visitors outside the EEA, UK, and Switzerland. For visitors in those regions, we capture none of this. An explicit "Reject" choice or a Global Privacy Control signal always opts out and clears any stored attribution value.

We decide whether this applies using an approximate country classification derived from your IP address through Vercel's x-vercel-ip-country header. Its accuracy varies, so misclassification is possible and accepted.

The legal basis is our legitimate interest in measuring marketing effectiveness and, for the website-to-account link, contract performance and legitimate interest. This processing is not tied to your analytics consent choice.

How We Use Your Information

We use your information to:

  • Provide the XO Report service
  • Process your subscription and payments
  • Send important service updates
  • Provide customer support
  • Improve our product

We process your data based on:

  • Contract performance: Providing the service you subscribed to
  • Consent: Vercel Web Analytics and PostHog, which we use only after your consent
  • Legitimate interests: Error reporting, security, and service improvement other than Vercel Web Analytics
  • Legal obligations: Tax records and fraud prevention

Data Security

We implement industry-standard security measures to protect your data:

  • All data is transmitted using TLS encryption
  • OAuth tokens are stored securely and never shared
  • We use Supabase for secure data storage with row-level security
  • We do not store your Xero password

AI and Machine Learning

Your Xero financial data is never used for AI training, machine learning, or any form of automated profiling. We do not sell, share, or provide your data to third parties for AI/ML purposes. Your data is used solely to deliver the XO Report service to you.

Data Retention

We retain your account information for as long as your account is active. Xero financial data is cached temporarily to improve performance and automatically purged:

  • Financial reports (P&L, Balance Sheet, etc.): cached for up to 5 minutes
  • Reference data (Chart of Accounts, Contacts, Tax Rates, etc.): cached for up to 1 hour

No Xero financial data is permanently stored on our servers. You can request deletion of your account data at any time.

Before analytics starts (Vercel Web Analytics and PostHog), we record the affirmative choice, consent version, notice ID and fingerprint, choices presented, service, server-received time, and a random receipt/grant identifier. A deployment identifier is included when available.

Consent receipts contain no IP address or user agent, are stored privately in Vercel's EU region, and are removed after approximately 24 months by a monthly sweep. When a best-effort withdrawal receipt is delivered, it links to the earlier grant.

Third-Party Services

We use the following third-party services:

  • Xero:Accounting data provider (subject to Xero's privacy policy)
  • Stripe:Payment processing (subject to Stripe's privacy policy)
  • Supabase: Database and authentication
  • Vercel (hosting):Web hosting for this site and the XO Report account portal (subject to Vercel's privacy policy)
  • Vercel Web Analytics: After your consent, this measures aggregate page views and a small number of named site events. For Analytics events, XO Report removes query strings and fragments from the event URL. Analytics processes the sanitized page path, referrer, approximate country, region and city, device type, operating-system and browser versions, and timestamp. Vercel derives a short-lived session hash from the incoming request; the IP address is used to derive it but is not stored in Analytics, and the hash is discarded after 24 hours. Vercel may process data internationally under its data-processing terms; private consent receipts in the EU do not limit all Vercel processing to the EU.
  • PostHog (analytics processor):After your consent, PostHog measures anonymous website usage — page views, clicks, referrer, and campaign parameters (e.g. UTM tags) — with an approximate location derived from your IP address. PostHog does not track you across other sites, and we never send it your name, email, or account identity. Requests are routed through our own domain (not PostHog's), and are stored and processed in PostHog Cloud EU (Frankfurt). PostHog uses Cloudflare as a global network subprocessor at the connection edge, so this EU-residency guarantee covers where your data is stored and processed, not where the network connection first terminates.
  • Sentry: Error monitoring and performance tracking
  • Microsoft: Excel add-in platform
  • Twilio SendGrid:Transactional / operational email relay for service notifications (subject to Twilio's privacy policy)

Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR) and similar laws, you have the following rights regarding your personal data:

  • Right to Access (Art. 15): Request a copy of all personal data we hold about you
  • Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data
  • Right to Erasure (Art. 17):Request deletion of your personal data ("right to be forgotten") — available self-service from your account portal or by contacting us
  • Right to Restriction (Art. 18): Restrict the processing of your personal data in certain circumstances
  • Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format
  • Right to Object (Art. 21): Object to processing of your personal data based on legitimate interests
  • Automated Decision-Making (Art. 22): We do not make automated decisions about you. Your data is never used for profiling or automated decision-making.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with a data-protection supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — aki.ee. If you are in another EU/EEA country, you may also complain to your local authority.

How to Exercise Your Rights

You can exercise your rights in two ways:

  • Self-service deletion:Use "Delete My Account" from your account portal under Advanced. Your account enters a 30-day cooling-off period during which you can cancel the deletion. After 30 days, all personal data is permanently deleted.
  • Email: Contact for any rights request. We will respond within 30 days as required by GDPR.

Delete Your Account

You can permanently delete your account and all associated personal data at any time. Here is how the process works:

  • How to request: Go to your account portal > Advanced > "Delete My Account", or email .
  • 30-day cooling-off period: After requesting deletion, your account enters a 30-day cooling-off period. During this time, you can cancel the deletion request from your account page (a banner at the top shows the scheduled deletion date and a Cancel Deletion button).
  • Immediate effects: Upon requesting deletion, your Xero access is disconnected, XO Report starts any related cache-cleanup work, and any active subscription enters the cancellation process.
  • After 30 days: All personal data is permanently and irreversibly deleted, including your account information, Xero organization data, authentication tokens, and error reports linked to your account.
  • Billing records: Anonymized billing records (with no personally identifiable information) are retained for 7 years as required by applicable accounting law.
  • Audit trail: An anonymized record of the deletion event is kept for compliance purposes. This record contains only a one-way hash of your user ID (not reversible to your identity) and the deletion timestamp.

Cookies

Our website uses necessary cookies for authentication and session management. We also use browser localStorage to remember your analytics choice. Analytics stays cookie-free: Vercel Web Analytics is cookieless, and PostHog is configured to store its data in localStorage only, so neither provider ever sets an analytics cookie.

The website works before you make a choice. Vercel Web Analytics and PostHog run only after your consent. A grant is valid for 12 months. A refusal remains until you change it or the analytics scope materially changes — for example, in August 2026 we added PostHog as a second analytics provider and asked everyone again. Privacy Settings in the footer lets you change your choice, and withdrawal takes effect immediately. A Global Privacy Control signal detected when the page loads is treated as a refusal worldwide.

Children's Privacy

XO Report is not intended for use by children under 16. We do not knowingly collect information from children.

International Data Transfers

Your data may be processed in countries outside your own, including the United States (where our infrastructure providers operate). We ensure appropriate safeguards are in place, including Standard Contractual Clauses where required.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes via email or through our service.

Governing Law

This Privacy Policy is governed by the laws of the European Union, specifically the General Data Protection Regulation (GDPR).

Contact Us

If you have questions about this Privacy Policy, email us at .