Privacy Policy

What we collect

• Account information: Your name and email address when you create an account.
• Bank transaction data: When you upload bank statements, we process transaction descriptions, dates, and amounts to identify subscriptions. We retain only transaction records that our system identifies as subscription-related. Original uploaded files are not retained after processing.
• Email monitoring data (paid tier): If you connect an email account, we access your emails to detect subscription-related activity such as new signups, renewals, and cancellations. We retain structured records of detected subscription events — such as the service name, event type, date, and amount. We do not retain email content. Emails are processed and discarded.
• Subscription inventory: Service names, costs, payment cadence, and status — the core of what Xenon provides to you.
• Communication preferences: Your notification settings.

What we do not collect

We never collect or store passwords, login credentials, or access keys for your other services. We do not store bank account numbers. We do not store the content of your emails. We do not collect payment card details — payment processing is handled by a PCI-compliant third-party provider, and we only store a payment reference.

How we use your information

We use your information to provide the Xenon service: identifying subscriptions, monitoring for changes, and maintaining your subscription inventory. We also use your email address to send service communications (welcome emails, subscription alerts, weekly digests) which you can control via your notification preferences or unsubscribe at any time.

Third-party services

We share data with third-party services as necessary to operate Xenon:

• Authentication providers for account sign-in and email access
• A payment processor for billing
• Email delivery services for sending notifications
• Cloud hosting and database providers for running the application
• AI classification services for identifying subscription activity from transaction and email data

These services process data under their own data processing terms. We select providers that offer appropriate data handling commitments. We do not sell or share your personal information for advertising or marketing purposes.

Email access

When you connect an email account, we request read-only access. You can disconnect at any time from the Sources page, which revokes our access. Your existing subscription inventory and previously detected activity remain intact after disconnection — you will no longer receive alerts based on new email activity.

We support connecting multiple email accounts. Each connection can be managed independently.

Data retention

Your data is retained for as long as your account is active. If you delete your account, we delete all your personal data, subscription records, and communication logs.

Your rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Access your personal information — your subscription inventory is visible in the app, and you can request a full data export by contacting us
• Correct inaccurate information — you can update your subscription records directly, or contact us for account-level changes
• Delete your account and all associated data — contact us at support@goxenon.com

We aim to respond to all requests within 20 working days as required by the Act.

Security

We use encryption in transit (HTTPS/TLS) and encryption at rest at the database level. Email access tokens are stored encrypted. We do not store passwords.

Cookies

We use essential cookies for authentication and session management. We do not use tracking cookies or third-party advertising cookies. For details, see our Cookie Policy.

Changes to this policy

We may update this policy as Xenon evolves. Significant changes will be communicated via email. The "last updated" date at the top reflects when the policy was last revised.

Contact

If you have questions about your privacy or want to exercise your rights:

• Email: support@goxenon.com
• Address: Level 8, 139 Quay Street, Auckland, New Zealand

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner at privacy.org.nz.