Privacy Policy

Xulah is responsible for deciding how personal information covered by this Privacy Policy is used.

Questions about this policy or your personal information can be sent to info@xulah.com.

This policy applies to Xulah’s website, account system, content intelligence tools, generated content, content calendars, subscriptions, communications and related services.

Third-party websites and services linked from Xulah operate under their own privacy policies.

Depending on how you use Xulah, we may collect:

Account and profile information

• your email address;
• account and authentication identifiers;
• your selected region or location preference;
• your subscription plan and account status; and
• information you provide when contacting support.

Prompts and generated content

• topics, instructions and prompts you submit;
• business, audience and content information you provide;
• content generated or refined through Xulah;
• saved history, calendars and content preferences; and
• images or other material you choose to submit.

Payment and subscription information

• selected plan and billing status;
• payment-provider customer and subscription identifiers;
• transaction references;
• billing dates and renewal information; and
• payment confirmation or failure information.

Xulah does not normally receive or store your full card number. Card and payment details are handled by the relevant payment provider.

Device, security and technical information

• IP address;
• browser and device information;
• device identifiers or protected device hashes;
• login and device-transfer events;
• verification and security records;
• usage information; and
• error and diagnostic information.

Intelligence Circle information

Where you join the Xulah Intelligence Circle, we may collect your first name, email address, business type and information about your content challenges.

We collect information:

• directly from you when you create or use an account;
• when you submit prompts, forms or support requests;
• automatically when you use the website or service;
• from payment providers when a transaction is processed;
• from authentication and security systems; and
• from service providers that support Xulah’s operation.

We may use personal information to:

• create and operate your account;
• authenticate you and protect account access;
• provide content generation and refinement services;
• create and save content calendars and generated content;
• manage trials, plans, subscriptions and usage limits;
• process and confirm payments;
• send verification, security and service messages;
• respond to support requests and complaints;
• detect fraud, misuse and security threats;
• maintain, troubleshoot and improve Xulah;
• comply with legal, financial and regulatory obligations;
• send marketing communications where permitted; and
• manage the Xulah Intelligence Circle.

Under applicable UK data-protection law, we rely on one or more of the following lawful reasons:

Contract

We use information where it is necessary to create your account, provide the service, manage your subscription or respond to requests connected with your use of Xulah.

Legitimate interests

We may use information to secure the service, prevent misuse, understand performance, provide support and improve Xulah where those interests are not overridden by your rights.

Legal obligations

We may process information to comply with tax, accounting, legal, regulatory or law-enforcement requirements.

Consent

Where required, we rely on your consent for activities such as optional marketing communications or non-essential tracking. You may withdraw consent at any time.

Information contained in your prompts and instructions may be sent to artificial-intelligence service providers so that Xulah can generate, analyse, rewrite or improve content.

You should not submit confidential, highly sensitive or unnecessary personal information in a prompt.

Generated content and related account information may be stored so that you can access your history, calendars and saved work.

Payments and subscriptions may be processed by Stripe or Paystack, depending on your region and selected payment method.

These providers process payment information under their own privacy policies and security arrangements.

Xulah may receive information such as payment status, subscription status, customer identifiers, transaction references and billing dates.

We may share information with service providers where reasonably necessary to operate Xulah.

These may include:

• Supabase for authentication, database and account services;
• OpenAI for artificial-intelligence processing;
• Stripe and Paystack for payment and subscription processing;
• Resend for verification and service emails;
• Brevo for Intelligence Circle and permitted email communications;
• Vercel for hosting and delivery of the website and application; and
• Unsplash and Pexels for suggested media and image-search services.

We may also disclose information where required by law, to protect Xulah or another person, to investigate fraud or security incidents, or in connection with a business sale, reorganisation or transfer.

We do not sell your personal information.

Some service providers may process information outside the United Kingdom.

Where required, we take reasonable steps to ensure that an appropriate legal safeguard applies to an international transfer, such as an adequacy regulation or approved contractual protections.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected.

Account information and saved content may be retained while your account remains open.

After an account is closed, some information may be retained for a limited period for security, dispute resolution, fraud prevention, accounting, tax or legal purposes.

Payment and transaction records may be retained for the period required by applicable financial, tax and legal obligations.

Verification codes are intended for short-term use, although related security records may be retained where reasonably necessary.

We may delete or anonymise information when it is no longer required.

We use reasonable technical and organisational measures designed to protect personal information.

These may include:

• authenticated account access;
• device-verification controls;
• protected device identifiers;
• database access controls;
• encrypted network connections;
• payment processing through specialist providers; and
• monitoring for suspicious or unauthorised activity.

No internet service or storage system can guarantee absolute security. You are also responsible for protecting your password, email account and verification codes.

Depending on the circumstances, you may have the right to:

• request access to your personal information;
• ask us to correct inaccurate information;
• ask us to delete information;
• ask us to restrict how information is used;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• complain to a data-protection authority.

These rights are not absolute and may depend on the reason we hold the information.

To make a request, email info@xulah.com. We may need to confirm your identity before completing the request.

You may also have the right to complain to the UK Information Commissioner’s Office.

Xulah may use cookies, browser storage and similar technologies to keep you signed in, maintain sessions, remember preferences, protect accounts and support the operation of the service.

Some technologies are necessary for Xulah to work correctly. Where the law requires consent for an optional technology, we will request that consent.

You can control cookies through your browser settings, although blocking necessary cookies or storage may prevent parts of Xulah from working.

We may send product news, Intelligence Circle messages or other marketing communications where you have requested them or where otherwise permitted by law.

You can unsubscribe using the link in an email or by contacting info@xulah.com.

We may still send essential account, payment, security or service messages after you unsubscribe from marketing.

Xulah is not intended for anyone under 18 years old. We do not knowingly invite children to create accounts or purchase subscriptions.

Contact us if you believe that a child has provided personal information to Xulah.

We may update this Privacy Policy when Xulah’s services, technology, providers or legal obligations change.

The latest version will be published on xulah.com with its effective date.

For privacy questions, requests or complaints, email info@xulah.com.