Xavio
Two roles, and why it matters which one
Xavio is an ERP. Almost none of the personal data inside it is about us or belongs to us: it is data your company enters about its own customers, suppliers and employees.
For that data, your company is the controller — it decides why the data is collected and what happens to it — and we are a processor: we handle it only to keep the application running, on your company's documented instructions. The terms are set out on the Data processing page.
For a much smaller set of data we are the controller ourselves: user accounts, the invoicing of our own service, support, and platform security. The rest of this page is about that set.
What we process as controller
- The account: name, email address, the password (kept only as a hash, never in plain text), and the two-step authentication settings.
- The company the account belongs to and the rights the person has in it.
- Technical data: IP address, browser identifier, sign-in times, open sessions and, for the mobile application, the device name, platform and application version.
- The audit log: which action was taken, by whom, and when.
- Support correspondence, if you write to us.
- Billing details of the company, for the Xavio subscription.
Why, and on what legal basis
Performance of the contract: keeping the accounts, running the application, support. Legal obligation: invoicing our own service, accounting, answering lawful requests from the authorities. Legitimate interest: platform security, preventing abuse, the audit log, measuring performance. Consent: only where we ask for it separately — today, nowhere in the application.
What we do not do
We do not use the data for advertising and we do not sell it. Neither the application nor these public pages contain any analytics or tracking tool — no Google Analytics, no social-network pixels, no click maps.
One thing does leave: these public pages load the Sora and Inter typefaces from Google Fonts, so Google receives the IP address of the visitor who loads them. Nothing else on these pages comes from another domain.
Who touches the data besides us
We use a small number of suppliers, and only for what the service needs:
- Hetzner Online GmbH Germany (Nuremberg)
Hosting of the application and the database. - Hetzner Online GmbH — Storage Box Germany (Falkenstein)
Backups, encrypted before they leave the server. - Cyber_Folks SRL Romania
The mail server used to send platform messages and the company documents sent to its customers. - Anthropic Ireland, Limited (Anthropic) Ireland (the contract); data is stored in the US
The language model behind Xavi, the AI assistant — only for the companies on which Xavi is used. Details in the Xavi transparency statement. - sendSMS.ro / SMSO.ro Romania
Sending text messages — only if the company enables the channel and configures its own API key.
Separately, and not as a supplier: when your company sends an invoice through e-Invoicing, the document reaches ANAF, the Romanian tax authority. That is a legal obligation of your company, and ANAF is an authority, not our subprocessor. The same applies to a VAT-number check against the public ANAF service.
Where the data is kept, and for how long
The application, the database and the backups are in the European Economic Area — Germany for hosting and backups, Romania for the mail server.
One exception: Xavi, the AI assistant. On the companies where it is used, the questions put to it and the company data it reads to answer them go to Anthropic, which stores data in the US. The safeguard is the European Commission's standard contractual clauses. Everything is set out on the Xavi transparency statement page. Apart from Xavi, we do not transfer personal data outside the EEA.
Account data is kept while the account is active. The audit log is kept for 3 years. Backups roll off on their own: 7 daily, 4 weekly and 6 monthly copies, after which they are gone. Invoices we issue for our own service are kept for the period required by Romanian accounting law.
Security
Access over HTTPS only. Passwords are stored as hashes, never recoverable. Two-step authentication is available to every account. Each company is isolated in its own workspace. Actions on documents, rights, roles and settings leave a trace in the audit log, together with the person, the time, the IP address and the browser identifier.
The database is dumped every night and copied off-site encrypted, and a watchdog raises an alarm if a night is missed. The server accepts only key-based sign-in, for one administrative account.
Your rights, and who to ask
You may ask for access, correction, deletion, restriction, portability or objection, and you may complain to the supervisory authority — in Romania, ANSPDCP.
Which door to knock on matters. If you have a Xavio account, write to us at contact@xavio.ro. If you are a customer, supplier or employee of a company that uses Xavio and you found your data there, that company is the controller — the request goes to it. If a request of that kind reaches us, we pass it on to the company and do not decide it ourselves.
Minors
Xavio is a tool for companies. It is not intended for and is not addressed to children, and we do not knowingly create accounts for people under 16.
Changes to this policy
When the application starts processing data differently — a new feature, a new supplier, a different retention period — this policy is updated before the change goes live, not after. The date at the top of the page shows the current version.
What the application does today
One working screen: the company dashboard, read-only. You sign in with the same account as on the web — the email address and password from Xavio — and you see the figures your rights allow. Nothing is entered, changed or signed from the application.
What it keeps about the device
The sign-in token is kept in the iOS Keychain and is valid for 60 days, after which you sign in again. Alongside it, the server keeps: a hash of the token (never the token itself), the device name, the platform, the application version, the IP address of the last use, the time of the last use, and the expiry date. Signing out withdraws the token on both sides.
What it does not ask for at all
No location, no camera, no contacts from the phone, no microphone, no notifications. The application declares no system permission, so iOS never has anything to ask you about. No advertising, no analytics, no third-party SDK.
The company data is not kept on the phone
The figures are requested from the server each time the screen opens, over HTTPS, and are not written to the device. If you lose the phone, withdrawing the token — by signing out from another device or by asking us — is enough to stop the access.
What is coming, and what that means for this page
Field collections, issuing invoices and barcode scanning are planned. Barcode scanning will need the camera. We are not promising them here and the application does not do them today. When one of them arrives, this page is updated — and the App Store and Google Play declarations with it — before the version that contains it is published.