Privacy Policy

This page explains what information Xylento collects, why, and how you can control it. If anything here is unclear, email [email protected].

What we collect

When you submit an application, we collect the founder and startup information you enter in the form (name, email, country, LinkedIn/GitHub/website links if provided, and everything about your startup), along with any files you attach. If you create an account, we also store your password (hashed, never in plain text), and — if you enable it — a two-factor authentication secret (encrypted at rest).

We automatically log basic technical data needed to operate and secure the service: IP address and browser user-agent at submission and login time, and timestamps of account activity.

What we don't collect

We don't run any third-party analytics, advertising trackers, or marketing pixels on this site. We don't sell or rent your data to anyone.

Payments

Payments are processed by Stripe. Your card number never reaches our servers — it's entered directly into Stripe's embedded payment form and sent straight to Stripe. We only ever see a payment status and the last 4 digits, via Stripe's systems.

Email

Transactional emails (application confirmations, status updates, notification pings) are sent through Resend. We don't send marketing email, and we don't add you to any mailing list. You can turn off notification emails at any time from your dashboard — you'll still see updates there, just without the email ping.

Who can see your application

Your application is visible only to the Xylento review team. It is never used to train AI models, shared with other applicants, or shown publicly.

Cookies

We use only strictly necessary cookies — a session cookie that keeps you logged in, and a short-lived cookie used during two-factor login. Both are set to HttpOnly and Secure, and are never used for tracking or advertising. See our Cookie Policy for details.

How long we keep data

We keep application and account data for as long as your account is active, or as needed to comply with legal, tax, or fraud-prevention obligations. If you request deletion (below), we remove what we're not legally required to retain.

Your rights

You can request a copy of the data we hold about you, ask us to correct it, or request deletion of your account and associated data, by emailing [email protected] from the email address on your account. We'll respond within a reasonable time, and no later than 30 days.

Note: your original application data is locked once submitted and paid for, so we can maintain an honest record of what was reviewed — but this doesn't affect your right to request its deletion.

Changes to this policy

If we make material changes to how we handle your data, we'll update the date at the top of this page and, where appropriate, notify account holders directly.