Data we collect
xYago collects your name, phone number, associated companies and the time records, messages and files you generate inside the app. We do not access your location or your contacts without your explicit permission.
Use of the information
Your data is used only for the purposes described in this policy: managing your account, providing and improving the services, and enabling communication with your companies. We never sell your information to third parties.
Legal basis and compliance
We only process your information with your consent or where a legal basis justifies it: performance of the contract with your company, compliance with statutory working-time record obligations, or a proportionate legitimate interest.
AI assistant and automatic translation
xYago offers an AI assistant (drafting, shortening and summarising messages) and automatic translation. For these features we use Google's Gemini models (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) via the Google Cloud / Gemini API.
When you use an AI feature, the relevant text (e.g. the message to be translated or rephrased) is sent to Google and processed there. No other profile data is transmitted. Google does not use data submitted via the API to train its models. Processing is based on Art. 6(1)(b) GDPR (performance of contract) and your use of the feature. A data processing agreement including EU standard contractual clauses is in place with Google.
More information: cloud.google.com/terms/data-processing-addendum and ai.google.dev/gemini-api/terms.
Storage and security
Information is transmitted encrypted (TLS) and stored on access-restricted servers located in the European Union. Chat conversations use end-to-end encryption. We adopt the measures needed to guarantee its confidentiality and security.
Retention
Working-time records and employment documents are kept for the period required by the rules applicable to your company. The rest of your account data is deleted 90 days after closing it, unless a legal obligation requires us to keep it.
Your rights (GDPR)
You can request access, rectification, portability or deletion of your data at any time from Profile → Support in the app, or by writing to hi@candelasoft.com. We will respond within 15 working days at most. You can also withdraw your consent whenever you wish and lodge a complaint with the competent supervisory authority.
- Access to and a copy of your data
- Rectification of inaccurate data
- Portability in a readable format
- Erasure and withdrawal of consent
- Objection to and restriction of processing