Using XKey
Privacy Policy
This policy explains how XKey handles information across its website, PowerPoint add-in, accounts, licensing, team features, support, and billing.
Effective date:
1. Operator and scope
Infiniti is the name under which an individual based in Japan operates XKey. This policy applies to the XKey website, PowerPoint add-in, account and team features, licensing, support, and billing (together, the “Service”).
Privacy questions, requests, and complaints may be sent to support@infiniticlips.com. Legally required information about the operator, including the operator’s name and address and information about safeguards, will be provided to a verified requester without undue delay where applicable.
2. Information we handle
The information handled depends on the features you use. We collect information you provide, information generated when the Service is used, and limited technical information received from service providers.
- Account and team information: name, email address, authentication identifiers, session information, team or organization name, membership, roles, and invited email addresses. An organization may provide your email address and initial name when inviting you.
- License and device information: account and license identifiers, hardware or device identifier, device name, app version, activation status, and license history.
- Purchase and billing information: product, plan, subscription and transaction identifiers, billing name, phone number and address, country, tax information, and payment status. Stripe handles payment-card details; XKey does not store complete card numbers.
- Support information: full name, email address, subject, message, and related correspondence submitted through the contact form or by email.
- Technical information: IP address and request metadata, browser or device information, visited route, timestamps, shortcut-usage counts, errors, performance traces, and sampled session-replay data. Signed-in diagnostics can include your Supabase user ID and email. Anonymous embedded sessions can use a hardware identifier; other browser sessions use a random tab-session identifier. These identifiers may be personal information even when they do not contain your name.
4. Purposes of use
We use information only as reasonably necessary for the following purposes:
Where the GDPR or UK GDPR applies, requested account, licensing and billing services rely on performance of our agreement; required tax and recordkeeping activities rely on legal obligations; and security, abuse prevention, troubleshooting and reliability rely on our legitimate interests, subject to your rights. Where applicable law requires consent for a specific activity, this notice and acceptance of the Terms do not replace that consent.
- Create and secure accounts, authenticate users, and provide account recovery.
- Issue and verify licenses, register devices, enforce plan and seat limits, and administer teams.
- Process purchases, subscriptions, renewals, cancellations, taxes, billing support, and fraud prevention.
- Respond to inquiries, provide support, send service notices, and keep necessary correspondence records.
- Operate, secure, troubleshoot, measure, and improve the Service and comply with legal obligations.
- Establish, exercise, or defend legal claims and enforce the Terms of Service.
5. Service providers, disclosure, and overseas processing
Vercel hosts the website and APIs; Supabase provides authentication and hosted account, team, device, license and usage data; Stripe provides checkout, billing, tax and payment services; Resend delivers contact-form email to our support mailbox; and Sentry provides error, performance and sampled session-replay diagnostics. Contact submissions are delivered by email rather than duplicated in a contact table in Supabase. Identity providers you choose handle sign-in under their own policies. GitHub distributes public installer assets and update metadata and can receive request metadata such as an IP address.
Providers and their subprocessors may process information outside Japan, including in the United States and other countries. Provider-specific locations, transfer safeguards and subprocessors are described in their published privacy and contractual materials; a regional database does not establish a single-country boundary for every provider. Contact us for information relevant to your organization’s review. We may also disclose information as required by law, to protect rights or safety, in connection with a transfer of the Service, or with your direction or consent. We do not sell personal information.
6. Retention and account closure
Sentry diagnostic events are retained for a maximum of 30 days under our current plan. Account, license and billing records are kept as needed to provide the Service and meet applicable security, dispute, legal or accounting obligations. Support correspondence, other operational logs, backups and payment-provider records follow their respective purposes and retention schedules.
Contact support@infiniticlips.com to request account closure or deletion. We review identity, team ownership, billing and applicable recordkeeping requirements before removing or restricting records. Deleting an account does not instantly erase support email, Sentry events, provider logs, backups or payment records; those require their respective deletion processes or retention schedules. Uninstalling the add-in preserves local user data and does not cancel a subscription. Local files and data held independently by payment or identity providers must be handled separately.
7. Security measures
Controls include verified server-side authentication, team authorization, database row-level policies, restricted server credentials and HTTPS connections to hosted services. Team ownership does not authorize changing another member’s global profile name. Provider certifications cover the provider’s stated scope and do not certify XKey. The Security & Data Handling page describes the current product boundaries and links to provider evidence. No internet transmission or storage system can be guaranteed completely secure.
8. Your requests and choices
Contact support@infiniticlips.com to request notice of purpose, access, correction, deletion, suspension of use, or information about applicable safeguards and overseas processing. We may verify your identity and may retain or withhold information where permitted or required by law.
You can manage account information, devices, teams, subscriptions and local settings through the available controls. Depending on applicable law, you may also request restriction, object to processing, request portability, withdraw consent where processing relies on consent, or complain to a competent data-protection authority. Blocking or clearing cookies/browser storage can affect authenticated features. An employer’s team administrator controls membership and seats, not your global profile name.
9. Children
The Service is not directed to children. A minor may use it only with the consent and supervision required by applicable law. If you believe a child provided personal information without appropriate consent, contact us so we can investigate and take appropriate action.
10. Changes and contact
We may update this policy to reflect changes to the Service, providers, or law. Material changes will be posted here with a new effective date and, where appropriate, communicated through the Service. Questions, complaints, and requests should be sent to support@infiniticlips.com.