Privacy Policy

Your privacy is our priority. Learn how we collect, use, and protect your personal information.

Last Updated: January 1, 2026

Encrypted & Secure

All health data encrypted end-to-end with military-grade security

GDPR Compliant

Full compliance with EU data protection regulations and rights

You're In Control

Export, modify, or delete your data anytime with one click

Our Privacy CommitmentWe never sell your personal health data. Period. Your information is encrypted, anonymized for analytics, and used solely to provide you with personalized health insights and platform services.

1. Privacy Overview

Who we are and what this policy covers

This Privacy Policy explains how Xenacious AB ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you use our health and wellness platform (the "Service"). This policy applies to all users regardless of location and complies with GDPR, CCPA, and other applicable privacy regulations.

Data Controller Information

Company: Xenacious AB

Location: Stockholm, Sweden

Data Protection Officer: daniel@xenacious.io

EU Representative: [EU-REP-CONTACT]

2. Information We Collect

What data we gather and why

Account & Profile Information

Purpose: Account creation, authentication, and personalization

Required: Email address, username, password (encrypted)
Optional: Full name, profile photo, date of birth, location
Preferences: Language, timezone, notification settings

Health & Wellness Data (Optional)

Fully Encrypted: All health data is encrypted at rest and in transit using AES-256 encryption.

From Connected Devices:

• Heart rate and HRV
• Sleep duration and quality
• Steps and activity levels
• Workout sessions and calories
• Body temperature and stress

User-Provided Data:

• Health goals and preferences
• Dietary restrictions
• Wellness journal entries
• AI coach conversations
• Challenge participation

Usage & Technical Information

Purpose: Platform improvements, security, and analytics

IP address and device information
Browser type and operating system
Pages visited and features used

Session duration and frequency
Error logs and crash reports
Performance metrics

Blockchain & Wallet Information

Public blockchain addresses for OPXEN token transactions

Transaction history (publicly visible on blockchain)

Wallet connection data (we never store private keys)

We never have access to your wallet private keys. All wallet interactions use secure, industry-standard protocols (WalletConnect, Web3).

3. How We Use Your Information

Purposes and legal basis

Personalized AI Insights

Generate health recommendations
Track progress and patterns
Provide coaching feedback
Predict wellness trends

Platform Functionality

Enable core features
Process OPXEN rewards
Facilitate community interaction
Manage challenges

Security & Safety

Detect fraud and abuse
Prevent unauthorized access
Monitor suspicious activity
Comply with regulations

Communication

Send account notifications
Provide security alerts
Share platform updates
Deliver newsletters (optional)

Legal Basis (GDPR): We process your data based on (1) your consent, (2) contract performance, (3) legal obligations, and (4) legitimate interests in improving our service.

4. Data Security & Protection

How we safeguard your information

Encryption

• AES-256 encryption at rest
• TLS 1.3 in transit
• Encrypted backups

Access Control

• Row-level security
• Role-based access
• MFA authentication

Infrastructure

• SOC 2 certified hosting
• Regular security audits
• Automated monitoring

Security Commitment: We implement industry-leading security measures including encryption, access controls, and regular security audits. In the unlikely event of a data breach, we will notify affected users within 72 hours as required by GDPR.

5. Your Privacy Rights (GDPR)

Control over your personal data

Under GDPR and other privacy laws, you have comprehensive rights regarding your personal data. We make it easy to exercise these rights through your account settings or by contacting our privacy team.

Right to Access

Request a copy of all personal data we hold about you

Right to Rectification

Correct any inaccurate or incomplete personal information

Right to Erasure

Request deletion of your account and all associated data

Right to Portability

Receive your data in a structured, machine-readable format

Right to Object

Object to processing of your data for specific purposes

Right to Restrict

Limit how we use your data in certain circumstances

Easy Exercise: Most rights can be exercised directly through your account settings. For complex requests, contact daniel@xenacious.io. We respond within 30 days.

6. Data Sharing & Third Parties

When and how we share information

We NEVER Sell Your Health Data - Your personal health information is never sold, rented, or traded to third parties for marketing or advertising purposes.

We only share data in these limited circumstances:

Service Providers

DPA Required

Cloud hosting (AWS/Supabase), analytics, email delivery - all bound by strict data processing agreements

With Your Consent

User Controlled

When you explicitly authorize sharing with coaches, community members, or third-party apps

Legal Requirements

Legal Obligation

When required by law, court order, or to protect rights and safety

Aggregated Analytics

Anonymized Only

Anonymized, aggregated data for research and platform improvements (no personal identification)

7. Cookies & Tracking Technologies

How we use cookies

We use cookies and similar technologies to enhance your experience, analyze usage, and improve our services.

Essential

Required

Authentication, security, session management

Analytics

Optional

Usage statistics, performance monitoring

Preferences

Optional

Language, theme, notification settings

You can manage cookie preferences in your browser settings or through our cookie consent banner. Note that disabling essential cookies may limit platform functionality.

8. Children's Privacy

Age requirements and protections

Age Requirement: Our Service is intended for users aged 18 and older. We do not knowingly collect data from children under 18 without parental consent.

If we discover that we have inadvertently collected data from a child under 18, we will delete it immediately. Parents or guardians who believe their child has provided us with personal information should contact daniel@xenacious.io.

9. International Data Transfers

How we protect your data globally

Xenacious is based in Sweden (EU), but our service providers may process data in other jurisdictions. We ensure all international transfers comply with GDPR through appropriate safeguards.

GDPR Protections

• Standard Contractual Clauses (SCCs)
• Adequacy decisions where applicable
• Additional security measures

Data Locations

• Primary: EU (Sweden)
• Cloud hosting: AWS (EU regions)
• Backups: Encrypted EU storage

10. Data Retention

How long we keep your information

Active Account Data

Duration of account + 30 days after deletion request

Health & Wellness Data

Duration of account + 30 days (fully encrypted)

Transaction Records

7 years (legal requirement for financial records)

Anonymized Analytics

Indefinitely (no personal identification possible)

Security Logs

90 days rolling (for fraud detection and security)

Account Deletion: When you delete your account, we remove all personal data within 30 days, except where legal obligations require retention (e.g., financial records).

Privacy Questions or Concerns?

Our Data Protection Officer and privacy team are here to help with any questions, concerns, or requests regarding your personal data.

daniel@xenacious.io

Data Protection Officer

Xenacious AB

Stockholm, Sweden

EU Representative: [EU-REP-CONTACT]

Lodge a Complaint: If you're unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority or the Swedish Data Protection Authority (Datainspektionen).